Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8511 State: PUBLISHED Published: 2025-08-03T13:32:05.211Z Last Updated: 2025-08-04T18:46:21.177Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ of the component Observações. The manipulation of the argument Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond i
been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318610 - https://vuldb.com/?ctiid.318610 - https://vuldb.com/?submit.618973 - https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-8511.md - https://github.com/marcelomulder/CVE/blob/main/i-diario/Stored%20XSS%20endpoint%20diario-de-observacoes.(ID)%20in%20'Observa%C3%A7%C3%B5es-Descri%C3%A7%C3%A3o'%20parameter.md
CVE ID: CVE-2025-8512 State: PUBLISHED Published: 2025-08-03T14:02:05.823Z Last Updated: 2025-08-04T18:37:38.290Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: TVB Products: Big Big Shop App Problem Types: CWE-926 Description: A vulnerability, which was classified as problematic, has been found in TVB Big Big Shop App 2.9.0 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component hk.com.tvb.bigbigshop. The manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was con
An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318611 - https://vuldb.com/?ctiid.318611 - https://vuldb.com/?submit.619028 - https://github.com/KMov-g/androidapps/blob/main/hk.com.tvb.bigbigshop.md
CVE ID: CVE-2025-8513 State: PUBLISHED Published: 2025-08-03T14:32:05.191Z Last Updated: 2025-08-04T18:35:28.767Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Caixin Products: News App Problem Types: CWE-926 Description: A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.caixin.news. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about thi
oach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318612 - https://vuldb.com/?ctiid.318612 - https://vuldb.com/?submit.619029 - https://github.com/KMov-g/androidapps/blob/main/com.caixin.news.md
CVE ID: CVE-2025-8515 State: PUBLISHED Published: 2025-08-04T10:32:05.124Z Last Updated: 2025-10-29T06:53:04.612Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Intelbras Products: InControl Problem Types: CWE-200, CWE-284 Description: A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoint. Executing manipulation can lead to information disclosure. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been made available to the
ociated with this attack. It is stated that the exploitability is difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318641 - https://vuldb.com/?ctiid.318641 - https://vuldb.com/?submit.579544 - https://backend.intelbras.com/sites/default/files/2025-08/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.60%20e%202.21.61%20PT-IN%20.pdf
CVE ID: CVE-2025-8516 State: PUBLISHED Published: 2025-08-04T15:32:07.731Z Last Updated: 2025-11-03T06:13:01.303Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Kingdee Products: Cloud-Starry-Sky Enterprise Edition Problem Types: CWE-22 Description: A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!\kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the component IIS-K3CloudMiniApp. The manipulation of the argument filePath
base\webapp\action\FileUploadAction.class of the component IIS-K3CloudMiniApp. The manipulation of the argument filePath leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The vendor recommends as a short-term measure to "[t]emporarily disable external network access to the Kingdee Cloud Galaxy Retail System or set up an IP whitelist for access control." The long-term remediation will be: "Install the security patch provided by the Starry Sky system, with the specific solutions being: i) Adding authentication to the vulnerable CMKAppWebHandler.ashx interface; ii) Rem
, with the specific solutions being: i) Adding authentication to the vulnerable CMKAppWebHandler.ashx interface; ii) Removing the file reading function." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318642 - https://vuldb.com/?ctiid.318642 - https://vuldb.com/?submit.573678 - https://vuldb.com/?submit.601912 - https://wx.mail.qq.com/s?k=hk3Fixc6Z1cKMI9rge - https://vip.kingdee.com/link/s/ZgAmJ
CVE ID: CVE-2025-8517 State: PUBLISHED Published: 2025-08-04T16:02:08.427Z Last Updated: 2025-08-18T16:58:49.077Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: givanz Products: Vvveb Problem Types: CWE-384 Description: A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.0.7 is recommended to address this issue. The patch is identified as d4b1e030066417b77d15b4ac505eed5ae7bf2c5e. You should upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
