Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-63689 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-07T15:59:41.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrary code via the orderby parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ycf1998/money-pos/issues/3 - https://gist.github.com/LockeTom/2ed0f3751c88542f48b7c230468d2a46
CVE ID: CVE-2025-63690 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-07T18:41:28.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat's built-in class jakarta.el.ELProcessor can be used to execute commands, leading to a remote code execution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.co
remote code execution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pig-mesh/pig/issues/1199 - https://github.com/LockeTom/vulnerability/blob/main/md/pig_Remote_Code_Execution_Vulnerability.md
CVE ID: CVE-2025-63691 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-07T18:49:24.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this
ly logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pig-mesh/pig/issues/1202 - https://github.com/LockeTom/vulnerability/blob/main/md/pig_Information_disclosure_vulnerability.md
CVE ID: CVE-2025-63693 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T14:41:00.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yohane-Mashiro/dzzoffice_xss - https://github.com/zyx0814/dzzoffice/i
ADP Vulnrichment: References: - https://github.com/Yohane-Mashiro/dzzoffice_xss - https://github.com/zyx0814/dzzoffice/issues/363
CVE ID: CVE-2025-63694 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T16:49:58.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zyx0814/dzzoffice/issues/364 - https://github.com/Yohane-Mashiro/dzzoffice_sql
CVE ID: CVE-2025-63695 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T16:49:53.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zyx0814/dzzoffice/issues/365 - https://github.com/Yohane-Mashiro/dzzoffice_upload
CVE ID: CVE-2025-63700 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T14:40:13.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://clerk.com - https://github.com/itsnishat08/CVE-2025-63700
CVE ID: CVE-2025-63701 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T21:35:25.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an undersized output buffer. The driver incorrectly assumes the output buffer size matches the input buffer size, leading to invalid memory operations and heap corruption. This vulnerability can cause denial of service through application crashes and potentially lead to code execution in user space. Local access is required to
f service through application crashes and potentially lead to code execution in user space. Local access is required to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://neurowinter.com/security/2025/10/08/Heap-Corruption-in-Advantech-TP-3250-Printer-Driver/
CVE ID: CVE-2025-63708 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T16:31:49.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performe
loads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html - https://github.com/DylanDavis1/CVE-2025-64708
CVE ID: CVE-2025-63709 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:38:09.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17897/simple-do-list
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17897/simple-do-list-system-using-php.html - https://github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709
CVE ID: CVE-2025-63710 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:04:41.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: The send_message.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implement any CSRF-protection mechanisms such as tokens, nonces, or same-site cookie restrictions. An attacker can create a malicious HTML page that, when visited by an authenticated user, will automatically submit a forged POST request to the vulnerable endpoint. This request will be executed with the victim's privileges, allowing the attacker to perform unauthorized ac
e endpoint. This request will be executed with the victim's privileges, allowing the attacker to perform unauthorized actions on their behalf, such as sending arbitrary messages in any chat room. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/12295/simple-public-chat-room-using-php.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63710/README2.md
CVE ID: CVE-2025-63711 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-10T14:53:26.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Client Database Management System 1.0 allows an attacker to cause an authenticated administrative user to perform user deletion actions without their consent. The application's user deletion endpoint (e.g., superadmin_user_delete.php) accepts POST requests containing a user_id parameter and does not enforce request origin or anti-CSRF tokens. Because the endpoint lacks proper authentication/authorization checks and CSRF protections, a remote attacker
RF tokens. Because the endpoint lacks proper authentication/authorization checks and CSRF protections, a remote attacker can craft a malicious page that triggers deletion when visited by an authenticated admin, resulting in arbitrary removal of user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17514/client-database-management-system.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63711/README3.md
CVE ID: CVE-2025-63712 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:39:22.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17883/web-based-product-alert-system.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63712
/17883/web-based-product-alert-system.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63712/README4.md
CVE ID: CVE-2025-63713 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:49:02.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM during test execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18431/matching-type-test-using-ht
otes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18431/matching-type-test-using-html-css-and-javascript-source-code.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63713/README7.md
CVE ID: CVE-2025-63714 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:46:37.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of user-supplied input when rendering generated account data to the DOM, allowing persistent injection of malicious HTML elements that execute when clicked by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
