Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ea06520-d7a9-49bb-812e-2fa2e50d0ec2?source=cve - https://plugins.trac.wordpress.org/changeset/3389636/blog2social
CVE ID: CVE-2025-12561 State: REJECTED Published: N/A Last Updated: 2025-11-22T22:24:46.769Z Description: No description available.
CVE ID: CVE-2025-12563 State: PUBLISHED Published: 2025-11-06T04:36:21.892Z Last Updated: 2025-11-06T14:08:53.571Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-862 Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theuploadVideo() function in all versions up to, and including, 8.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory. Additional An
Subscriber-level access and above, to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3710f139-0f17-426c-b48c-4c42ae4bab5f?source=cve - https://plugins.trac.wordpress.org/changeset/3389636/blog2social
CVE ID: CVE-2025-12569 State: PUBLISHED Published: 2025-11-24T06:00:06.595Z Last Updated: 2025-11-24T10:53:49.397Z Vendors: Unknown Products: Guest posting / Frontend Posting / Front Editor Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/37586572-33f9-4365-bfce-7db277a8df72/
CVE ID: CVE-2025-12580 State: PUBLISHED Published: 2025-11-05T03:27:56.949Z Last Updated: 2025-11-07T14:26:33.712Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: stanleychoi Products: SMS for WordPress Problem Types: CWE-79 Description: The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addition
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4e1ddaa-d05a-4261-b55d-54d7650c12b8?source=cve - https://plugins.trac.wordpress.org/browser/sms4wp/trunk/includes/views/templates/sms4wp_template.php#L13 - https://wordpress.org/plugins/sms4wp/
CVE ID: CVE-2025-12582 State: PUBLISHED Published: 2025-11-05T02:25:52.638Z Last Updated: 2025-11-05T18:57:22.260Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: klicher Products: Features Problem Types: CWE-862 Description: The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endpoint in all versions up to, and including, 0.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revert options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a6efab8-04a0-459f-a791-9360c83e5dbe?source=cve - https://wordpress.org/plugins/features/
CVE ID: CVE-2025-12583 State: PUBLISHED Published: 2025-11-08T02:28:03.760Z Last Updated: 2025-11-10T20:17:37.487Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: neofix Products: Simple Downloads List Problem Types: CWE-862 Description: The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts. Additi
criber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbee3d3b-383b-48f5-be63-61cd692a18a0?source=cve - https://plugins.trac.wordpress.org/browser/simple-downloads-list/tags/1.5.0/admin/adminpanel_v3.php?rev=3388438 - https://plugins.trac.wordpress.org/changeset?old_path=/simple-downloads-list/tags/1.4.3&new_path=/simple-downloads-list/tags/1.5.0&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12586 State: PUBLISHED Published: 2025-11-25T07:28:20.635Z Last Updated: 2025-11-25T07:28:20.635Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: evolurise Products: Conditionnal Maintenance Mode for WordPress Problem Types: CWE-352 Description: The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation when toggling the maintenance mode status. This makes it possible for unauthenticated attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator
attackers to enable or disable the site's maintenance mode via a forged request granted they can trick an administrator into performing an action such as clicking on a link. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/535f1d8a-8266-4f90-82fa-9c32181bf277?source=cve - https://plugins.trac.wordpress.org/browser/maintenance-mode-based-on-user-roles/tags/1.0.0/Maintenance_mode.php#L178
CVE ID: CVE-2025-12587 State: PUBLISHED Published: 2025-11-25T07:28:27.819Z Last Updated: 2025-11-25T07:28:27.819Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: webgarh Products: Peer Publish Problem Types: CWE-352 Description: The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the website management pages. This makes it possible for unauthenticated attackers to add, modify, or delete website configurations via a forged request granted they can trick an administrator into performing an action such as clicking on a link. References: - https:/
