Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7896 State: PUBLISHED Published: 2025-07-20T14:44:04.741Z Last Updated: 2025-07-21T12:39:40.937Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR) Vendors: harry0703 Products: MoneyPrinterTurbo Problem Types: CWE-22 Description: A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function download_video/delete_video of the file app/controllers/v1/video.py. The manipulation leads to path traversal. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317011 - https://vuldb.com/?ctiid.317011 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317011 - https://vuldb.com/?ctiid.317011 - https://vuldb.com/?submit.608941 - https://vuldb.com/?submit.609041
CVE ID: CVE-2025-7897 State: PUBLISHED Published: 2025-07-20T15:02:04.770Z Last Updated: 2025-07-21T12:38:55.383Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR) Vendors: harry0703 Products: MoneyPrinterTurbo Problem Types: CWE-306, CWE-287 Description: A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317012 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317012 - https://vuldb.com/?ctiid.317012 - https://vuldb.com/?submit.609040
CVE ID: CVE-2025-7898 State: PUBLISHED Published: 2025-07-20T15:14:05.337Z Last Updated: 2025-07-21T12:38:19.983Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Codecanyon Products: iDentSoft Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSetting of the component Account Setting Page. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317013 - https://vuldb.com/?ctiid.317013 - https://vuldb.com/?submit.609578 - https://www.youtube.com/watch?v=jsWOCSWs7gs
CVE ID: CVE-2025-7899 State: PUBLISHED Published: 2025-07-22T10:18:38.449Z Last Updated: 2025-07-22T14:18:12.927Z Vendors: TYPO3 Products: Extension "powermail" Problem Types: CWE-639 Description: The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-009
CVE ID: CVE-2025-7900 State: PUBLISHED Published: 2025-07-22T10:21:32.123Z Last Updated: 2025-07-22T14:17:04.005Z Vendors: TYPO3 Products: Extension "femanager" Problem Types: CWE-639 Description: The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-010
CVE ID: CVE-2025-7901 State: PUBLISHED Published: 2025-07-20T15:32:04.851Z Last Updated: 2025-07-21T20:36:51.300Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be initiated remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317015 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317015 - https://vuldb.com/?ctiid.317015 - https://vuldb.com/?submit.618353 - https://github.com/yangzongzhuan/RuoYi/issues/293
CVE ID: CVE-2025-7902 State: PUBLISHED Published: 2025-07-20T16:02:05.625Z Last Updated: 2025-07-21T18:38:28.183Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317016 - https://vuldb.com/?ctiid.317016 - https://vuldb.com/?submit.618354 - https://github.com/yangzongzhuan/RuoYi/issues/294 - https://github.com/yangzongzhuan/RuoYi/issues/294#issue-3211205807
CVE ID: CVE-2025-7903 State: PUBLISHED Published: 2025-07-20T16:32:05.647Z Last Updated: 2025-07-21T16:05:13.228Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-1021 Description: A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317017 - https://vuldb.com/?ctiid.317017 - https://vuldb.com/?submit.618357 - https://github.com/yangzongzhuan/RuoYi/issues/295
CVE ID: CVE-2025-7904 State: PUBLISHED Published: 2025-07-20T17:02:06.267Z Last Updated: 2025-07-21T16:01:21.536Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Insurance Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in itsourcecode Insurance Management System 1.0. This affects an unknown part of the file /insertNominee.php. The manipulation of the argument nominee_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317019 - https://vuldb.com/?ctiid.317019 - https://vuldb.com/?submit.618358 - https://github.com/viaiam/CVE/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-7905 State: PUBLISHED Published: 2025-07-20T19:02:06.110Z Last Updated: 2025-07-21T15:55:11.373Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Insurance Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in itsourcecode Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /insertPayment.php. The manipulation of the argument recipt_no leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317020 - https://vuldb.com/?ctiid.317020 - https://vuldb.com/?submit.618359 - https://github.com/viaiam/CVE/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2025-7906 State: PUBLISHED Published: 2025-07-20T19:32:05.216Z Last Updated: 2025-07-21T15:52:37.624Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
nitiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317021 - https://vuldb.com/?ctiid.317021 - https://vuldb.com/?submit.618361 - https://github.com/yangzongzhuan/RuoYi/issues/296
CVE ID: CVE-2025-7907 State: PUBLISHED Published: 2025-07-20T20:32:05.417Z Last Updated: 2025-07-21T12:43:57.841Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-1392 Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/src/main/resources/application-druid.yml of the component Druid. The manipulation leads to use of default credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
e attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317022 - https://vuldb.com/?ctiid.317022 - https://vuldb.com/?submit.618362 - https://github.com/yangzongzhuan/RuoYi/issues/297
CVE ID: CVE-2025-7908 State: PUBLISHED Published: 2025-07-20T21:02:06.127Z Last Updated: 2025-07-21T12:43:23.649Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DI-8100 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp?opt=add of the component jhttpd. The manipulation of the argument mx leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317023 - https://vuldb.com/?ctiid.317023 - https://vuldb.com/?submit.618582 - https://github.com/buobo/bo-s-CVE/blob/main/DI-8100/wp.md - https://www.dlink.com/
CVE ID: CVE-2025-7909 State: PUBLISHED Published: 2025-07-20T21:32:05.452Z Last Updated: 2025-07-21T12:42:42.442Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-513 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. Affected by this issue is the function sprintf of the file /goform/formLanSetupRouterSettings of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no lo
y. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317024 - https://vuldb.com/?ctiid.317024 - https://vuldb.com/?submit.618593 - https://github.com/buobo/bo-s-CVE/blob/main/DIR-513/formLanSetupRouterSettings.md - https://www.dlink.com/