ous HTML elements that execute when clicked by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/javascript/18430/modern-user-account-generator-using-html-css-and-javascript-source-code.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63714/README10.md
CVE ID: CVE-2025-63716 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:51:49.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17510/leads-manager-tool-using-php-and-mysql-source-code.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63716/README5
ing-php-and-mysql-source-code.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63716/README5.md
CVE ID: CVE-2025-63717 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:52:47.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. The application does not implement adequate anti-CSRF tokens or same-site cookie restrictions, allowing attackers to trick authenticated users into unknowingly changing their passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/18340/pet-grooming-management-software-download.html
ADP Vulnrichment: References: - https://www.sourcecodester.com/php/18340/pet-grooming-management-software-download.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63717/README6.md
CVE ID: CVE-2025-63718 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T19:50:00.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html - https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63718/README8.md
CVE ID: CVE-2025-63719 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T14:49:47.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pei4AN/CVE/issues/6
CVE ID: CVE-2025-63724 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T19:27:33.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://deepstrike.io/blog/sql-injection-in-svx-portal-v-2-7A
CVE ID: CVE-2025-63725 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T21:28:50.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://deepstrike.io/blog/sql-injection-in-svx-portal-v-2-7A - https://deepstrike.io/blog/reflected-xss-via-unescaped-attribute-context-in-svx-portal
CVE ID: CVE-2025-63744 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-16T21:02:45.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/marlinkcyber/advisories/blob/main/advisories/radare2-nullptr-deref-bin_dyldcache.md - https://github.com/radareorg/radare2/issues/24661 - https://github.com/radareorg/radare2/commit/e37e15d10fd8a19c3e57b3d7735a2cfe0082ec79 - https
eorg/radare2/issues/24661 - https://github.com/radareorg/radare2/commit/e37e15d10fd8a19c3e57b3d7735a2cfe0082ec79 - https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-002-radare2-nullptr-deref-bin_dyldcache.md
CVE ID: CVE-2025-63745 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T21:31:01.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/marlinkcyber/advisories/blob/main/advisories/radare2-nullptr-deref-bin_ne.md - https://github.com/radareorg/radare2/issues/24660 - https://github.com/radareorg/radare2/commit/6c5df3f8570d4f
n_ne.md - https://github.com/radareorg/radare2/issues/24660 - https://github.com/radareorg/radare2/commit/6c5df3f8570d4f0c360681c08241ad8af3b919fd - https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-001-radare2-nullptr-deref-bin_ne.md
CVE ID: CVE-2025-63747 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T19:42:04.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can gain administrative access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://qatraq.com - https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce
CVE ID: CVE-2025-63748 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T19:53:27.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: QaTraq 6.9.2 allows authenticated users to upload arbitrary files via the "Add Attachment" feature in the "Test Script" module. The application fails to restrict file types, enabling the upload of executable PHP files. Once uploaded, the file can be accessed through the "View Attachment" option, which executes the PHP payload on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://qatraq.com - https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce
CVE ID: CVE-2025-63749 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T21:00:27.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XunMInt/cve/blob/main/Pnetlab-20251013.md
CVE ID: CVE-2025-63783 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T17:04:57.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for the requested project ID. An authenticated attacker can send a malicious request containing another user's project ID to unlawfully modify, delete, or manipulate tags on that project, which can severely compromise data integ
's project ID to unlawfully modify, delete, or manipulate tags on that project, which can severely compromise data integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tossbank.notion.site/IDOR-in-onlook-27a557175d2e8061a3dbc931da53f095 - https://blog.soohyun.tech/CVE-2025-63783-IDOR-in-Onlook-27a557175d2e8061a3dbc931da53f095
CVE ID: CVE-2025-63784 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-12T17:07:08.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks. Additional Ana
d user to an arbitrary external website under their control, which can be exploited for phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tossbank.notion.site/Open-Redirect-in-onlook-27e557175d2e80ac8641fab59dc36021 - https://blog.soohyun.tech/CVE-2025-63784-Open-Redirect-in-Onlook-27e557175d2e80ac8641fab59dc36021
CVE ID: CVE-2025-63785 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-10T20:03:11.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An attacker can exploit this to inject malicious HTML and script code, which is then executed within the context of the preview iframe, allowing for the execution of arbitrary scripts in the user's session. Additional Analyst Notes: -
f the preview iframe, allowing for the execution of arbitrary scripts in the user's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tossbank.notion.site/DOM-XSS-in-onlook-27e557175d2e80e1b210c75b77952115 - https://blog.soohyun.tech/CVE-2025-63785-DOM-XSS-in-Onlook-27e557175d2e80e1b210c75b77952115
CVE ID: CVE-2025-63800 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:08:08.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts. Additional Analyst Notes: - CIS