uest granted they can trick an administrator into performing an action such as clicking on a link. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fffa6c31-8da0-48d7-b603-64f50950787b?source=cve - https://plugins.trac.wordpress.org/browser/peer-publish/tags/1.0/admin/admin-pages/newwebsite.php#L17 - https://plugins.trac.wordpress.org/browser/peer-publish/tags/1.0/admin/admin-pages/websites.php#L20
CVE ID: CVE-2025-12588 State: PUBLISHED Published: 2025-11-11T03:30:41.567Z Last Updated: 2025-11-12T20:06:10.416Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: behzadrohizadeh Products: USB Qr Code Scanner For Woocommerce Problem Types: CWE-352 Description: The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a
's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e02d105-0f1e-479e-a537-7a7fdbbd7804?source=cve - https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L410 - https://plugins.trac.wordpress.org/browser/usb-qr-code-scanner-for-woocommerce/tags/1.0.0/usb-qrcode-scanner-for-woocommerce.php#L149
CVE ID: CVE-2025-12589 State: PUBLISHED Published: 2025-11-11T03:30:40.408Z Last Updated: 2025-11-12T20:06:36.152Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: baronen Products: WP-Walla Problem Types: CWE-352 Description: The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into perf
ttackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ed9f7a1-54ef-4f88-b89c-756b8b646254?source=cve - https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L2 - https://plugins.trac.wordpress.org/browser/wp-walla/tags/0.5.3.5/wpwalla_admin.php#L83 - https://developer.wordpress.org/plugins/security/nonces/ - https://developer.wordpress.org/reference/functions/esc_attr/
CVE ID: CVE-2025-12590 State: PUBLISHED Published: 2025-11-11T03:30:42.295Z Last Updated: 2025-11-14T15:31:43.208Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: andreaferracani Products: YSlider Problem Types: CWE-352 Description: The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administ
authenticated attackers to inject arbitrary web scripts in pages via a forged request granted they can trick an administrator into performing an action such as clicking on a link. The injected scripts will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79f03bfe-dd7e-47e7-9e6f-4539d26cc101?source=cve - https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L2 - https://plugins.trac.wordpress.org/browser/yslider/tags/1.1/content-config.php#L48
CVE ID: CVE-2025-12592 State: PUBLISHED Published: 2025-11-19T12:30:32.854Z Last Updated: 2025-11-19T16:07:56.677Z Vendors: Vivotek Products: Affected device model numbers are FD7131-VVTK,FD7131-VVTK,FD7131-VVTK,FD7141-VVTK,IP7131-VVTK,IP7133-VVTK,IP7133-VVTK,IP7133-VVTK,IP7134-VVTK,IP7135-VVTK,IP7135-VVTK,IP7135-VVTK,IP7135-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7137-VVTK,IP7138-VVTK,IP7142-VVTK,IP7142-VVTK,IP7151-VVTK,IP7152-VVTK,IP7153-VVTK,IP7153-VVTK,IP7154-VVTK,IP7330-VVTK,IP7330-VVTK,IP7330-VVTK,IP8131-VVTK,IP8131-VVTK,IP8131-VVTK,IP8131W-VVTK,PT7135-VVTK,PT7137-TCON,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PZ7131-VVTK,PZ7131-VVTK,PZ71X1-VVTK,PZ71X1-
VVTK,PT7135-VVTK,PT7137-TCON,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PT7137-VVTK,PZ7131-VVTK,PZ7131-VVTK,PZ71X1-VVTK,PZ71X1-VVTK,PZ71X2-VVTK,SD73X3-VVTK,SD73X3-VVTK,SD73X3-VVTK,TC5330-VVTK,TC5332-TCVV,TC5333-TCVV,TC5633-TCVV,TC5633-VVTK,VS7100-VVTK,VS7100-VVTK,VS7100-VVTK Problem Types: CWE-1392 Description: Legacy Vivotek Device firmware uses default credetials for the root and user login accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.akamai.com/blog/security-research/rce-zero-day-in-legacy-vivotek-firmware - http://www.vapidlabs.com/advisory.php?v=219
CVE ID: CVE-2025-12593 State: PUBLISHED Published: 2025-11-02T06:02:05.981Z Last Updated: 2025-11-03T15:43:16.030Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-434, CWE-284 Description: A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit_room.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichm
arried out remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330888 - https://vuldb.com/?ctiid.330888 - https://vuldb.com/?submit.677547 - https://github.com/asd1238525/cve/blob/main/upload2.md - https://code-projects.org/
CVE ID: CVE-2025-12594 State: PUBLISHED Published: 2025-11-02T08:32:06.189Z Last Updated: 2025-11-03T15:43:44.392Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_account.php. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
it has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330889 - https://vuldb.com/?ctiid.330889 - https://vuldb.com/?submit.677576 - https://github.com/asd1238525/cve/blob/main/SQL10.md - https://code-projects.org/
