Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55731 State: PUBLISHED Published: 2025-08-20T15:22:16.058Z Last Updated: 2025-08-20T15:47:04.165Z Vendors: frappe Products: frappe Problem Types: CWE-89 Description: Frappe is a full-stack web application framework. A carefully crafted request could extract data that the user would normally not have access to, via SQL injection. This vulnerability is fixed in 15.74.2 and 14.96.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-5p8f-568f-vfq2 - https://github.com/frappe/frappe/commit/93ee30c638bf7a7e33e2937a0adccac14c38b410 - https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1
/93ee30c638bf7a7e33e2937a0adccac14c38b410 - https://github.com/frappe/frappe/commit/c2b01e3eb6f50e9bd05df0440f5cbf5dfbc1badd
CVE ID: CVE-2025-55732 State: PUBLISHED Published: 2025-08-20T15:22:21.091Z Last Updated: 2025-08-20T15:45:41.860Z Vendors: frappe Products: frappe Problem Types: CWE-89 Description: Frappe is a full-stack web application framework. Prior to 15.74.2 and 14.96.15, an attacker could implement SQL injection through specially crafted requests, allowing malicious people to access sensitive information. This vulnerability is a bypass of the official patch released for CVE-2025-52895. This vulnerability is fixed in 15.74.2 and 14.96.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-6rpr-2hjx-w9vp - https://github.com/frapp
hment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-6rpr-2hjx-w9vp - https://github.com/frappe/frappe/commit/24dd2d9420a7c68ce09875cb18586d1bf071c857 - https://github.com/frappe/frappe/commit/abe2cc25e333cd794405d12caec4da0279a54e6e
CVE ID: CVE-2025-55733 State: PUBLISHED Published: 2025-08-19T18:26:38.741Z Last Updated: 2025-08-19T20:49:59.391Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: ThinkInAIXYZ Products: deepchat Problem Types: CWE-94 Description: DeepChat is a smart assistant that connects powerful AI to your personal world. DeepChat before 0.3.1 has a one-click remote code execution vulnerability. An attacker can exploit this vulnerability by embedding a specially crafted deepchat: URL on any website, including a malicious one they control. When a victim visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (deepchat:), causing the De
visits such a site or clicks on the link, the browser triggers the app’s custom URL handler (deepchat:), causing the DeepChat application to launch and process the URL, leading to remote code execution on the victim’s machine. This vulnerability is fixed in 0.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ThinkInAIXYZ/deepchat/security/advisories/GHSA-hqr4-4gfc-5p2j - https://github.com/ThinkInAIXYZ/deepchat/commit/a0ff6f362e01ddceb7fd42d0af0b28b6184fb4d2
CVE ID: CVE-2025-55734 State: PUBLISHED Published: 2025-08-19T18:38:04.355Z Last Updated: 2025-08-19T19:22:37.704Z Vendors: DogukanUrker Products: FlaskBlog Problem Types: CWE-862 Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page, but that control is not done for the pages routes/adminPanelComments.py and routes/adminPanelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the
anelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-jw79-2xvp-76p8 - https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-h239-vv39-v3vx
CVE ID: CVE-2025-55735 State: PUBLISHED Published: 2025-08-19T18:56:42.600Z Last Updated: 2025-08-19T19:18:45.395Z Vendors: DogukanUrker Products: FlaskBlog Problem Types: CWE-79, CWE-807 Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filter, that tells the engine to not escape the rendered content. This can lead to a stored XSS inside the content of the post. The code that causes the problem is in template/routes.html. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
st. The code that causes the problem is in template/routes.html. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-gj9v-qhc3-gcfx
CVE ID: CVE-2025-55736 State: PUBLISHED Published: 2025-08-19T19:04:00.564Z Last Updated: 2025-08-19T19:29:09.500Z Vendors: DogukanUrker Products: FlaskBlog Problem Types: CWE-425, CWE-807 Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6q83-vfmq-wf72
CVE ID: CVE-2025-55737 State: PUBLISHED Published: 2025-08-19T19:06:15.195Z Last Updated: 2025-08-19T19:27:18.828Z Vendors: DogukanUrker Products: FlaskBlog Problem Types: CWE-639 Description: flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6hp9-jv2f-88wr
