Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307373 - https://vuldb.com/?ctiid.307373 - https://vuldb.com/?submit.563430 - https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearDiagnosisLog.md - https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearSyslog.md - https://www.totolink.net/
CVE ID: CVE-2025-4270 State: PUBLISHED Published: 2025-05-05T07:31:07.013Z Last Updated: 2025-05-05T13:20:24.606Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TOTOLINK Products: A720R Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Anal
is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307374 - https://vuldb.com/?ctiid.307374 - https://vuldb.com/?submit.563442 - https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getInitCfg.md - https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getSysStatusCfg.md - https://www.totolink.net/
CVE ID: CVE-2025-4271 State: PUBLISHED Published: 2025-05-05T08:00:08.825Z Last Updated: 2025-05-05T13:09:25.246Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TOTOLINK Products: A720R Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307375 - https://vuldb.com/?ctiid.307375 - https://vuldb.com/?submit.563444 - https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/showSyslog.md - https://www.totolink.net/
CVE ID: CVE-2025-4272 State: PUBLISHED Published: 2025-05-05T11:00:07.406Z Last Updated: 2025-05-05T12:32:51.133Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mechrevo Products: Control Console Problem Types: CWE-427, CWE-426 Description: A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\csCAPI.dll of the component GCUService. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitat
ontrolled search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307376 - https://vuldb.com/?ctiid.307376 - https://vuldb.com/?submit.563468 - https://www.yuque.com/ba1ma0-an29k/nnxoap/bhd5ckqugggmpttp?singleDoc - https://drive.google.com/file/d/1VKhLyW0oglACkt-5PgTtN9oRB2jMczeh/view?usp=sharing
CVE ID: CVE-2025-4273 State: REJECTED Published: 2025-05-05T01:20:25.259Z Last Updated: 2025-05-05T02:07:06.681Z Description: No description available.
CVE ID: CVE-2025-4275 State: PUBLISHED Published: 2025-06-11T00:25:17.737Z Last Updated: 2025-08-14T05:58:07.245Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: cwe-284: Improper Access Control Description: A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/sec
ot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025002/
CVE ID: CVE-2025-4276 State: PUBLISHED Published: 2025-08-13T01:41:56.834Z Last Updated: 2025-08-14T05:54:07.744Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-20 Description: UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025005/
CVE ID: CVE-2025-4277 State: PUBLISHED Published: 2025-08-13T01:46:22.998Z Last Updated: 2025-08-14T05:54:24.230Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Insyde Software Products: InsydeH2O Problem Types: CWE-20 Description: Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/sa-2025005/
CVE ID: CVE-2025-4278 State: PUBLISHED Published: 2025-06-12T10:02:25.006Z Last Updated: 2025-06-12T13:43:54.714Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-80 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/539198 - https://hackerone.com/reports/3085738
CVE ID: CVE-2025-4279 State: PUBLISHED Published: 2025-05-05T18:22:39.421Z Last Updated: 2025-05-05T18:35:26.672Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: muromuro Products: External image replace Problem Types: CWE-434 Description: The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_posts::replace_post' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution pos
and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1624fd-d98b-4953-99dc-a952dda48aa1?source=cve - https://plugins.trac.wordpress.org/browser/external-image-replace/tags/1.0.8/class.php#L87
CVE ID: CVE-2025-4280 State: PUBLISHED Published: 2025-05-22T09:59:30.632Z Last Updated: 2025-05-22T13:23:51.275Z Vendors: Poedit Products: Poedit Problem Types: CWE-276 Description: MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for
t triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Poedit, potentially disguising attacker's malicious intent. This issue has been fixed in 3.6.3 version of Poedit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/05/CVE-2025-4280 - https://cert.pl/en/posts/2025/05/CVE-2025-4280 - https://poedit.net - https://github.com/vslavik/poedit - https://github.com/vslavik/poedit/security/advisories/GHSA-8fcw-v6gr-hp34
CVE ID: CVE-2025-4281 State: PUBLISHED Published: 2025-05-05T16:00:09.603Z Last Updated: 2025-05-05T16:38:07.683Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Shenzhen Sixun Software Products: Sixun Shanghui Group Business Management System Problem Types: CWE-200, CWE-284 Description: A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an unknown part of the file /api/GylOperator/LoadData. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additio
e. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307389 - https://vuldb.com/?ctiid.307389 - https://vuldb.com/?submit.563515 - https://github.com/zhangbuneng/an-unauthorized-vulnerability-in-the-business-management-system-of-Wisdom-7-Group/issues/1
CVE ID: CVE-2025-4282 State: PUBLISHED Published: 2025-05-05T18:00:08.512Z Last Updated: 2025-05-05T19:03:27.302Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester, oretnom23 Products: Stock Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307390 - https://vuldb.com/?ctiid.307390 - https://vuldb.com/?submit.563102 - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/CSRF/info.md
CVE ID: CVE-2025-4283 State: PUBLISHED Published: 2025-05-05T18:31:04.418Z Last Updated: 2025-05-05T18:48:57.123Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester, oretnom23 Products: Stock Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307391 - https://vuldb.com/?ctiid.307391 - https://vuldb.com/?submit.563175 - https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Auth-Bypass/info.md
CVE ID: CVE-2025-4284 State: PUBLISHED Published: 2025-07-22T11:31:07.670Z Last Updated: 2025-07-22T14:01:24.458Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Rolantis Information Technologies Products: Agentis Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS.This issue affects Agentis: before 4.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0168