CVE ID: CVE-2025-12595 State: PUBLISHED Published: 2025-11-02T10:02:07.134Z Last Updated: 2025-11-03T14:55:49.338Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC23 Problem Types: CWE-120, CWE-119 Description: A weakness has been identified in Tenda AC23 16.03.07.52. This impacts the function formSetVirtualSer of the file /goform/SetVirtualServerCfg. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330890 - https://vuldb.com/
ited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330890 - https://vuldb.com/?ctiid.330890 - https://vuldb.com/?submit.677581 - https://github.com/LX-LX88/cve/issues/8 - https://www.tenda.com.cn/
CVE ID: CVE-2025-12596 State: PUBLISHED Published: 2025-11-02T10:32:06.299Z Last Updated: 2025-11-03T14:54:39.493Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC23 Problem Types: CWE-120, CWE-119 Description: A security vulnerability has been detected in Tenda AC23 16.03.07.52. Affected is the function saveParentControlInfo of the file /goform/saveParentControlInfo. Such manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330891 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330891 - https://vuldb.com/?ctiid.330891 - https://vuldb.com/?submit.677585 - https://github.com/LX-LX88/cve/issues/9 - https://www.tenda.com.cn/
CVE ID: CVE-2025-12597 State: PUBLISHED Published: 2025-11-02T11:32:06.558Z Last Updated: 2025-11-03T14:45:32.495Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the file /admin_class.php. Performing manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
tely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330892 - https://vuldb.com/?ctiid.330892 - https://vuldb.com/?submit.678085 - https://github.com/321190176/Best-house-rental-management-system/blob/main/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-12598 State: PUBLISHED Published: 2025-11-02T12:02:07.575Z Last Updated: 2025-11-03T14:44:57.474Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA AD
loit has been published and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330893 - https://vuldb.com/?ctiid.330893 - https://vuldb.com/?submit.678086 - https://github.com/321190176/Best-house-rental-management-system-2/blob/main/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-12599 State: PUBLISHED Published: 2025-11-01T18:39:53.127Z Last Updated: 2025-11-03T13:29:56.000Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-321 Description: Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12600 State: PUBLISHED Published: 2025-11-01T18:48:49.084Z Last Updated: 2025-11-03T13:29:50.055Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-730 Description: Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12601 State: PUBLISHED Published: 2025-11-01T18:49:12.782Z Last Updated: 2025-11-03T13:29:43.969Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-730 Description: Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12602 State: PUBLISHED Published: 2025-11-01T18:54:46.956Z Last Updated: 2025-11-03T13:29:38.120Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-787 Description: /etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12603 State: PUBLISHED Published: 2025-11-01T18:56:52.453Z Last Updated: 2025-11-03T13:29:31.660Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-787 Description: /etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12604 State: PUBLISHED Published: 2025-11-02T21:32:06.054Z Last Updated: 2025-11-03T14:44:06.472Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation of the argument loan_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330894 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330894 - https://vuldb.com/?ctiid.330894 - https://vuldb.com/?submit.678229 - https://github.com/cintahue/CVE/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-12605 State: PUBLISHED Published: 2025-11-02T23:02:07.442Z Last Updated: 2025-11-03T14:43:19.764Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330895 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330895 - https://vuldb.com/?ctiid.330895 - https://vuldb.com/?submit.678231 - https://github.com/cintahue/CVE/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2025-12606 State: PUBLISHED Published: 2025-11-02T23:32:06.631Z Last Updated: 2025-11-03T14:42:31.694Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
icly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330896 - https://vuldb.com/?ctiid.330896 - https://vuldb.com/?submit.678238 - https://github.com/cintahue/CVE/issues/3 - https://itsourcecode.com/