CVE ID: CVE-2025-55739 State: PUBLISHED Published: 2025-09-04T23:22:43.649Z Last Updated: 2025-09-05T15:19:50.135Z Vendors: FreePBX Products: security-reporting Problem Types: CWE-798, CWE-522 Description: api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An attacker with access to the shared OAuth private key could forge JWT tokens, bypass authentication, and potentially gain full access to both REST and GraphQL APIs. Systems with the "api" module
s, bypass authentication, and potentially gain full access to both REST and GraphQL APIs. Systems with the "api" module enabled, configured and previously activated by an administrator for remote inbound connections may be affected. This issue is fixed in versions 15.0.13, 16.0.15 and 17.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-3r47-p39v-vqqf - https://github.com/FreePBX/api/commit/305295aad38322c74cffd75bf550707dfb1a64a2
CVE ID: CVE-2025-55740 State: PUBLISHED Published: 2025-08-19T19:52:25.777Z Last Updated: 2025-08-19T20:05:46.786Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Anipaleja Products: nginx-defender Problem Types: CWE-1392 Description: nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender
credentials (default_password: "change_me_please", GF_SECURITY_ADMIN_PASSWORD=admin123). If users deploy nginx-defender without changing these defaults, attackers with network access could gain administrative control, bypassing security protections. The issue is addressed in v1.5.0 and later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Anipaleja/nginx-defender/security/advisories/GHSA-pr72-8fxw-xx22
CVE ID: CVE-2025-55741 State: PUBLISHED Published: 2025-08-22T16:04:51.542Z Last Updated: 2025-08-22T16:24:48.523Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: unopim Products: unopim Problem Types: CWE-284, CWE-862 Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This v
s by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx - https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989 - https://www.youtube.com/watch?v=J_WV8fCXlJM
CVE ID: CVE-2025-55742 State: PUBLISHED Published: 2025-08-21T15:36:07.475Z Last Updated: 2025-08-21T19:58:34.442Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: unopim Products: unopim Problem Types: CWE-79 Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q - https://github.com/
lnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q - https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75 - https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902 - https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3
CVE ID: CVE-2025-55743 State: PUBLISHED Published: 2025-08-21T15:45:32.296Z Last Updated: 2025-08-21T20:00:06.996Z Vendors: unopim Products: unopim Problem Types: CWE-434 Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make changes to the file extension and content. The vulnerability is fixed in 0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisori
2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-v22v-xwh7-2vrm - https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn
CVE ID: CVE-2025-55744 State: PUBLISHED Published: 2025-08-21T15:51:43.126Z Last Updated: 2025-08-21T20:00:56.409Z Vendors: unopim Products: unopim Problem Types: CWE-352 Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). This vulnerability is fixed in 0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-287x-6r2h-f9mw - https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ
CVE ID: CVE-2025-55745 State: PUBLISHED Published: 2025-08-22T16:14:33.134Z Last Updated: 2025-08-22T20:03:01.826Z Vendors: unopim Products: unopim Problem Types: CWE-1236 Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection, also known as formula injection, in the Quick Export feature. This vulnerability allows attackers to inject malicious content into exported CSV files. When the CSV file is opened in spreadsheet applications such as Microsoft Excel, the malicious input may be interpreted as a formula or command, potentially resulting in the execution of arbitrary code on
malicious input may be interpreted as a formula or command, potentially resulting in the execution of arbitrary code on the victim's device. Successful exploitation can lead to remote code execution, including the establishment of a reverse shell. Users are advised to upgrade to version 0.3.1 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unopim/unopim/security/advisories/GHSA-74rg-6f92-g6wx - https://github.com/unopim/unopim/commit/b25db9496fc147842a519d1dd42ec03c3bf00a34
CVE ID: CVE-2025-55746 State: PUBLISHED Published: 2025-08-20T17:58:06.762Z Last Updated: 2025-08-20T18:20:03.663Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L) Vendors: directus Products: directus Problem Types: CWE-73, CWE-434 Description: Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI.
