Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25357 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-14T17:11:54.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20Emails.pdf
CVE ID: CVE-2025-25361 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:48:51.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/c0rdXy/POC/blob/master/CVE/PublicCMS/XSS_02/XSS_02.md
CVE ID: CVE-2025-25362 State: PUBLISHED Published: 2025-03-05T00:00:00.000Z Last Updated: 2025-04-08T20:35:57.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/explosion/spacy-llm/issues/492 - https://www.hacktivesecurity.com/blog/2025/04/01/cve-2025-25362-old-vulnerabilities-new-victims-breaking-llm-prompts-with-ssti/
CVE ID: CVE-2025-25363 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T18:42:02.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload into the HTML field of a template. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://marketplace.atlassian.com/apps/4832/enterprise-mail-handler-for-jira-jemh/version-history?versionHistoryHosting=dataCent
marketplace.atlassian.com/apps/4832/enterprise-mail-handler-for-jira-jemh/version-history?versionHistoryHosting=dataCenter - https://github.com/florkie/CVE/blob/main/CVE-2025-25363.md
CVE ID: CVE-2025-25370 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T13:41:54.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive information via the show app only setting function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://realme.com - https://gist.github.com/krl5/4eeed04a065287489c2e606e6d48c1bc
CVE ID: CVE-2025-25371 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T14:00:25.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE ID: CVE-2025-25372 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T13:58:01.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE ID: CVE-2025-25373 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T14:43:11.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE ID: CVE-2025-25374 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T13:54:30.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/nasa-cfs-version-aquila-software-vulnerability-assessment/
CVE ID: CVE-2025-25379 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-04T15:44:16.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/R2og/Sun-jialiang/tree/main/9/readme.md
CVE ID: CVE-2025-25381 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-12T13:59:10.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/edwin-0990/CVE_ID/blob/main/CVE-2025-25381/README.md - https://www.tenable.com/cve/CVE-2025-25381 - https://github.com/advisories/GHSA-x2cr-cpw2-j9x5
CVE ID: CVE-2025-25382 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-20T20:40:37.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tax.lsgkerala.gov.in/epayment/QuickPaySearch.php - https://github.com/edwin-0990/CVE_ID/blob/main/CVE-2025-25382/README.md
CVE ID: CVE-2025-25387 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-14T16:30:40.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the propertytype POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20edited.pdf
CVE ID: CVE-2025-25388 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-13T19:25:08.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the editid GET request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20p%20editid.pdf
CVE ID: CVE-2025-25389 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-14T16:45:05.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/SQL%20Injection%20forget.pdf
CVE ID: CVE-2025-25403 State: PUBLISHED Published: 2025-04-29T00:00:00.000Z Last Updated: 2025-05-06T15:30:58.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/christopherralinanggoman/cve-skripsi/blob/main/my_reports/slims-9-bulian-coll-type-report.md - https://github.com/slims/slims9_bulian/issues/273
CVE ID: CVE-2025-25426 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-05T16:48:40.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/guchengwuyue/yshopmall/issues/34 - https://gist.github.com/Catherines77/79e6b69490b085d9c2d96c99e72c3579
CVE ID: CVE-2025-25427 State: PUBLISHED Published: 2025-04-18T00:03:00.275Z Last Updated: 2025-07-01T18:22:30.305Z Vendors: TP-Link Systems Inc. Products: TL-WR841N v14/v14.6/v14.8 Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload when the upnp page is loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tp-link.com/us/support/faq/4415/ - https://www.tp-link.com/us/support/downlo
ADP Vulnrichment: References: - https://www.tp-link.com/us/support/faq/4415/ - https://www.tp-link.com/us/support/download/tl-wr841n/#Firmware - https://github.com/slin99/2025-25427
CVE ID: CVE-2025-25428 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-04T15:41:40.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-Hardcoded-password-17815d9d4d2680d5a2becf32425d93fd
CVE ID: CVE-2025-25429 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-02-28T22:18:56.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name function on the /addschedule.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-10315d9d4d26801f8985c11a22389e6b
CVE ID: CVE-2025-25430 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-04T15:36:29.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-17a15d9d4d2680fbb72ced0a02a64875
