Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7207 State: PUBLISHED Published: 2025-07-09T00:02:07.237Z Last Updated: 2025-07-09T13:08:10.538Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: mruby Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scope_new of the file mrbgems/mruby-compiler/core/codegen.c of the component nregs Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9
loit has been disclosed to the public and may be used. The name of the patch is 1fdd96104180cc0fb5d3cb086b05ab6458911bb9. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315156 - https://vuldb.com/?ctiid.315156 - https://vuldb.com/?submit.607683 - https://github.com/mruby/mruby/issues/6509 - https://github.com/mruby/mruby/issues/6509#event-17145516649 - https://github.com/user-attachments/files/19619499/mruby_crash.txt - https://github.com/mruby/mruby/commit/1fdd96104180cc0fb5d3cb086b05ab6458911bb9
CVE ID: CVE-2025-7208 State: PUBLISHED Published: 2025-07-09T00:32:08.356Z Last Updated: 2025-07-09T18:37:19.543Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: 9fans Products: plan9port Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in 9fans plan9port up to 9da5b44. It has been classified as critical. This affects the function edump in the library /src/plan9port/src/libsec/port/x509.c. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affect
his product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is b3e06559475b0130a7a2fb56ac4d131d13d2012f. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259053 - https://vuldb.com/?ctiid.259053 - https://vuldb.com/?submit.304567 - https://vuldb.com/?submit.607684 - https://drive.google.com/drive/folders/1kedwNLNDiFQB2OAp7S-ZKYoF7nxfIZGO?usp=sharing - https://github.com/9fans/plan9port/issues/710#issuecomment-2819906648 - https://github.com/user-attachments/files/19698345/
ps://github.com/9fans/plan9port/issues/710#issuecomment-2819906648 - https://github.com/user-attachments/files/19698345/plan9port_crash_1.txt - https://git.9front.org/plan9front/plan9front/b3e06559475b0130a7a2fb56ac4d131d13d2012f/commit.html
CVE ID: CVE-2025-7209 State: PUBLISHED Published: 2025-07-09T01:02:08.354Z Last Updated: 2025-07-09T17:04:07.666Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: 9fans Products: plan9port Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in 9fans plan9port up to 9da5b44 and classified as problematic. Affected by this vulnerability is the function value_decode in the library src/libsec/port/x509.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide c
ploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is deae8939583d83fd798fca97665e0e94656c3ee8. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315157 - https://vuldb.com/?ctiid.315157 - https://vuldb.com/?submit.607685 - https://github.com/9fans/plan9port/issues/711 - https://github.com/9fans/plan9port/issues/711#issuecomment-2819905220 - https://github.com/user-attachments/files/19698361/plan9port_crash_2
fans/plan9port/issues/711#issuecomment-2819905220 - https://github.com/user-attachments/files/19698361/plan9port_crash_2.txt - https://git.9front.org/plan9front/plan9front/deae8939583d83fd798fca97665e0e94656c3ee8/commit.html
CVE ID: CVE-2025-7210 State: PUBLISHED Published: 2025-07-09T01:32:05.879Z Last Updated: 2025-07-09T17:02:34.659Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects, Fabian Ros Products: Library Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in code-projects/Fabian Ros Library Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/profile_update.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
ck may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315158 - https://vuldb.com/?ctiid.315158 - https://vuldb.com/?submit.607801 - https://github.com/horytick/CVE/blob/main/Library%20Management%20System%20In%20PHP%20Arbitrary%20file%20upload.md
CVE ID: CVE-2025-7211 State: PUBLISHED Published: 2025-07-09T02:02:04.981Z Last Updated: 2025-07-09T16:54:48.411Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: LifeStyle Store Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cart_add.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315160 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315160 - https://vuldb.com/?ctiid.315160 - https://vuldb.com/?submit.607821 - https://github.com/18889016001/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-7212 State: PUBLISHED Published: 2025-07-09T02:32:06.221Z Last Updated: 2025-07-09T16:52:17.070Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Insurance Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Insurance Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insertAgent.php. The manipulation of the argument agent_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315161 - https://vuldb.com/?ctiid.315161 - https://vuldb.com/?submit.607909 - https://github.com/wishoper/CVE/issues/3 - https://itsourcecode.com/
CVE ID: CVE-2025-7213 State: PUBLISHED Published: 2025-07-09T03:02:05.807Z Last Updated: 2025-07-09T17:28:36.758Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: FNKvision Products: FNK-GU2 Problem Types: CWE-1191 Description: A vulnerability classified as critical has been found in FNKvision FNK-GU2 up to 40.1.7. Affected is an unknown function of the component UART Interface. The manipulation leads to on-chip debug and test interface with improper access control. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to
e complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315162 - https://vuldb.com/?ctiid.315162 - https://vuldb.com/?submit.608025 - https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21
CVE ID: CVE-2025-7214 State: PUBLISHED Published: 2025-07-09T03:32:05.801Z Last Updated: 2025-07-09T14:28:15.446Z Severity: LOW (CVSS 1.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: FNKvision Products: FNK-GU2 Problem Types: CWE-327, CWE-310 Description: A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disc
device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315163 - https://vuldb.com/?ctiid.315163 - https://vuldb.com/?submit.608027 - https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21