ent metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/directus/directus/security/advisories/GHSA-mv33-9f6j-pfmc - https://github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696b
CVE ID: CVE-2025-55747 State: PUBLISHED Published: 2025-09-03T20:12:12.978Z Last Updated: 2025-09-03T20:48:27.579Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-23 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qww7-89xh-x7m7 - https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78
https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-45ea9c87d5fb68cd5db0da7f78cf25e76f1325f5fe56e21618b21786fc706236R80-R81 - https://jira.xwiki.org/browse/XWIKI-19350
CVE ID: CVE-2025-55748 State: PUBLISHED Published: 2025-09-03T20:19:45.501Z Last Updated: 2025-09-03T20:47:51.121Z Vendors: xwiki Products: xwiki-platform Problem Types: CWE-23 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg&minify=false`. This is fixed in version 16.10.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwik
fixed in version 16.10.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-m63c-3rmg-r2cf - https://github.com/xwiki/xwiki-platform/commit/9e7b4c03f2143978d891109a17159f73d4cdd318#diff-ee78930a9ac5ea586179fe8ab88a5fd58e369d175927d1e88a0b4dbc3ebcbf1eR62 - https://jira.xwiki.org/browse/XWIKI-23109
CVE ID: CVE-2025-55750 State: PUBLISHED Published: 2025-08-29T15:53:51.123Z Last Updated: 2025-08-29T16:03:08.245Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: gitpod-io Products: gitpod Problem Types: CWE-201 Description: Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via the URL fragment when clicked by an authenticated user. This resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was
nticated user. This resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was limited to Bitbucket (GitHub and GitLab integrations were not affected), required user interaction, and has been mitigated through redirect handling and OAuth logic hardening. The issue was resolved in main-gha.33628 and later. There are no workarounds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gitpod-io/gitpod/security/advisories/GHSA-63fw-3jgp-2p2g - https://github.com/gitpod-io/gitpod/pull/20983 - https://github.com/gitpod-io/gitpod/commit/a736c1b83bd781786af0da705d0acebabfba7862
CVE ID: CVE-2025-55751 State: PUBLISHED Published: 2025-08-20T15:31:48.496Z Last Updated: 2025-08-20T18:07:13.067Z Vendors: HackUCF Products: OnboardLite Problem Types: CWE-601 Description: OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing, credential theft, malware delivery, and trust abuse. Any version with commit hash 6cca19e or later implements jwt signing for the redirect url parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ater implements jwt signing for the redirect url parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HackUCF/OnboardLite/security/advisories/GHSA-p8c5-qp4c-qr2m - https://github.com/HackUCF/OnboardLite/commit/6cca19ea4f47af125caa08ef82594844f039e07e
CVE ID: CVE-2025-55752 State: PUBLISHED Published: 2025-10-27T17:29:56.060Z Last Updated: 2025-11-10T21:38:09.790Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code e
B-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, whi
lso be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog
CVE ID: CVE-2025-55754 State: PUBLISHED Published: 2025-10-27T17:29:50.756Z Last Updated: 2025-11-04T21:13:16.888Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-150 Description: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled comman
anipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
later, 10.1.45 or later or 9.0.109 or later, which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd
CVE ID: CVE-2025-55757 State: PUBLISHED Published: 2025-10-25T18:34:46.909Z Last Updated: 2025-10-28T04:35:21.702Z Vendors: virtuemart.net Products: Virtuemart component for Joomla Problem Types: CWE-79 Description: A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://virtuemart.net/ - https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-55757
CVE ID: CVE-2025-55758 State: PUBLISHED Published: 2025-10-28T10:02:54.016Z Last Updated: 2025-10-28T20:00:45.402Z Vendors: jdownloads.com Products: JDownloads component for Joomla Problem Types: CWE-352 Description: Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jdownloads.com/
CVE ID: CVE-2025-55763 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-08-29T17:05:30.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/civetweb/civetweb - https://github.com/krispybyte/CVE-2025-55763
CVE ID: CVE-2025-55777 State: REJECTED Published: N/A Last Updated: 2025-09-15T17:22:29.462Z Description: No description available.