Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-56467 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T17:30:03.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AXIS BANK LIMITED Axis Mobile App 9.9 that allows attackers to obtain sensitive information without a UPI PIN, such as account information, balances, transaction history, and unspecified other information. NOTE: the Supplier's perspective is that this is an intended feature and "does not reveal much sensitive information." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://axis.com - https://github.com/dewcode91/security-research/blob/main/CVE-2025-56467.md
CVE ID: CVE-2025-56498 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T20:03:01.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can
root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://prolink2u.com/products/pgn6401v - https://github.com/Jorge2Rubio/CVEs/blob/main/CVE-2025-56498.md
CVE ID: CVE-2025-56499 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T13:33:49.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MetaCubeX/mihomo/tree/v1.19.11 - https://github.com/Cherrling/CVE-2025-56499
CVE ID: CVE-2025-56503 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-17T07:26:07.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Administrator via replacing the uninstall file with a crafted binary in the installation folder. NOTE: this is disputed by the Supplier because replacing the uninstall file requires administrator permissions, i.e., there is no privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1aP4S-WdFUL9ocNOucioIqxOgzreZ6Ey7/view?usp=sha
s: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1aP4S-WdFUL9ocNOucioIqxOgzreZ6Ey7/view?usp=sharing - https://drive.google.com/file/d/1QDi9_RKJO-Gi_8jkHJKi7QV1Tajqh4WT/view?usp=sharing - https://github.com/secxplorers/CVE-2025-56503
CVE ID: CVE-2025-56513 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-03T19:11:22.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution. This constitutes a critical supply chain attack vector. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@princep49036142/hijacking-the-miner-how-nicehashmi
yst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@princep49036142/hijacking-the-miner-how-nicehashminers-auto-update-pipeline-enables-zero-click-rce-ed6a36b6769b - https://medium.com/@princep49036142/hijacking-the-miner-zero-click-rce-in-nicehash-quickminer-cve-2025-56513-4a7190295e6c
CVE ID: CVE-2025-56514 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-21T20:00:49.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yinxin630/fiora - https://fiora.suisuijiang.com/ - https://github.com/Kov404/CVE-2025-56514/tree/main
CVE ID: CVE-2025-56515 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T15:50:25.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers (onmouseover) to be uploaded and stored. When rendered, these SVG files execute arbitrary JavaScript, enabling attackers to steal user sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles. Additional Analys
sessions, cookies, and perform unauthorized actions in the context of users viewing affected profiles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yinxin630/fiora - https://fiora.suisuijiang.com/ - https://github.com/Kov404/CVE-2025-56515/tree/main
CVE ID: CVE-2025-56520 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T20:04:03.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. A different vulnerability than CVE-2025-29720. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langgenius/dify/issues/22532
CVE ID: CVE-2025-56526 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T14:43:49.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cinnamon/kotaemon/commit/37cdc28 - https://github.com/Cinnamon/kotaemon - https://skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-22cd1563bd3380458588eb49f361a363 - https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure -
in-LocalStorage-22cd1563bd3380458588eb49f361a363 - https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure - https://harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-236770c3fe1e80f6a1aef381fb1c8f73
CVE ID: CVE-2025-56527 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T14:45:12.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cinnamon/kotaemon/commit/37cdc28 - https://github.com/Cinnamon/kotaemon - https://skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-22cd1563bd3380458588eb49f361a363?pvs=74 - https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure - https://harvest-sink-590.notion.site/Stor
?pvs=74 - https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosure - https://harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-236770c3fe1e80f6a1aef381fb1c8f73
CVE ID: CVE-2025-56551 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T19:04:21.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://i.imgur.com/qA6SAXO.png - https://i.imgur.com/4HF0cnP.png - https://cxsecurity.com/issue/WLB-2025100001
CVE ID: CVE-2025-56556 State: PUBLISHED Published: 2025-09-11T00:00:00.000Z Last Updated: 2025-09-11T20:36:49.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL query tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/intelliants/subrion/issues/913
CVE ID: CVE-2025-56557 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T13:48:59.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tuya.com - https://archive.org/details/tuya-matter-fabric-bug/mode/2up
CVE ID: CVE-2025-56558 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T20:38:05.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Dyson App v6.1.23041-23595 allows unauthenticated attackers to control other users' Dyson IoT devices remotely via MQTT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dyson.com - https://archive.org/details/dyson-acpolicy-bug-report
CVE ID: CVE-2025-56562 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T15:42:46.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://signify.com - http://wiz.com - https://api.wiz.world/api/v2/light - https://archive.org/details/wiz-rtebug
CVE ID: CVE-2025-56571 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-03T19:16:21.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive CPU usage, causing application stalls or crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://financejs.com - https://github.com/ebradyjobory/finance.js - https://raw.githack.com/ebradyjobory/finance.js/6d571ea2a86d08491ceb584e292e9b76b0a60636/finance.js - https://medium.com/@nakah_/cve-2025-56571-and-cve-2025-56572-
e.js/6d571ea2a86d08491ceb584e292e9b76b0a60636/finance.js - https://medium.com/@nakah_/cve-2025-56571-and-cve-2025-56572-denial-of-service-vulnerabilities-in-finance-js-78f8b399f53b