c505eed5ae7bf2c5e. You should upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318643 - https://vuldb.com/?ctiid.318643 - https://vuldb.com/?submit.623135 - https://github.com/givanz/Vvveb/issues/312 - https://github.com/givanz/Vvveb/issues/312#issuecomment-2977995664 - https://github.com/kwerty138/Session-Fixation-in-Vvveb-CMS-v1.0.6.1 - https://github.com/givanz/Vvveb/commit/d4b1e030066417b77d15b4ac505eed5ae7bf2c5e - https://github.com/givanz/Vvveb/releases/tag/1.0.7
CVE ID: CVE-2025-8518 State: PUBLISHED Published: 2025-08-04T17:02:06.746Z Last Updated: 2025-08-05T17:28:38.905Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: givanz Products: Vvveb Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db7157
and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318644 - https://vuldb.com/?ctiid.318644 - https://vuldb.com/?submit.624971 - https://hkohi.ca/vulnerability/8 - https://gist.github.com/0xHamy/f16fb399f8dd3a973acadc18fa07b1cb - https://github.com/givanz/Vvveb/commit/f684f3e374d04db715730fc4796e102f5ebcacb2 - https://github.com/givanz/Vvveb/releases/tag/1.0.6
CVE ID: CVE-2025-8519 State: PUBLISHED Published: 2025-08-04T17:32:06.854Z Last Updated: 2025-08-05T15:57:55.383Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:OF/RC:C) Vendors: givanz Products: Vvveb Problem Types: CWE-200, CWE-284 Description: A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this i
tely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The identifier of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318645 - https://vuldb.com/?ctiid.318645 - https://vuldb.com/?submit.624972 - https://hkohi.ca/vulnerability/10 - https://github.com/givanz/Vvveb/commit/f684f3e374d04db715730fc4796e102f5ebcacb2 - https://github.com/givanz/Vvveb/releases/tag/1.0.6
CVE ID: CVE-2025-8520 State: PUBLISHED Published: 2025-08-04T18:02:06.491Z Last Updated: 2025-08-05T15:54:19.112Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: givanz Products: Vvveb Problem Types: CWE-918 Description: A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is i
s been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is identified as f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318646 - https://vuldb.com/?ctiid.318646 - https://vuldb.com/?submit.624973 - https://hkohi.ca/vulnerability/9 - https://github.com/givanz/Vvveb/commit/f684f3e374d04db715730fc4796e102f5ebcacb2 - https://github.com/givanz/Vvveb/releases/tag/1.0.6
CVE ID: CVE-2025-8521 State: PUBLISHED Published: 2025-08-04T18:32:06.153Z Last Updated: 2025-08-05T15:47:16.792Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: givanz Products: Vvveb Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue.
The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is named b53c7161da606f512b7efcb392d6ffc708688d49/605a70f8729e4d44ebe272671cb1e43e3d6ae014. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318647 - https://vuldb.com/?ctiid.318647 - https://vuldb.com/?submit.625003 - https://hkohi.ca/vulnerability/11 - https://github.com/givanz/Vvveb/commit/b53c7161da606f512b7efcb392d6ffc708688d49 - https://github.com/givanz/Vvveb/releases/tag/1.0.6
CVE ID: CVE-2025-8522 State: PUBLISHED Published: 2025-08-04T19:02:05.798Z Last Updated: 2025-08-04T19:25:56.076Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: givanz Products: Vvvebjs Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Affected is an unknown function of the file /save.php of the component node.js. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. A
rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318648 - https://vuldb.com/?ctiid.318648 - https://vuldb.com/?submit.616993 - https://github.com/givanz/VvvebJs/issues/409 - https://github.com/givanz/VvvebJs/issues/409#issue-3235569867
CVE ID: CVE-2025-8523 State: PUBLISHED Published: 2025-08-04T19:32:05.733Z Last Updated: 2025-08-04T19:59:57.687Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: RiderLike Products: Fruit Crush-Brain App Problem Types: CWE-926 Description: A vulnerability has been found in RiderLike Fruit Crush-Brain App 1.0 on Android and classified as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.fruitcrush.fun. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the pu
application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318649 - https://vuldb.com/?ctiid.318649 - https://vuldb.com/?submit.619035 - https://github.com/KMov-g/androidapps/blob/main/com.fruitcrush.fun.md
CVE ID: CVE-2025-8524 State: PUBLISHED Published: 2025-08-04T20:02:05.674Z Last Updated: 2025-08-04T20:17:54.897Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Boquan Products: DotWallet App Problem Types: CWE-926 Description: A vulnerability was found in Boquan DotWallet App 2.15.2 on Android and classified as problematic. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.boquanhash.dotwallet. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was
