Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
were renamed via @link imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. This issue is fixed in versions 1.61.12 and 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-g8jh-vg5j-4h3f - https://github.com/apollographql/router/commit/78e4b20a2fc26cc5f141aa47992ed85375266a2b
CVE ID: CVE-2025-64348 State: PUBLISHED Published: 2025-10-31T18:31:21.412Z Last Updated: 2025-11-04T15:58:49.177Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: ELOG Products: ELOG Problem Types: CWE-862 Description: ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service. If the execute facility is specifically enabled with the "-x" command line flag, attackers could execute OS commands on the host machine. By default, ELOG is not configured to allow shell commands or self-registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitbucket.org/ritt/elog/commits/f81e5695c409
n. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc - https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 - https://www.cve.org/CVERecord?id=CVE-2025-64348 - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json
CVE ID: CVE-2025-64349 State: PUBLISHED Published: 2025-10-31T18:31:42.904Z Last Updated: 2025-10-31T18:31:42.904Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ELOG Products: ELOG Problem Types: CWE-862 Description: ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration. References: - https://bitbucket.org/ritt/elog/commits/7092ff64f6eb9521f8cc8c52272a020bf3730946 - https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc - https://raw.git
c52272a020bf3730946 - https://bitbucket.org/ritt/elog/commits/f81e5695c40997322fe2713bfdeba459d9de09dc - https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-304-01.json - https://www.cve.org/CVERecord?id=CVE-2025-64349
CVE ID: CVE-2025-64350 State: PUBLISHED Published: 2025-10-31T11:42:17.908Z Last Updated: 2025-11-13T10:33:49.500Z Vendors: Rank Math SEO Products: Rank Math SEO Problem Types: CWE-862 Description: Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-252-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64351 State: PUBLISHED Published: 2025-10-31T11:42:22.226Z Last Updated: 2025-11-13T10:33:49.501Z Vendors: Rank Math SEO Products: Rank Math SEO Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sensitive Data.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/seo-by-rank-math/vulnerability/wordpress-rank-math-seo-plugin-1-0-252-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-64352 State: PUBLISHED Published: 2025-10-31T11:42:23.045Z Last Updated: 2025-11-13T10:33:49.526Z Vendors: WPDeveloper Products: Essential Addons for Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-2
e/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-2-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64353 State: PUBLISHED Published: 2025-10-31T11:42:25.417Z Last Updated: 2025-11-13T10:33:49.498Z Vendors: Chouby Products: Polylang Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through <= 3.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/polylang/vulnerability/wordpress-polylang-plugin-3-7-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE ID: CVE-2025-64354 State: PUBLISHED Published: 2025-10-31T11:42:26.178Z Last Updated: 2025-11-13T10:33:49.515Z Vendors: Matias Ventura Products: Gutenberg Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matias Ventura Gutenberg gutenberg allows Stored XSS.This issue affects Gutenberg: from n/a through <= 21.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gutenberg/vulnerability/wordpress-gutenberg-plugin-21-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64356 State: PUBLISHED Published: 2025-10-31T11:42:26.908Z Last Updated: 2025-11-13T10:33:49.626Z Vendors: f1logic Products: Insert PHP Code Snippet Problem Types: CWE-862 Description: Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Insert PHP Code Snippet: from n/a through <= 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/insert-php-code-snippet/vulnerability/wordpress-insert-php-code-snippet-plugin-1-4-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64357 State: PUBLISHED Published: 2025-10-31T11:42:27.627Z Last Updated: 2025-11-13T10:33:49.623Z Vendors: Younes JFR. Products: Advanced Database Cleaner Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner advanced-database-cleaner allows Cross Site Request Forgery.This issue affects Advanced Database Cleaner: from n/a through <= 3.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/advanced-database-cleaner/vulnerability/wordpress-advanced-database-cleaner-plugin-3-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-64358 State: PUBLISHED Published: 2025-10-31T11:42:28.439Z Last Updated: 2025-11-13T10:33:49.682Z Vendors: WebToffee Products: Smart Coupons for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Coupons for WooCommerce: from n/a through <= 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wt-smart-coupons-for-woocommerce/vulnerability/wordpress-smart-coupons-for-woocommerce-plugin-2-2-3-broken-acce
