Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320909 - https://vuldb.com/?ctiid.320909 - https://vuldb.com/?submit.632411 - https://github.com/CVE-Hunter-Leo/CVE/issues/7 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9305 State: PUBLISHED Published: 2025-08-21T15:02:10.930Z Last Updated: 2025-08-21T15:55:42.336Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Bank Management System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is an unknown function of the file /bank/mnotice.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
t has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320910 - https://vuldb.com/?ctiid.320910 - https://vuldb.com/?submit.632413 - https://github.com/CVE-Hunter-Leo/CVE/issues/8 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9306 State: PUBLISHED Published: 2025-08-21T15:32:08.960Z Last Updated: 2025-08-22T11:31:39.259Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Advanced School Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice/addNotice. The manipulation of the argument noticeSubject results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320911 - https://vuldb.com/?ctiid.320911 - https://vuldb.com/?submit.632419 - https://github.com/lrjbsyh/CVE_Hunter/issues/3 - https://github.com/lrjbsyh/CVE_Hunter/issues/3#issue-3313419319 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9307 State: PUBLISHED Published: 2025-08-21T16:02:09.594Z Last Updated: 2025-08-21T17:32:21.777Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Online Course Registration Problem Types: CWE-89, CWE-74 Description: A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This manipulation of the argument sesssion causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320912 - https://vuldb.com/?ctiid.320912 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320912 - https://vuldb.com/?ctiid.320912 - https://vuldb.com/?submit.632646 - https://github.com/zzx-yyds/mycve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-9308 State: PUBLISHED Published: 2025-08-21T16:02:12.172Z Last Updated: 2025-08-21T17:32:14.661Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R) Vendors: yarnpkg Products: Yarn Problem Types: CWE-1333, CWE-400 Description: A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
t are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320913 - https://vuldb.com/?ctiid.320913 - https://vuldb.com/?submit.633486 - https://github.com/yarnpkg/yarn/pull/9203
CVE ID: CVE-2025-9309 State: PUBLISHED Published: 2025-08-21T16:32:08.672Z Last Updated: 2025-08-21T17:31:37.142Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tenda Products: AC10 Problem Types: CWE-798, CWE-259 Description: A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made public and could be used. Additional Analyst Notes: -
exploitability is told to be difficult. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320914 - https://vuldb.com/?ctiid.320914 - https://vuldb.com/?submit.633585 - https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC10/V4.0si_V16.03.10.13.md - https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC10/V4.0si_V16.03.10.13.md#steps-to-reproduce - https://www.tenda.com.cn/
CVE ID: CVE-2025-9310 State: PUBLISHED Published: 2025-08-21T16:32:10.812Z Last Updated: 2025-08-21T17:31:30.124Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: yeqifu Products: carRental Problem Types: CWE-798, CWE-259 Description: A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality of the file /carRental_war/druid/login.html of the component Druid. Executing manipulation can lead to hard-coded credentials. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling
y be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320915 - https://vuldb.com/?ctiid.320915 - https://vuldb.com/?submit.633588 - https://github.com/caigo8/CVE-md/blob/main/carRentalV1.0/druid%E6%9C%AA%E6%8E%88%E6%9D%83.md
CVE ID: CVE-2025-9311 State: PUBLISHED Published: 2025-08-21T17:02:07.188Z Last Updated: 2025-08-21T17:30:31.838Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fair/addfair.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
y available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320916 - https://vuldb.com/?ctiid.320916 - https://vuldb.com/?submit.633658 - https://github.com/zzb1388/cve/issues/42 - https://itsourcecode.com/
CVE ID: CVE-2025-9312 State: PUBLISHED Published: 2025-11-18T12:05:22.207Z Last Updated: 2025-11-18T17:38:15.686Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WSO2 Products: WSO2 API Manager, WSO2 API Control Plane, WSO2 Traffic Manager, WSO2 Universal Gateway, WSO2 Identity Server as Key Manager, WSO2 Identity Server, WSO2 Open Banking KM, WSO2 Open Banking AM, WSO2 Open Banking IAM, org.wso2.carbon.identity.auth.service Problem Types: CWE-306 Description: A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of c
LS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication. Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability
cess to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/
