Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-51531 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-11T15:40:28.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a victim's browser via injecting a crafted payload into the tabfields parameter at /dpw/scripts/cgiip.exe/WService. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/sage-dpw
: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/sage-dpw-schwachstelle-xss-in-db-monitor-tabfields/
CVE ID: CVE-2025-51532 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-11T15:32:03.199Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The vendor has stated that the issue is fixed in 2025_06_000, released in June 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/sage-dpw-unauthentifizierter-zugriff-adminbereich-db-mo
/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/sage-dpw-unauthentifizierter-zugriff-adminbereich-db-monitor/
CVE ID: CVE-2025-51533 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T19:14:17.143Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen - https://www.sec4you-pentest.com/schwachstelle/sage-dpw-vorhersehbare-url-ids-ermoeglichen-unautorisierten-zugriff-auf-interne-formulare/
CVE ID: CVE-2025-51534 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T14:41:50.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-stored-nested-xss-delete-button/
CVE ID: CVE-2025-51535 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T16:51:04.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-unbeschraenkte-sql-konsole-im-admin-ui/
CVE ID: CVE-2025-51536 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-04T15:22:04.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-standard-adminkonto-mit-hartcodiertem-passwort/
CVE ID: CVE-2025-51539 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T19:54:24.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to a PHP script to read arbitrary files from the filesystem. The script lacks both authentication checks and secure path handling, allowing directory traversal attacks (e.g., ../../../) to access sensitive files such as configuration files, database dumps, source code, and password reset
e.g., ../../../) to access sensitive files such as configuration files, database dumps, source code, and password reset tokens. If phpMyAdmin is exposed, extracted credentials can be used for direct administrative access. In environments without such tools, attacker-controlled file reads still allow full database extraction by targeting raw MySQL data files. The vendor states that the issue is fixed in 3.5.72.27183. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ballpoint.fr/en/blog/ezged3-preauth-file-read-admin-takeover
CVE ID: CVE-2025-51540 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T19:59:17.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and allows attackers to perform efficient offline brute-force attacks if password hashes are disclosed. The lack of salting and use of a fast, outdated algorithm makes it feasible to recover plaintext credentials using precomputed tables or GPU-based cracking tools. The vendor states that the issue is fixed in 3.5.72.27183. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
vendor states that the issue is fixed in 3.5.72.27183. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ballpoint.fr/en/blog/ezged3-preauth-file-read-admin-takeover
CVE ID: CVE-2025-51541 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-07T14:03:50.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_schema field fails to properly sanitize user-supplied input before rendering it in the browser, allowing an attacker to inject malicious JavaScript. This vulnerability can be exploited via a Cross-Site Request Forgery (CSRF) attack due to the absence of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, whe
nce of CSRF protections on the POST request. An unauthenticated remote attacker can craft a malicious web page that, when visited by a victim, stores the payload persistently in the installation configuration. As a result, the payload executes whenever any user subsequently accesses the vulnerable installation page, leading to persistent client-side code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dax-tokaido.com/recovery/install/database-configuration/ - https://gist.github.com/anonx-hunter/a7ef32a01d7d888413b08bf8589fdd7e#file-cve-2025-51541-shopware-xss-md
CVE ID: CVE-2025-51543 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-20T18:56:31.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/reset_password endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cicool.com - https://github.com/JustDinooo/CVEs/blob/main/CVE-2025-51543/poc.md
CVE ID: CVE-2025-51569 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T19:49:43.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to inject arbitrary JavaScript, which is executed in the context of the router's origin when the crafted URL is accessed. The issue requires user interaction to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
is accessed. The issue requires user interaction to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lb-link.com/CPE300M-AX300-4G-LTE-Router-pd502775568.html - https://www.zyenra.com/blog/xss-in-lb-link-lb-cpe300m.html
CVE ID: CVE-2025-51586 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T17:50:16.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://prestashop.com/ - https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1 - https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md
CVE ID: CVE-2025-51591 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-11-24T21:52:10.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf. Additional Analyst
external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf. Additional Analyst Notes: - CISA ADP Vulnrichment: pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf. References: - http://jgm.com - http://pandoc.com - https://github.com/RealestName/Vulnerability-Research/tree/main/CVE-2025-51591 - https://github.com/jgm/pandoc/issues/8874 - https://github.com/jgm/pandoc/issues/10682 - https://github.com/jgm/pandoc/discussi
/github.com/jgm/pandoc/issues/8874 - https://github.com/jgm/pandoc/issues/10682 - https://github.com/jgm/pandoc/discussions/11200 - https://github.com/jgm/pandoc/issues/11261 - https://github.com/jgm/pandoc/pull/11262 - https://www.wiz.io/blog/imds-anomaly-hunting-zero-day