The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318650 - https://vuldb.com/?ctiid.318650 - https://vuldb.com/?submit.619037 - https://github.com/KMov-g/androidapps/blob/main/com.boquanhash.dotwallet.md
CVE ID: CVE-2025-8525 State: PUBLISHED Published: 2025-08-04T20:32:05.870Z Last Updated: 2025-08-05T15:44:45.527Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Exrick Products: xboot Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318651 - https://vuldb.com/?ctiid.318651 - https://vuldb.com/?submit.622172 - https://github.com/Exrick/xboot/issues/72 - https://github.com/Exrick/xboot/issues/72#issue-3252465914
CVE ID: CVE-2025-8526 State: PUBLISHED Published: 2025-08-04T21:02:05.466Z Last Updated: 2025-08-05T15:43:54.503Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Exrick Products: xboot Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: -
ck can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318652 - https://vuldb.com/?ctiid.318652 - https://vuldb.com/?submit.622173 - https://github.com/Exrick/xboot/issues/71 - https://github.com/Exrick/xboot/issues/71#issue-3252446955
CVE ID: CVE-2025-8527 State: PUBLISHED Published: 2025-08-04T21:32:06.008Z Last Updated: 2025-08-05T13:38:09.297Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Exrick Products: xboot Problem Types: CWE-918 Description: A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/main/java/cn/exrick/xboot/modules/base/controller/common/SecurityController.java of the component Swagger. The manipulation of the argument loginUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Addit
quest forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318653 - https://vuldb.com/?ctiid.318653 - https://vuldb.com/?submit.622174 - https://github.com/Exrick/xboot/issues/70 - https://github.com/Exrick/xboot/issues/70#issue-3252425972
CVE ID: CVE-2025-8528 State: PUBLISHED Published: 2025-08-04T22:02:06.163Z Last Updated: 2025-08-05T13:35:38.680Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Exrick Products: xboot Problem Types: CWE-315, CWE-312 Description: A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList. The manipulation leads to cleartext storage of sensitive information in a cookie. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and
f an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318654 - https://vuldb.com/?ctiid.318654 - https://vuldb.com/?submit.622175 - https://github.com/Exrick/xboot/issues/69 - https://github.com/Exrick/xboot/issues/69#issue-3252177305
CVE ID: CVE-2025-8529 State: PUBLISHED Published: 2025-08-04T22:32:05.485Z Last Updated: 2025-08-05T13:18:48.609Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: cloudfavorites Products: favorites-web Problem Types: CWE-918 Description: A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl of the file app/src/main/java/com/favorites/web/CollectController.java. The manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: -
tack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318655 - https://vuldb.com/?ctiid.318655 - https://vuldb.com/?submit.622176 - https://github.com/cloudfavorites/favorites-web/issues/134 - https://github.com/cloudfavorites/favorites-web/issues/134#issue-3252105130
CVE ID: CVE-2025-8530 State: PUBLISHED Published: 2025-08-04T23:02:06.927Z Last Updated: 2025-08-05T15:26:51.524Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: elunez Products: eladmin Problem Types: CWE-1392 Description: A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file eladmin-system\src\main\resources\config\application-prod.yml of the component Druid. The manipulation of the argument login-username/login-password leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the publ
ord leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318656 - https://vuldb.com/?ctiid.318656 - https://vuldb.com/?submit.622177 - https://github.com/elunez/eladmin/issues/883 - https://github.com/elunez/eladmin/issues/883#issue-3252078139
CVE ID: CVE-2025-8531 State: PUBLISHED Published: 2025-09-19T09:30:21.832Z Last Updated: 2025-09-24T05:39:19.865Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Mitsubishi Electric Corporation Products: MELSEC-Q Series Q03UDVCPU, MELSEC-Q Series Q04UDVCPU, MELSEC-Q Series Q06UDVCPU, MELSEC-Q Series Q13UDVCPU, MELSEC-Q Series Q26UDVCPU, MELSEC-Q Series Q04UDPVCPU, MELSEC-Q Series Q06UDPVCPU, MELSEC-Q Series Q13UDPVCPU, MELSEC-Q Series Q26UDPVCPU Problem Types: CWE-130 Description: Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVC
ility in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled. Additional Analyst Note