CVE ID: CVE-2025-9313 State: PUBLISHED Published: 2025-10-28T11:49:29.119Z Last Updated: 2025-10-28T13:15:31.459Z Vendors: Asseco Poland S.A. Products: mMedica Problem Types: CWE-288 Description: An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/pos
edica in versions before 11.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/10/CVE-2025-9313/ - https://mmedica.asseco.pl/
CVE ID: CVE-2025-9316 State: PUBLISHED Published: 2025-11-12T15:27:25.206Z Last Updated: 2025-11-12T18:26:46.799Z Vendors: N-able Products: N-central Problem Types: CWE-1284 Description: N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.n-able.com/s/security-advisory/aArVy0000000rdpKAA/cve20259316-ncentral-unauthenticated-sessionid-generation
CVE ID: CVE-2025-9317 State: PUBLISHED Published: 2025-11-14T23:49:27.149Z Last Updated: 2025-11-17T16:55:20.081Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: AVEVA Products: Edge Problem Types: CWE-327 Description: The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-006.pdf - https://www.cisa
va.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-006.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-03 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-317-03.json
CVE ID: CVE-2025-9319 State: PUBLISHED Published: 2025-09-11T18:33:02.108Z Last Updated: 2025-09-11T19:07:57.735Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Wallpaper Client Problem Types: CWE-494 Description: A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/431733
CVE ID: CVE-2025-9321 State: PUBLISHED Published: 2025-09-23T04:26:13.615Z Last Updated: 2025-09-23T13:49:09.210Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpsight Products: WPCasa Problem Types: CWE-94 Description: The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee
tes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee-827e-6e57f7a50218?source=cve - https://plugins.trac.wordpress.org/browser/wpcasa/trunk/includes/class-wpsight-api.php#L48 - https://plugins.trac.wordpress.org/changeset/3365172/
CVE ID: CVE-2025-9322 State: PUBLISHED Published: 2025-10-25T06:49:23.256Z Last Updated: 2025-10-27T15:44:23.530Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: themeisle Products: Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Problem Types: CWE-89 Description: The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak
ufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/886b612a-d0d1-4880-b423-eb62410a28cd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378785%40wp-full-stripe-free&new=3378785%40wp-full-stripe-free&sfp_email=&sfph_mail=#file6
CVE ID: CVE-2025-9323 State: PUBLISHED Published: 2025-09-02T20:09:42.290Z Last Updated: 2025-09-02T20:39:34.719Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of prop
open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-27101. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-869/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9324 State: PUBLISHED Published: 2025-09-02T20:09:34.797Z Last Updated: 2025-09-02T20:39:52.579Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of prop
open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26802. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-868/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9325 State: PUBLISHED Published: 2025-09-02T20:09:27.758Z Last Updated: 2025-09-02T20:41:31.376Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of prop
open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26785. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-867/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9326 State: PUBLISHED Published: 2025-09-02T20:09:20.028Z Last Updated: 2025-09-02T20:41:46.941Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper valid
alicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26784. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-866/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9327 State: PUBLISHED Published: 2025-09-02T20:09:11.963Z Last Updated: 2025-09-03T14:30:11.038Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of prop
open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26774. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-865/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9328 State: PUBLISHED Published: 2025-09-02T20:09:04.564Z Last Updated: 2025-09-03T14:31:28.327Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper valid
alicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26773. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-864/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9329 State: PUBLISHED Published: 2025-09-02T20:08:56.886Z Last Updated: 2025-09-03T14:32:43.123Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-125 Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper valid
alicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26772. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-863/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2025-9330 State: PUBLISHED Published: 2025-09-02T20:09:51.190Z Last Updated: 2025-09-02T20:39:14.133Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-427 Description: Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Foxit Reader Update Service. The product loads a libra