Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9532 State: PUBLISHED Published: 2025-08-27T14:02:06.029Z Last Updated: 2025-08-28T04:57:25.240Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /RegraAvaliacao/view. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
rly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321551 - https://vuldb.com/?ctiid.321551 - https://vuldb.com/?submit.635801 - https://karinagante.github.io/cve-2025-9532/ - https://karinagante.github.io/cve-2025-9532/#proof-of-concept-poc
CVE ID: CVE-2025-9533 State: PUBLISHED Published: 2025-08-27T14:32:11.071Z Last Updated: 2025-08-27T16:05:55.163Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T10 Problem Types: CWE-287 Description: A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321552 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321552 - https://vuldb.com/?ctiid.321552 - https://vuldb.com/?submit.635941 - https://github.com/aLtEr6/MY_test/blob/main/TOTOLINK/TOTOLINK%20T10%20Vulnerability.md - https://www.totolink.net/
CVE ID: CVE-2025-9539 State: PUBLISHED Published: 2025-09-09T06:40:36.082Z Last Updated: 2025-09-09T19:27:02.969Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: rubengc Products: AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress Problem Types: CWE-94 Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated
mport_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9efa04ca-68c8-4221-a3d9-cf75010d2266?source=cve - https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.3.6/includes/admin/pages/import-automation.php#L386
CVE ID: CVE-2025-9540 State: PUBLISHED Published: 2025-09-22T06:00:14.792Z Last Updated: 2025-09-22T14:59:09.898Z Vendors: Unknown Products: Markup Markdown Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/79e606df-50a0-4639-b2d9-4a77111fd729/
CVE ID: CVE-2025-9541 State: PUBLISHED Published: 2025-09-22T06:00:15.165Z Last Updated: 2025-09-22T14:29:57.272Z Vendors: Unknown Products: Markup Markdown Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3828b320-9f7b-4a2a-a6b0-200b023d602c/
CVE ID: CVE-2025-9542 State: PUBLISHED Published: 2025-09-09T06:40:35.408Z Last Updated: 2025-09-09T19:26:21.058Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: rubengc Products: AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress Problem Types: CWE-862 Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, w
le plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62ed278c-f914-4edd-aba1-4aaa099a869f?source=cve - https://plugins.trac.wordpress.org/changeset/3355175/
CVE ID: CVE-2025-9544 State: PUBLISHED Published: 2025-10-29T06:00:06.910Z Last Updated: 2025-10-29T13:51:20.351Z Vendors: Unknown Products: Doppler Forms Problem Types: CWE-862 Missing Authorization Description: The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulner
dPress plugin through 2.5.1). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/06312fba-dfc5-47af-afe3-b01d8941acbf/
CVE ID: CVE-2025-9548 State: PUBLISHED Published: 2025-10-15T14:25:42.495Z Last Updated: 2025-10-16T19:57:38.078Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Power Management Driver Problem Types: CWE-476 Description: A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated user to cause a Windows blue screen error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-203293
CVE ID: CVE-2025-9549 State: PUBLISHED Published: 2025-10-10T22:24:16.674Z Last Updated: 2025-10-15T19:12:16.415Z Vendors: Drupal Products: Facets Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-099
CVE ID: CVE-2025-9550 State: PUBLISHED Published: 2025-10-10T22:24:34.606Z Last Updated: 2025-10-15T19:14:57.518Z Vendors: Drupal Products: Facets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-100
CVE ID: CVE-2025-9551 State: PUBLISHED Published: 2025-10-10T22:24:59.070Z Last Updated: 2025-10-15T19:15:49.611Z Vendors: Drupal Products: Protected Pages Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-101
CVE ID: CVE-2025-9552 State: PUBLISHED Published: 2025-10-10T22:25:22.179Z Last Updated: 2025-10-15T19:20:18.945Z Vendors: Drupal Products: Synchronize composer.json With Contrib Modules Description: Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-102
CVE ID: CVE-2025-9553 State: PUBLISHED Published: 2025-10-10T22:25:36.628Z Last Updated: 2025-10-15T19:21:28.347Z Vendors: Drupal Products: API Key manager Description: Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-103
CVE ID: CVE-2025-9554 State: PUBLISHED Published: 2025-10-10T22:25:48.838Z Last Updated: 2025-10-15T19:22:29.982Z Vendors: Drupal Products: Owl Carousel 2 Description: Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-104
CVE ID: CVE-2025-9556 State: PUBLISHED Published: 2025-09-12T13:45:14.684Z Last Updated: 2025-11-03T18:14:18.939Z Vendors: Langchaingo Products: Langchaingo Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a statement into a prompt to read the "etc/passwd" file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
the "etc/passwd" file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tmc/langchaingo/security/advisories/GHSA-mgcj-g55g-rf6h - https://github.com/tmc/langchaingo/pull/1348
CVE ID: CVE-2025-9559 State: PUBLISHED Published: 2025-10-16T15:28:18.504Z Last Updated: 2025-10-16T18:13:47.670Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-639 Description: Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-h25-vulnerability-remediation-note
CVE ID: CVE-2025-9560 State: PUBLISHED Published: 2025-10-11T02:24:51.813Z Last Updated: 2025-10-14T14:15:07.490Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: extendthemes Products: Colibri Page Builder Problem Types: CWE-79 Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wh
icated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef1679f-44ec-448a-a77b-489ac9bfaa7a?source=cve - https://wordpress.org/plugins/colibri-page-builder/#developers - https://plugins.trac.wordpress.org/changeset/3373432/colibri-page-builder/trunk/extend-builder/shortcodes/newsletter.php