CVE ID: CVE-2025-51605 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T16:11:20.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Shopizer 3.2.7. The server's CORS implementation reflects the client-supplied Origin header verbatim into Access-Control-Allow-Origin without any whitelist validation, while also enabling Access-Control-Allow-Credentials: true. This allows any malicious origin to make authenticated cross-origin requests and read sensitive responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250512-02.md
CVE ID: CVE-2025-51606 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-22T13:56:21.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250610-01.md
CVE ID: CVE-2025-51624 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T19:54:54.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bitaqati.com - http://zone.com - https://zone.net.sa/bitaqati-self-service/ - https://medium.com/@a77777mad/cross-site-scripting-xss-vulnerability-in-zone-bitaqati-v3-4-0-a05b980b4df4
CVE ID: CVE-2025-51627 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T20:03:01.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agenziaimpresa.com - http://eccobook.com - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2025-51627%20%7C%20Eccobook.md
CVE ID: CVE-2025-51628 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T18:00:07.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to read confidential documents via the DocumentoId parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://eccobook.com - http://agenzia.com - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2025-51628%20%7C%20Eccobook.md
CVE ID: CVE-2025-51629 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T18:09:28.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://eccobook.com - http://agenzia.com - https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2025-51629%20%7C%20Eccobook.md
CVE ID: CVE-2025-51630 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-07-17T19:14:19.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilterRules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/Totolink-N350RT-Vulnerability/blob/main/1-ePort.md
CVE ID: CVE-2025-51643 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:07:31.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NastyCrow/CVE-2025-51643
CVE ID: CVE-2025-51650 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:14:05.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a crafted template file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Y4y17/Foxcms/blob/main/Foxcms%20%3C%3D%20v1.2.6%20RCE.md
CVE ID: CVE-2025-51651 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:15:51.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Y4y17/CVE/blob/main/Arbitrary%20file%20download%20vulnerability.md
CVE ID: CVE-2025-51652 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:26:50.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_1.md
CVE ID: CVE-2025-51653 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:28:14.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_2.md
CVE ID: CVE-2025-51654 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:28:58.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_3.md
CVE ID: CVE-2025-51655 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:30:07.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_4.md
CVE ID: CVE-2025-51656 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:31:07.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_5.md
CVE ID: CVE-2025-51657 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:31:58.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_6.md
CVE ID: CVE-2025-51658 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:33:04.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_7.md
CVE ID: CVE-2025-51659 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:34:07.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_8.md
CVE ID: CVE-2025-51660 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T19:35:00.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://www.sem-cms.com/ - https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_9.md
CVE ID: CVE-2025-51661 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T21:05:08.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path Traversal vulnerability found in FileCodeBox v2.2 and earlier allows arbitrary file writes when application is configured to use local filesystem storage. SystemFileStorage.save_file method in core/storage.py uses filenames from user input without validation to construct save_path and save files. This allows remote attackers to perform arbitrary file writes outside the intended directory by sending crafted POST requests with malicious traversal sequences to /share/file/ upload endpoint, which does not require any
ng crafted POST requests with malicious traversal sequences to /share/file/ upload endpoint, which does not require any authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vastsa/FileCodeBox - https://github.com/vastsa/FileCodeBox/issues/349
CVE ID: CVE-2025-51662 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T16:04:03.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. Insufficient input validation allows attackers to inject arbitrary JavaScript code into shared text "codeboxes". The xss payload is automatically executed in the browsers of any users who try to access the infected codebox by clicking link or entering share code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vastsa/FileCodeBox - https://github.com/vastsa/File
yst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vastsa/FileCodeBox - https://github.com/vastsa/FileCodeBox/issues/351
CVE ID: CVE-2025-51663 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T21:08:20.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share codes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vastsa/FileCodeBox - https://github.com/vastsa/FileCodeBox/issues/350
CVE ID: CVE-2025-51667 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T17:46:49.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection vulnerability, which may lead to partial data leakage or disruption of normal system operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/suyuan32/simple-admin-core/issues/333 - https://gist.github.com/66Giraffe66/fc258f7fcc65a6a1a1a01e217977b92d