CVE ID: CVE-2025-25431 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-04T15:37:43.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /captive_portal.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-17b15d9d4d26806a90f3d830a6143ebe
CVE ID: CVE-2025-25450 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T16:44:09.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://piuswalter.de/blog/2fa-bypass-and-deactivation-attack-in-mytaag/
CVE ID: CVE-2025-25451 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T16:45:37.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_authorized" Local Storage key Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://piuswalter.de/blog/2fa-bypass-and-deactivation-attack-in-mytaag/
CVE ID: CVE-2025-25452 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T16:46:27.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://piuswalter.de/blog/2fa-bypass-and-deactivation-attack-in-mytaag/
CVE ID: CVE-2025-25453 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T18:29:51.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-serviceName2-StackOverflow - https://gist.github.com/xyqer1/84dc6d8b3f92597d1d597b2799c2c45f
CVE ID: CVE-2025-25454 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T14:02:25.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-wanSpeed2-StackOverflow - https://gist.github.com/xyqer1/491bfd8b9b0868977dca66ab6ce238d2
CVE ID: CVE-2025-25455 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T14:01:29.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-wanMTU2-StackOverflow - https://gist.github.com/xyqer1/6c865a9ec44b4797e78b6765cd5c84e5
CVE ID: CVE-2025-25456 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:34:29.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-mac2-StackOverflow - https://gist.github.com/xyqer1/ab1e6a2bd369aaada0666639c843aff0
CVE ID: CVE-2025-25457 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T12:02:24.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via cloneType2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-cloneType2-StackOverflow - https://gist.github.com/xyqer1/f69ebbdec019cacf5870ea55e25780a4
CVE ID: CVE-2025-25458 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T18:28:05.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Tenda-AC10-AdvSetMacMtuWan-serverName2-StackOverflow - https://gist.github.com/xyqer1/d195ea1eb37ba1cc5f709b1d4fc1a2c6
CVE ID: CVE-2025-25460 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-24T16:52:23.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress - https://github.com/RoNiXxCybSe
otes: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress - https://github.com/RoNiXxCybSeC0101/CVE-2025-25460
CVE ID: CVE-2025-25461 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-02-28T16:00:43.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
browser of any user who views the document. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.seeddms.org/ - https://github.com/RoNiXxCybSeC0101/CVE-2025-25461
CVE ID: CVE-2025-25462 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-12T18:54:01.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote attackers to execute arbitrary code via the propertytype POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/terrasystemlabs/CVE-IDs/blob/main/PHP-Gurukul/Land-record/Land_SQL_Injection.pdf
CVE ID: CVE-2025-25467 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T14:39:01.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code.videolan.org/videolan/x264/-/issues/75
CVE ID: CVE-2025-25468 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T14:55:23.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trac.ffmpeg.org/ticket/11415 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd
CVE ID: CVE-2025-25469 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-19T21:37:47.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd - https://trac.ffmpeg.org/ticket/11416
CVE ID: CVE-2025-25471 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-20T21:05:48.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/fd1772b7475d0d5673a5dd314ee78443d0be4cf1 - https://trac.ffmpeg.org/ticket/11417
CVE ID: CVE-2025-25472 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-11-03T19:45:05.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=410ffe2019b9db6a8f4036daac742a6f5e4d36c2
CVE ID: CVE-2025-25473 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-02-20T21:10:17.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c - https://trac.ffmpeg.org/ticket/11419 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b
CVE ID: CVE-2025-25474 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-11-03T19:45:06.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=1d205bcd307164c99e0d4bbf412110372658d847
CVE ID: CVE-2025-25475 State: PUBLISHED Published: 2025-02-18T00:00:00.000Z Last Updated: 2025-11-03T19:45:08.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=bffa3e9116abb7038b432443f16b1bd390e80245 - https://github.com/DCMTK/dcmtk/commit/bffa3e9116abb7038b432443f16b1bd390e80245
CVE ID: CVE-2025-25476 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-04T15:46:52.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476
CVE ID: CVE-2025-25477 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T15:15:41.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25477
CVE ID: CVE-2025-25478 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-05T15:33:21.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478