Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6475 State: PUBLISHED Published: 2025-06-22T12:00:15.476Z Last Updated: 2025-06-23T14:00:43.387Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Student Result Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /script/admin/manage_students of the component Manage Students Module. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst N
The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313583 - https://vuldb.com/?ctiid.313583 - https://vuldb.com/?submit.600550 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README8.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-6476 State: PUBLISHED Published: 2025-06-22T12:31:05.638Z Last Updated: 2025-06-23T13:58:40.213Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Gym Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313584 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313584 - https://vuldb.com/?ctiid.313584 - https://vuldb.com/?submit.600558 - https://github.com/alc9700jmo/CVE/issues/15 - https://www.sourcecodester.com/
CVE ID: CVE-2025-6477 State: PUBLISHED Published: 2025-06-22T13:00:08.845Z Last Updated: 2025-06-23T13:59:49.414Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Student Result Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /script/admin/system of the component System Settings Page. The manipulation of the argument School Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the publi
ool Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313585 - https://vuldb.com/?ctiid.313585 - https://vuldb.com/?submit.600559 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README9.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-6478 State: PUBLISHED Published: 2025-06-22T13:31:05.347Z Last Updated: 2025-06-23T13:59:09.751Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:ND/RC:UC) Vendors: CodeAstro Products: Expense Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313586 - https://vuldb.com/?ctiid.313586 - https://vuldb.com/?submit.600581 - https:
References: - https://vuldb.com/?id.313586 - https://vuldb.com/?ctiid.313586 - https://vuldb.com/?submit.600581 - https://codeastro.com/
CVE ID: CVE-2025-6479 State: PUBLISHED Published: 2025-06-22T14:00:16.245Z Last Updated: 2025-06-23T19:26:37.844Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Pizza Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Simple Pizza Ordering System 1.0. This affects an unknown part of the file /salesreport.php. The manipulation of the argument dayfrom leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313587 - https://vuldb.com/?ctiid.313587 - https://vuldb.com/?submit.600683 - https://github.com/rom4j/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6480 State: PUBLISHED Published: 2025-06-22T14:31:05.814Z Last Updated: 2025-06-23T19:26:31.794Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Pizza Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Simple Pizza Ordering System 1.0. This vulnerability affects unknown code of the file /addcatexec.php. The manipulation of the argument textfield leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313588 - https://vuldb.com/?ctiid.313588 - https://vuldb.com/?submit.600684 - https://github.com/rom4j/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6481 State: PUBLISHED Published: 2025-06-22T15:00:15.999Z Last Updated: 2025-06-23T19:26:25.387Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Pizza Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Simple Pizza Ordering System 1.0. This issue affects some unknown processing of the file /update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313589 - https://vuldb.com/?ctiid.313589 - https://vuldb.com/?submit.600685 - https://github.com/rom4j/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-6482 State: PUBLISHED Published: 2025-06-22T15:31:07.311Z Last Updated: 2025-06-23T13:44:58.063Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Pizza Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /edituser-exec.php. The manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313590 - https://vuldb.com/?ctiid.313590 - https://vuldb.com/?submit.600689 - https://github.com/rom4j/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-6483 State: PUBLISHED Published: 2025-06-22T16:00:15.803Z Last Updated: 2025-06-23T13:47:53.725Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Pizza Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edituser.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313591 - https://vuldb.com/?ctiid.313591 - https://vuldb.com/?submit.600690 - https://github.com/rom4j/cve/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-6484 State: PUBLISHED Published: 2025-06-22T16:31:06.722Z Last Updated: 2025-06-23T13:32:49.346Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Shopping Store Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Shopping Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument cat_id/brand_id/keyword/proId/pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313592 - https://vuldb.com/?ctiid.313592 - https://vuldb.com/?submit.600694 - https://vuldb.com/?submit.600702 - https://vuldb.com/?submit.600704 - https://vuldb.com/?submit.600705 - https://vuldb.com/?submit.600707 - https://github.com/ez-lbz/poc/issues/5 - https://github.com/ez-lbz/poc/issues/6 - https://code-projects.org/
CVE ID: CVE-2025-6485 State: PUBLISHED Published: 2025-06-22T17:00:16.977Z Last Updated: 2025-06-23T13:28:25.470Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A3002R Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313593 - https://vuldb.com/?ctiid.313593 - https://vuldb.com/?submit.600727 - https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_34/34.md - https://www.totolink.net/
CVE ID: CVE-2025-6486 State: PUBLISHED Published: 2025-06-22T17:31:07.185Z Last Updated: 2025-06-23T16:51:47.706Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A3002R Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313594 - https://vuldb.com/?ctiid.313594 - https://vuldb.com/?submit.600728 - https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_35/35.md - https://www.totolink.net/