CVE ID: CVE-2025-7910 State: PUBLISHED Published: 2025-07-20T22:02:05.866Z Last Updated: 2025-07-21T12:42:10.202Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-513 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer support
it has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317025 - https://vuldb.com/?ctiid.317025 - https://vuldb.com/?submit.618594 - https://github.com/buobo/bo-s-CVE/blob/main/DIR-513/formSetWanNonLogin.md - https://www.dlink.com/
CVE ID: CVE-2025-7911 State: PUBLISHED Published: 2025-07-20T22:32:06.358Z Last Updated: 2025-07-21T12:40:59.545Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DI-8100 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in D-Link DI-8100 1.0. This vulnerability affects the function sprintf of the file /upnp_ctrl.asp of the component jhttpd. The manipulation of the argument remove_ext_proto/remove_ext_port leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317026 - https://vuldb.com/?ctiid.317026 - https://vuldb.com/?submit.618640 - https://vuldb.com/?submit.618641 - https://github.com/buobo/bo-s-CVE/blob/main/DI-8100/upnp_ctrl_asp.md - https://www.dlink.com/
CVE ID: CVE-2025-7912 State: PUBLISHED Published: 2025-07-20T23:02:08.791Z Last Updated: 2025-07-21T18:13:05.998Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317027 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317027 - https://vuldb.com/?ctiid.317027 - https://vuldb.com/?submit.618655 - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/6.md - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/6.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7913 State: PUBLISHED Published: 2025-07-20T23:32:09.106Z Last Updated: 2025-07-21T18:13:46.020Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317028 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317028 - https://vuldb.com/?ctiid.317028 - https://vuldb.com/?submit.618656 - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/7.md - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/7.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7914 State: PUBLISHED Published: 2025-07-21T00:02:07.481Z Last Updated: 2025-07-21T18:17:40.558Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR) Vendors: Tenda Products: AC6 Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the component httpd. The manipulation leads to buffer overflow. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317029 - https://vuldb.com/?ctiid.317029 - https://vuldb.com/?submit.618859 - https://github.com/gaoch
s://vuldb.com/?id.317029 - https://vuldb.com/?ctiid.317029 - https://vuldb.com/?submit.618859 - https://github.com/gaochen61/IoTVuln/blob/main/Tenda_AC6_V15.03.06.50/setparentcontrolinfo.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-7915 State: PUBLISHED Published: 2025-07-21T00:32:04.959Z Last Updated: 2025-07-21T18:20:38.629Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Chanjet Products: CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Chanjet CRM 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mail/mailinactive.php of the component Login Page. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317030 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317030 - https://vuldb.com/?ctiid.317030 - https://vuldb.com/?submit.618873 - https://github.com/qiantx/cve/blob/main/cve4.md
CVE ID: CVE-2025-7916 State: PUBLISHED Published: 2025-07-21T05:57:51.661Z Last Updated: 2025-07-21T18:23:55.612Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Simopro Technology Products: WinMatrix3 Problem Types: CWE-502 Description: WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10256-14d55-1.html - https://www.twcert.org.tw/en/cp-139-10257-e88f3-2.html
CVE ID: CVE-2025-7917 State: PUBLISHED Published: 2025-07-21T06:08:38.612Z Last Updated: 2025-07-21T15:39:46.038Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Simopro Technology Products: WinMatrix3 Web package Problem Types: CWE-434 Description: WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10258-16bbf-1.html - https://www.twcert.org.tw/en/cp-139-10263
chment: References: - https://www.twcert.org.tw/tw/cp-132-10258-16bbf-1.html - https://www.twcert.org.tw/en/cp-139-10263-5f2e7-2.html
CVE ID: CVE-2025-7918 State: PUBLISHED Published: 2025-07-21T06:12:49.798Z Last Updated: 2025-07-21T15:39:22.593Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Simopro Technology Products: WinMatrix3 Web package Problem Types: CWE-89 Description: WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10259-b4b38-1.html - https://www.twcert.org.tw/en/cp-139-10264-6c4b7-2.html
CVE ID: CVE-2025-7919 State: PUBLISHED Published: 2025-07-21T06:16:00.562Z Last Updated: 2025-07-21T15:28:33.924Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Simopro Technology Products: WinMatrix3 Web package Problem Types: CWE-200 Description: WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10259-b4b38-1.html - https://www.twcert.org.tw/en/cp-139-10264-6c4b7-2.html
CVE ID: CVE-2025-7920 State: PUBLISHED Published: 2025-07-21T06:59:23.110Z Last Updated: 2025-07-21T15:25:35.826Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Simopro Technology Products: WinMatrix3 Web package Problem Types: CWE-79 Description: WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10262-2fcb6-1.html - https://www.twcert.org.tw/en/cp-139-10267-775be-2.html
CVE ID: CVE-2025-7921 State: PUBLISHED Published: 2025-07-21T06:41:57.380Z Last Updated: 2025-07-21T12:35:59.137Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASKEY Products: RTF8207w, RTF8217 Problem Types: CWE-121 Description: Certain modem models developed by Askey has a Stack-based Buffer Overflow vulnerability, allowing unauthenticated remote attackers to control the program's execution flow and potentially execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10268-1583b-1.html - https://www.twcert.org.tw/en/cp-139-10269-c9839-2.html
CVE ID: CVE-2025-7924 State: PUBLISHED Published: 2025-07-21T11:02:07.605Z Last Updated: 2025-07-21T12:17:04.737Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Online Banquet Booking System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric
hed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317053 - https://vuldb.com/?ctiid.317053 - https://vuldb.com/?submit.618882 - https://github.com/LagonGit/ReportCVE/issues/1 - https://drive.google.com/file/d/1vrvOnw662FZ7CIfhr5EnXPLRqwTRkJqA/view - https://phpgurukul.com/