CVE ID: CVE-2025-9561 State: PUBLISHED Published: 2025-10-03T11:17:22.462Z Last Updated: 2025-10-03T18:24:30.046Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: hovanesvn Products: AP Background Problem Types: CWE-434 Description: The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation within the advParallaxBackAdminSaveSlider() handler in versions 3.8.1 to 3.8.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst N
upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4045a2b-2bbc-4335-b6d2-af7a046f1f92?source=cve - https://wordpress.org/plugins/ap-background/ - https://plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php
CVE ID: CVE-2025-9562 State: PUBLISHED Published: 2025-10-18T06:42:46.555Z Last Updated: 2025-10-27T16:13:26.280Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Redirection for Contact Form 7 Problem Types: CWE-79 Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut
henticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801bb0-a7fc-42c3-b26f-3f7cdb592bea?source=cve - https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.5/wpcf7r-functions.php#L558 - https://wordpress.org/plugins/wpcf7-redirect/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378810%40wpcf7-redirect&new=3378810%40wpcf7-redirect&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9565 State: PUBLISHED Published: 2025-09-17T06:17:48.875Z Last Updated: 2025-09-17T12:54:12.783Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Companion Problem Types: CWE-79 Description: The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c28e740e-9337-41b5-a8e7-ca68e41eaed4?source=cve - https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.9/framework/extensions/newsletter-subscribe/extension.php#L191 - https://plugins.trac.wordpress.org/browser/blocksy-companion/tags/2.1.9/framework/extensions/newsletter-subscribe/helpers.php#L65 - https://wordpress.org/plugins/blocksy-companion/ - https://plugins.trac.wordpress.org/change
subscribe/helpers.php#L65 - https://wordpress.org/plugins/blocksy-companion/ - https://plugins.trac.wordpress.org/changeset/3360000/blocksy-companion/trunk/framework/extensions/newsletter-subscribe/helpers.php
CVE ID: CVE-2025-9566 State: PUBLISHED Published: 2025-09-05T19:54:30.503Z Last Updated: 2025-11-13T09:46:36.696Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Ente
SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Dev Spaces (RHOSDS) 3.24, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces Problem Types: CWE-22 Description: There's a vulnerability i
penShift Container Platform 4, Red Hat OpenShift Dev Spaces Problem Types: CWE-22 Description: There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:15900 - https://access.redhat.com/
es: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:15900 - https://access.redhat.com/errata/RHSA-2025:15901 - https://access.redhat.com/errata/RHSA-2025:15904 - https://access.redhat.com/errata/RHSA-2025:16480 - https://access.redhat.com/errata/RHSA-2025:16481 - https://access.redhat.com/errata/RHSA-2025:16482 - https://access.redhat.com/errata/RHSA-2025:16488 - https://access.redhat.com/errata/RHSA-2025:16515 - https://access.redhat.com/errata/RHSA-2025:18217 - https://access.redhat.com/errata/RHSA-2025:18218 - https://access.redhat.com/errata/RHSA-2025:18240 - https://access.redhat.com/errata/RHSA-2025:19002 - https://access.redhat.com/errata/RHSA-2025:19
rrata/RHSA-2025:18240 - https://access.redhat.com/errata/RHSA-2025:19002 - https://access.redhat.com/errata/RHSA-2025:19041 - https://access.redhat.com/errata/RHSA-2025:19046 - https://access.redhat.com/errata/RHSA-2025:19094 - https://access.redhat.com/errata/RHSA-2025:19894 - https://access.redhat.com/errata/RHSA-2025:20909 - https://access.redhat.com/errata/RHSA-2025:20983 - https://access.redhat.com/security/cve/CVE-2025-9566 - https://bugzilla.redhat.com/show_bug.cgi?id=2393152
CVE ID: CVE-2025-9567 State: PUBLISHED Published: 2025-09-01T02:32:27.215Z Last Updated: 2025-09-02T20:44:59.666Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-79 Description: The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html - https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html
CVE ID: CVE-2025-9568 State: PUBLISHED Published: 2025-09-01T02:40:33.827Z Last Updated: 2025-09-02T14:10:41.707Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-79 Description: The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html - https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html
CVE ID: CVE-2025-9569 State: PUBLISHED Published: 2025-09-01T02:42:49.437Z Last Updated: 2025-09-02T19:26:40.833Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-79 Description: The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html - https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html
CVE ID: CVE-2025-9570 State: PUBLISHED Published: 2025-09-01T02:46:39.988Z Last Updated: 2025-09-02T19:27:11.723Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-23 Description: The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to exploit Relative Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html - https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html
CVE ID: CVE-2025-9573 State: PUBLISHED Published: 2025-09-02T08:42:55.912Z Last Updated: 2025-09-02T13:45:32.131Z Vendors: TYPO3 Products: Extension "TYPO3 Backup Plus" Problem Types: CWE-78 Description: The ns_backup extension through 13.0.2 for TYPO3 allows command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-011
CVE ID: CVE-2025-9574 State: PUBLISHED Published: 2025-10-20T16:56:32.337Z Last Updated: 2025-10-24T10:04:57.390Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ABB Products: ALS-mini-s4 IP, ALS-mini-s8 IP Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Serial Number from 2000 to 5166 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=4TZ00000006007&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-9575 State: PUBLISHED Published: 2025-08-28T18:02:06.116Z Last Updated: 2025-08-28T18:31:06.309Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function cgiMain of the file /cgi-bin/upload.cgi. Executing manipulation of the argument filename can lead to os command injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and