CVE ID: CVE-2025-6487 State: PUBLISHED Published: 2025-06-22T18:00:15.051Z Last Updated: 2025-06-23T16:50:06.003Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A3002R Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.31
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313595 - https://vuldb.com/?ctiid.313595 - https://vuldb.com/?submit.600729 - https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_36/36.md - https://www.totolink.net/
CVE ID: CVE-2025-6488 State: PUBLISHED Published: 2025-06-27T04:25:30.231Z Last Updated: 2025-06-27T11:02:21.495Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jairoochoa Products: isMobile() Shortcode for WordPress Problem Types: CWE-79 Description: The isMobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addition
nd above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1886db3-e01d-4cb1-8134-8cddff6503ac?source=cve - https://wordpress.org/plugins/ismobile/#developers - https://plugins.trac.wordpress.org/changeset/3318334/
CVE ID: CVE-2025-6489 State: PUBLISHED Published: 2025-06-22T18:31:05.987Z Last Updated: 2025-06-23T16:41:10.173Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Agri-Trading Online Shopping System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in itsourcecode Agri-Trading Online Shopping System 1.0 and classified as critical. This vulnerability affects unknown code of the file /transactionsave.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313600 - https://vuldb.com/?ctiid.313600 - https://vuldb.com/?submit.601190 - https://github.com/ltranquility/CVE/issues/13 - https://itsourcecode.com/
CVE ID: CVE-2025-6490 State: PUBLISHED Published: 2025-06-22T19:00:11.556Z Last Updated: 2025-06-30T19:09:07.204Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: sparklemotion Products: nokogiri Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability
roached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313601 - https://vuldb.com/?ctiid.313601 - https://vuldb.com/?submit.601005 - https://github.com/sparklemotion/nokogiri/issues/3500 - https://github.com/sparklemotion/nokogiri/pull/3524 - https
05 - https://github.com/sparklemotion/nokogiri/issues/3500 - https://github.com/sparklemotion/nokogiri/pull/3524 - https://github.com/user-attachments/files/19625432/nokogiri_crash.txt - https://github.com/sparklemotion/nokogiri/commit/ada4708e5a67114402cd3feb70a4e1d1d7cf773a
CVE ID: CVE-2025-6491 State: PUBLISHED Published: 2025-07-13T22:10:15.996Z Last Updated: 2025-11-04T21:14:48.898Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-476 Description: In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-453
ISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x
CVE ID: CVE-2025-6492 State: PUBLISHED Published: 2025-06-22T20:00:14.265Z Last Updated: 2025-06-23T16:33:52.463Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: MarkText Problem Types: CWE-1333, CWE-400 Description: A vulnerability has been found in MarkText up to 0.17.1 and classified as problematic. Affected by this vulnerability is the function getRecommendTitleFromMarkdownString of the file marktext/src/main/utils/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
e launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313609 - https://vuldb.com/?ctiid.313609 - https://vuldb.com/?submit.598208 - https://github.com/marktext/marktext/pull/3952 - https://github.com/mmmsssttt404/marktext/blob/c59b3ad423dfa082869933baf9f5d5c69bdcc560/test/unit/specs/match-electron-accelerator.spec.js#L155-L164
CVE ID: CVE-2025-6493 State: PUBLISHED Published: 2025-06-22T22:00:10.483Z Last Updated: 2025-09-29T13:48:37.784Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: CodeMirror Problem Types: CWE-1333, CWE-400 Description: A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should
made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313610 - https://vuldb.com/?ctiid.313610 - https://vuldb.com/?submit.598875 - https://github.com/codemirror/codemirror5/issues/7128
CVE ID: CVE-2025-6494 State: PUBLISHED Published: 2025-06-22T22:31:05.760Z Last Updated: 2025-06-30T19:09:09.777Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: sparklemotion Products: nokogiri Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerabili
approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313611 - https://vuldb.com/?ctiid.313611 - https://vuldb.com/?submit.601006 - https://github.com/sparklemotion/nokogiri/issues/3508 - https://github.com/sparklemotion/nokogiri/pull/3524 - https://github
s://github.com/sparklemotion/nokogiri/issues/3508 - https://github.com/sparklemotion/nokogiri/pull/3524 - https://github.com/user-attachments/files/19825279/nokogiri_crash_2.txt - https://github.com/sparklemotion/nokogiri/commit/ada4708e5a67114402cd3feb70a4e1d1d7cf773a
CVE ID: CVE-2025-6495 State: PUBLISHED Published: 2025-07-29T04:23:44.765Z Last Updated: 2025-07-29T14:04:17.941Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Bricks Builder Products: Bricks Problem Types: CWE-89 Description: The Bricks theme for WordPress is vulnerable to blind SQL Injection via the ‘p’ parameter in all versions up to, and including, 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the databas
additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac49a00-dabc-4cd9-9032-c038ede3fd8f?source=cve - https://bricksbuilder.io/ - https://bricksbuilder.io/release/bricks-2-0/#full-changelog
CVE ID: CVE-2025-6496 State: PUBLISHED Published: 2025-06-23T00:00:15.786Z Last Updated: 2025-06-23T13:06:58.408Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: HTACG Products: tidy-html5 Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313612 - https://vuldb.com/?ctiid.313612 - https://vuldb.com/?submit.601007 - https://github.com/htacg/tidy-html5/issues/1141 - https://github.com/user-attachments/files/19652942/tidy-html5_crash.txt