CVE ID: CVE-2025-4285 State: PUBLISHED Published: 2025-07-22T11:21:54.909Z Last Updated: 2025-07-22T14:05:59.581Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Rolantis Information Technologies Products: Agentis Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL Injection.This issue affects Agentis: before 4.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0168
CVE ID: CVE-2025-4286 State: PUBLISHED Published: 2025-05-05T19:31:04.865Z Last Updated: 2025-05-05T20:05:12.475Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N) Vendors: Intelbras Products: InControl Problem Types: CWE-256, CWE-255 Description: A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later rel
loit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307392 - https://vuldb.com/?ctiid.307392 - https://vuldb.com/?submit.483834 - https://eldruin.notion.site/Intelbras-InControl-v2-21-57-Storing-password-in-insecure-format-17d27474cccb8003b647ea832186b162?pvs=4
CVE ID: CVE-2025-4287 State: PUBLISHED Published: 2025-05-05T20:00:11.130Z Last Updated: 2025-05-06T13:45:53.787Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: PyTorch Problem Types: CWE-404 Description: A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fi
y be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307394 - https://vuldb.com/?ctiid.307394 - https://vuldb.com/?submit.553644 - https://github.com/pytorch/pytorch/issues/150836 - https://github.com/pytorch/pytorch/pull/150923 - https://github.com/pytorch/pytorch/issues/150836#issue-2979097872 - https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5
CVE ID: CVE-2025-4288 State: PUBLISHED Published: 2025-05-05T20:31:04.050Z Last Updated: 2025-05-06T13:43:00.402Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307395 - https://vuldb.com/?ctiid.307395 - https://vuldb.com/?su
A ADP Vulnrichment: References: - https://vuldb.com/?id.307395 - https://vuldb.com/?ctiid.307395 - https://vuldb.com/?submit.561625 - https://fitoxs.com/exploit/exploit-aab361888e671e1705f94c27c26f9bc7c9c63d3c66d5df89e31dcaf7fa17f528.txt
CVE ID: CVE-2025-4289 State: PUBLISHED Published: 2025-05-05T21:00:11.070Z Last Updated: 2025-05-06T02:52:23.321Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307396 - https://vuldb.com/?ctiid.307396 - https://vuldb.com/?submit
P Vulnrichment: References: - https://vuldb.com/?id.307396 - https://vuldb.com/?ctiid.307396 - https://vuldb.com/?submit.561626 - https://fitoxs.com/exploit/exploit-0c70a8b6f3e2d1312bbfa8fcb8e44c802394c3adfb7c1f860a18e9fdc88d8e9c3.txt
CVE ID: CVE-2025-4290 State: PUBLISHED Published: 2025-05-05T21:31:04.070Z Last Updated: 2025-05-06T02:51:33.515Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SMNT Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307397 - https://vuldb.com/?ctiid.307397 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307397 - https://vuldb.com/?ctiid.307397 - https://vuldb.com/?submit.561628 - https://fitoxs.com/exploit/exploit-1d02cb01af712a1176c64e21664ade52d09ec09ab368d4501d7d09296bcd395b.txt
CVE ID: CVE-2025-4291 State: PUBLISHED Published: 2025-05-05T22:00:11.189Z Last Updated: 2025-05-06T02:50:04.646Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: IdeaCMS Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307398 - https://vuldb.com/?ctiid.307398 - https://vuldb.com/?submit.563522 - https://gitee.com/
- https://vuldb.com/?id.307398 - https://vuldb.com/?ctiid.307398 - https://vuldb.com/?submit.563522 - https://gitee.com/ideacms/ideacms/issues/IC32SB
CVE ID: CVE-2025-4292 State: PUBLISHED Published: 2025-05-05T22:31:04.337Z Last Updated: 2025-05-06T02:48:48.349Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: MRCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/user/edit.do of the component Edit User Page. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.30
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307399 - https://vuldb.com/?ctiid.307399 - https://vuldb.com/?submit.563533 - https://github.com/bdkuzma/vuln/issues/1
CVE ID: CVE-2025-4293 State: PUBLISHED Published: 2025-05-05T22:31:05.921Z Last Updated: 2025-05-06T02:47:35.063Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: MRCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do of the component Group Edit Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307400 - https://vuldb.com/?ctiid.30
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307400 - https://vuldb.com/?ctiid.307400 - https://vuldb.com/?submit.563534 - https://github.com/bdkuzma/vuln/issues/2
CVE ID: CVE-2025-4294 State: PUBLISHED Published: 2025-07-22T13:53:59.638Z Last Updated: 2025-07-22T14:08:59.350Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: HotelRunner Products: B2B Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HotelRunner B2B allows Cross-Site Scripting (XSS).This issue affects B2B: before 04.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0169
CVE ID: CVE-2025-4295 State: PUBLISHED Published: 2025-07-22T13:58:00.772Z Last Updated: 2025-07-22T14:08:09.870Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: HotelRunner Products: B2B Problem Types: CWE-297 Description: Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting.This issue affects B2B: before 04.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0169
CVE ID: CVE-2025-4296 State: PUBLISHED Published: 2025-07-23T11:21:57.898Z Last Updated: 2025-07-23T13:08:51.281Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: HotelRunner Products: B2B Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.This issue affects B2B: before 04.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0169
CVE ID: CVE-2025-4297 State: PUBLISHED Published: 2025-05-05T23:00:10.871Z Last Updated: 2025-05-06T02:46:37.742Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Men Salon Management System 2.0. It has been classified as critical. This affects an unknown part of the file /admin/change-password.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
nd may be used. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307401 - https://vuldb.com/?ctiid.307401 - https://vuldb.com/?submit.563548 - https://github.com/lierran1/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4298 State: PUBLISHED Published: 2025-05-05T23:31:05.551Z Last Updated: 2025-05-06T02:45:01.333Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC1206 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307402 - https://vuldb.com/?ctiid.307402 - https://vuld