CVE ID: CVE-2025-56572 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-03T19:14:08.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://financejs.com - https://github.com/ebradyjobory/finance.js - https://raw.githack.com/ebradyjobory/finance.js/6d571ea2a86d08491ceb584e292e9b76b0a60636/finance.js - https://medium.com/@nakah_/cve-2025-56571-and-cve-2025-56572-denial-of-service-vulnerabilities-in-finance-js-78f8b399f53b
CVE ID: CVE-2025-56577 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-08-29T20:13:23.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/208981
CVE ID: CVE-2025-56578 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-10-15T16:21:07.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RTSPtoWeb v.2.4.3 allows a remote attacker to obtain sensitive information and executearbitrary code via the lack of authentication mechanisms Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/God-mellon/article/blob/main/RTSPtoWeb-Unauthorized%20Access%20Vulnerability.pdf
CVE ID: CVE-2025-56588 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T20:05:40.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dolibarr.com - https://github.com/PhDg1410/Research
CVE ID: CVE-2025-56608 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T19:09:03.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficien
tentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html - https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4 - https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md
CVE ID: CVE-2025-56630 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T14:44:27.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.foxcms.cn/
CVE ID: CVE-2025-56643 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T16:50:05.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a token is compromised. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBS0
oint and the logout mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBS0D27/CVE-2025-56643
CVE ID: CVE-2025-56648 State: PUBLISHED Published: 2025-09-17T00:00:00.000Z Last Updated: 2025-09-17T19:21:49.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/R4356th/41f468def606b2406e36f7193f5322b8 - https://github.com/parcel-bundler/parcel/discussions/10089 - https://github.com/parcel-bundler/parcel/issues/10216
CVE ID: CVE-2025-56675 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:32:42.572Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: EKEN Products: video doorbell T6 Problem Types: CWE-669 Description: The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://httpscolonforwardslashforwardslashwwwdotzoltanbalazsdotcom.com/2025/07/15/eken-wifi-leak.html
CVE ID: CVE-2025-56676 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T19:55:42.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log in as another user, due to improper validation of token-user linkage. This allows remote attackers to gain unauthorized access to any user account by exploiting the password reset mechanism. The vulnerability occurs because the reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enab
he reset token is not correctly bound to the requesting account and is accepted for other user emails during login, enabling privilege escalation and information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://previews.titansystems.ph/zender/dashboard/auth - https://codecanyon.net/item/zender-android-mobile-devices-as-sms-gateway-saas-platform/26594230 - https://darklotus.medium.com/cve-2025-56676-critical-vulnerability-in-zender-gateway-allows-account-takeover-2b5bcb50c762
CVE ID: CVE-2025-56683 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-14T14:17:48.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting arbitrary Javascript into a crafted README.md file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/martinkubecka/Attributed-CVEs/blob/main/unresolved-vulnerabilities/logseq_xss_to_rce.md - https://github.com/logseq/logseq/commit/4cdf49aedd8de073015b6945a529399c3bfa109a#diff-25789e3ba4c2adf4a68996260eb693a441b4a834c38b76167a120f0b5
eq/logseq/commit/4cdf49aedd8de073015b6945a529399c3bfa109a#diff-25789e3ba4c2adf4a68996260eb693a441b4a834c38b76167a120f0b51b969f7R72-R74 - https://github.com/logseq/logseq - https://martinkubecka.sk/security-advisories/cve-2025-56683/
CVE ID: CVE-2025-56689 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-16T15:30:56.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NOTE: this is disputed by the Supplier because, by design, the product successfully authenticates a client that possesses a cookie whose validity time interval includes the current time, and thus authenticati
enticates a client that possesses a cookie whose validity time interval includes the current time, and thus authentication after any type of "interception" is not a violation of the security model. (The cookie has the HttpOnly attribute.) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@vigneshrajan54_88115/how-i-found-cve-2025-56689-in-safeguard-for-privileged-passwords-6d58fd4bf453
CVE ID: CVE-2025-56694 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T14:32:00.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fotoshare.co/ - https://support.lumasoft.co/hc/en-us/articles/360046797573-Event-Privacy-and-Link-Sharing - https://inf0sectom.github.io/posts/fotoshareco/
CVE ID: CVE-2025-56697 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T19:15:32.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0. Attackers can inject malicious scripts via the smyFeedbacks POST parameter in /users/home.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/scriptjacker/CVE/tree/main/Kashipara/Computer-Base-Test
CVE ID: CVE-2025-56699 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:29:56.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arbitrary SQL commands via the sender parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://basedigitale.com/integrated-security-solutions/security-asset-management/centrax/ - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-56699
CVE ID: CVE-2025-56700 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:29:00.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has access to the platform, to execute arbitrary SQL commands via the datafine parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://basedigitale.com/integrated-security-solutions/security-asset-management/centrax/ - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-56700
CVE ID: CVE-2025-56706 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T17:37:46.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/woaiqjj/CVE/blob/main/BR-6473AX/1.md
CVE ID: CVE-2025-56710 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T14:07:16.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. This flaw allows an attacker to trick authenticated users into unintentionally modifying their account details. By crafting a malicious HTML page, an attacker can submit unauthorized requests to the vulnerable endpoint: /create-class.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@mrshaikh841/csrf-pocs-1c96d9305298