CVE ID: CVE-2025-7215 State: PUBLISHED Published: 2025-07-09T04:02:05.353Z Last Updated: 2025-07-09T14:17:36.350Z Severity: LOW (CVSS 1.6 CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: FNKvision Products: FNK-GU2 Problem Types: CWE-312, CWE-310 Description: A vulnerability, which was classified as problematic, has been found in FNKvision FNK-GU2 up to 40.1.7. Affected by this issue is some unknown functionality of the file /rom/wpa_supplicant.conf. The manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The expl
on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315164 - https://vuldb.com/?ctiid.315164 - https://vuldb.com/?submit.608030 - https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21
CVE ID: CVE-2025-7216 State: PUBLISHED Published: 2025-07-09T04:32:07.417Z Last Updated: 2025-07-09T14:16:58.631Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: lty628 Products: Aidigu Problem Types: CWE-502, CWE-20 Description: A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/common.php of the component PHP Object Handler. The manipulation of the argument rememberMe leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315165 - https://vuldb.com/?ctiid.315165 - https://vuldb.com/?submit.608209 - https://note-hxlab.wetolink.com/share/Bon2P1OSuNDc
CVE ID: CVE-2025-7217 State: PUBLISHED Published: 2025-07-09T05:02:06.014Z Last Updated: 2025-07-09T14:15:07.682Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Payroll Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_position. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315166 - https://vuldb.com/?ctiid.315166 - https://vuldb.com/?submit.608251 - https://github.com/falling-snow1/vuldb/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-7218 State: PUBLISHED Published: 2025-07-09T05:32:05.464Z Last Updated: 2025-07-09T14:12:44.491Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Payroll Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_position. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315167 - https://vuldb.com/?ctiid.315167 - https://vuldb.com/?submit.608252 - https://github.com/falling-snow1/vuldb/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-7219 State: PUBLISHED Published: 2025-07-09T06:02:06.379Z Last Updated: 2025-07-11T13:34:20.343Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Payroll Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_allowances. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315168 - https://vuldb.com/?ctiid.315168 - https://vuldb.com/?submit.608263 - https://github.com/skyrainoh/CVE/issues/7 - https://www.campcodes.com/
CVE ID: CVE-2025-7220 State: PUBLISHED Published: 2025-07-09T06:32:05.827Z Last Updated: 2025-07-09T14:09:42.459Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Payroll Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_deductions. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315169 - https://vuldb.com/?ctiid.315169 - https://vuldb.com/?submit.608264 - https://github.com/skyrainoh/CVE/issues/8 - https://www.campcodes.com/
CVE ID: CVE-2025-7221 State: PUBLISHED Published: 2025-08-21T05:28:14.137Z Last Updated: 2025-08-21T15:03:37.282Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: givewp Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-285 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not presen
enticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8766608e-df72-4b9d-a301-a50c64fadc9a?source=cve - https://plugins.trac.wordpress.org/browser/give/trunk/includes/payments/functions.php#L339 - https://plugins.trac.wordpress.org/changeset/3333090/give
CVE ID: CVE-2025-7222 State: PUBLISHED Published: 2025-07-21T19:52:00.660Z Last Updated: 2025-07-22T19:18:52.741Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-787 Description: Luxion KeyShot 3DM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper validation
ous file. The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26473. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-587/ - http://www.keyshot.com/csirt
CVE ID: CVE-2025-7223 State: PUBLISHED Published: 2025-07-21T19:52:53.913Z Last Updated: 2025-07-22T19:19:48.070Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: INVT Products: HMITool Problem Types: CWE-787 Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of us
le. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25044. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-474/
CVE ID: CVE-2025-7224 State: PUBLISHED Published: 2025-07-21T19:52:57.358Z Last Updated: 2025-07-22T13:27:04.916Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: INVT Products: HMITool Problem Types: CWE-787 Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of us
le. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25045. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-475/
CVE ID: CVE-2025-7225 State: PUBLISHED Published: 2025-07-21T19:53:01.236Z Last Updated: 2025-07-22T13:25:33.160Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: INVT Products: HMITool Problem Types: CWE-787 Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of us
le. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25047. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-476/
CVE ID: CVE-2025-7226 State: PUBLISHED Published: 2025-07-21T19:53:04.787Z Last Updated: 2025-07-22T13:37:03.503Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: INVT Products: HMITool Problem Types: CWE-787 Description: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of us
le. The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25048. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-477/
CVE ID: CVE-2025-7227 State: PUBLISHED Published: 2025-07-21T19:53:08.378Z Last Updated: 2025-07-22T13:34:51.242Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: INVT Products: VT-Designer Problem Types: CWE-787 Description: INVT VT-Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper vali
malicious file. The specific flaw exists within the parsing of PM3 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25550. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-478/