s/Plugin/wt-smart-coupons-for-woocommerce/vulnerability/wordpress-smart-coupons-for-woocommerce-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64359 State: PUBLISHED Published: 2025-10-31T11:42:31.602Z Last Updated: 2025-11-13T10:33:49.693Z Vendors: StylemixThemes Products: Consulting Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through < 6.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/consulting/vulnerability/wordpress-consulting-theme-6-7-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-64360 State: PUBLISHED Published: 2025-10-31T11:42:32.330Z Last Updated: 2025-11-13T10:33:49.917Z Vendors: StylemixThemes Products: Consulting Elementor Widgets Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/consulting-elementor-widgets/vulnerability/wordpress-consulting-ele
https://vdp.patchstack.com/database/Wordpress/Plugin/consulting-elementor-widgets/vulnerability/wordpress-consulting-elementor-widgets-plugin-1-4-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-64361 State: PUBLISHED Published: 2025-10-31T11:42:33.072Z Last Updated: 2025-11-13T10:33:49.931Z Vendors: StylemixThemes Products: Consulting Elementor Widgets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/consulting-elementor-widgets/vulnerability/wordpress-consulting-elementor-widgets-plugin-1-4-2-cr
abase/Wordpress/Plugin/consulting-elementor-widgets/vulnerability/wordpress-consulting-elementor-widgets-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64362 State: PUBLISHED Published: 2025-10-31T11:42:36.419Z Last Updated: 2025-11-13T10:33:49.915Z Vendors: SeventhQueen Products: K Elements Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.This issue affects K Elements: from n/a through < 5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/k-elements/vulnerability/wordpress-k-elements-plugin-5-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64363 State: PUBLISHED Published: 2025-10-31T11:42:37.131Z Last Updated: 2025-11-13T10:33:49.915Z Vendors: SeventhQueen Products: Kleo Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through < 5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/kleo/vulnerability/wordpress-kleo-theme-5-5-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-64364 State: PUBLISHED Published: 2025-10-31T11:42:37.865Z Last Updated: 2025-11-13T10:33:49.921Z Vendors: StylemixThemes Products: Masterstudy Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Masterstudy masterstudy allows PHP Local File Inclusion.This issue affects Masterstudy: from n/a through < 4.8.126. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/masterstudy/vulnerability/wordpress-masterstudy-theme-4-8-126-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-64365 State: PUBLISHED Published: 2025-10-31T11:42:38.588Z Last Updated: 2025-11-13T10:33:49.895Z Vendors: colabrio Products: Ohio Extra Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This issue affects Ohio Extra: from n/a through <= 3.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/ohio-extra/vulnerability/wordpress-ohio-extra-plugin-3-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64366 State: PUBLISHED Published: 2025-10-31T11:42:39.301Z Last Updated: 2025-11-13T10:33:49.936Z Vendors: Stylemix Products: MasterStudy LMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.6.27. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-27-sql-injection-vulnerability?_s
tudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-27-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-64367 State: PUBLISHED Published: 2025-10-31T11:42:40.076Z Last Updated: 2025-11-13T10:33:49.935Z Vendors: Adrian Tobey Products: Groundhogg Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Stored XSS.This issue affects Groundhogg: from n/a through <= 4.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-plugin-4-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64368 State: PUBLISHED Published: 2025-10-31T11:42:40.843Z Last Updated: 2025-11-13T10:33:49.929Z Vendors: Mikado-Themes Products: Bard Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/bardwp/vulnerability/wordpress-bard-theme-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-64369 State: PUBLISHED Published: 2025-11-13T09:24:33.215Z Last Updated: 2025-11-17T19:16:59.884Z Vendors: codepeople Products: Contact Form Email Problem Types: CWE-862 Description: Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.58. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/contact-form-to-email/vulnerability/wordpress-contact-form-email-plugin-1-3-58-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64370 State: PUBLISHED Published: 2025-11-13T09:24:33.651Z Last Updated: 2025-11-13T16:01:22.104Z Vendors: YOP Products: YOP Poll Problem Types: CWE-862 Description: Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Poll: from n/a through <= 6.5.38. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/yop-poll/vulnerability/wordpress-yop-poll-plugin-6-5-38-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64379 State: PUBLISHED Published: 2025-11-13T09:24:34.101Z Last Updated: 2025-11-13T15:46:29.344Z Vendors: Pluggabl Products: Booster for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through <= 7.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-7-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64380 State: PUBLISHED Published: 2025-11-13T09:24:34.585Z Last Updated: 2025-11-13T15:40:34.018Z Vendors: Pluggabl Products: Booster for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Stored XSS.This issue affects Booster for WooCommerce: from n/a through <= 7.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-7-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64381 State: PUBLISHED Published: 2025-11-13T09:24:35.014Z Last Updated: 2025-11-17T19:06:31.286Z Vendors: wpdevelop Products: Booking Calendar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored XSS.This issue affects Booking Calendar: from n/a through <= 10.14.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/booking/vulnerability/wordpress-booking-calendar-plugin-10-14-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64382 State: PUBLISHED Published: 2025-11-13T09:24:35.435Z Last Updated: 2025-11-13T15:27:04.594Z Vendors: WebToffee Products: Order Export & Order Import for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Export & Order Import for WooCommerce: from n/a through <= 2.6.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/order-import-export-for-woocommerce/vulnerability/wordpress-order-
https://vdp.patchstack.com/database/Wordpress/Plugin/order-import-export-for-woocommerce/vulnerability/wordpress-order-export-order-import-for-woocommerce-plugin-2-6-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64383 State: PUBLISHED Published: 2025-11-13T09:24:35.862Z Last Updated: 2025-11-13T15:17:28.285Z Vendors: Qode Products: Qi Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/qi-blocks/vulnerability/wordpress-qi-blocks-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64384 State: PUBLISHED Published: 2025-11-13T09:24:36.292Z Last Updated: 2025-11-21T18:30:52.465Z Vendors: jetmonsters Products: JetFormBuilder Problem Types: CWE-862 Description: Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through <= 3.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-5-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64385 State: PUBLISHED Published: 2025-10-31T14:23:06.442Z Last Updated: 2025-11-03T19:06:16.313Z Vendors: Circutor Products: TCPRS1plus Problem Types: CWE-20 Description: The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cds.thalesgroup.com/es/s21sec - https://cir
on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cds.thalesgroup.com/es/s21sec - https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./ - https://www.hackrtu.com/blog/cg-0day-en-003/
CVE ID: CVE-2025-64386 State: PUBLISHED Published: 2025-10-31T13:42:32.743Z Last Updated: 2025-11-03T15:51:03.421Z Vendors: Circutor Products: TCPRS1plus Problem Types: CWE-613 Description: The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session detecting it. The web server allows the attacker to reuse an old session JWT token while the legitimate session is active. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://circutor.com/producto
timate session is active. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./ - https://www.hackrtu.com/blog/cg-0day-en-003/ - https://cds.thalesgroup.com/es/s21sec-about
CVE ID: CVE-2025-64387 State: PUBLISHED Published: 2025-10-31T14:12:55.199Z Last Updated: 2025-11-03T15:48:02.400Z Vendors: Circutor Products: TCPRS1plus Problem Types: CWE-1021 Description: The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page controlled by the attacker in order to deceive the victim. This deception can range from making the victim click on a button to making them enter their login credentials in a form that, a priori, appears legitimate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/p
ADP Vulnrichment: References: - https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./ - https://cds.thalesgroup.com/es/s21sec - https://www.hackrtu.com/blog/cg-0day-en-003/
CVE ID: CVE-2025-64388 State: PUBLISHED Published: 2025-10-31T14:17:00.827Z Last Updated: 2025-11-03T15:47:20.502Z Vendors: Circutor Products: TCPRS1plus Problem Types: CWE-400 Description: Denial of service of the web server through specific requests to this protocol Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cds.thalesgroup.com/es/s21sec - https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./ - https://www.hackrtu.com/blog/cg-0day-en-003/