Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323869 - https://vuldb.com/?ctiid.323869 - https://vuldb.com/?submit.647615 - https://github.com/ldz23/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-10436 State: PUBLISHED Published: 2025-09-15T09:32:05.497Z Last Updated: 2025-09-15T16:40:08.234Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Computer Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/sup_searchfrm.php?action=edit. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichme
he exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323870 - https://vuldb.com/?ctiid.323870 - https://vuldb.com/?submit.647616 - https://github.com/ldz23/cve/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-10437 State: PUBLISHED Published: 2025-11-19T11:41:06.202Z Last Updated: 2025-11-19T16:08:39.462Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Eksagate Electronic Engineering and Computer Industry Trade Inc. Products: Webpack Management System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection.This issue affects Webpack Management System: through 20251119. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.t
gement System: through 20251119. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0401
CVE ID: CVE-2025-10438 State: PUBLISHED Published: 2025-09-25T09:18:44.444Z Last Updated: 2025-09-25T14:33:40.806Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Products: Yordam Katalog Problem Types: CWE-27 Description: Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal.This issue affects Yordam Katalog: before 21.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0296
CVE ID: CVE-2025-10439 State: PUBLISHED Published: 2025-09-17T11:45:49.521Z Last Updated: 2025-09-17T13:08:26.961Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yordam Informatics Products: Yordam Library Automation System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection.This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0268
CVE ID: CVE-2025-10440 State: PUBLISHED Published: 2025-09-15T10:02:07.376Z Last Updated: 2025-09-15T16:27:56.083Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003, DI-8003G Problem Types: CWE-78, CWE-77 Description: A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the p
ument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323874 - https://vuldb.com/?ctiid.323874 - https://vuldb.com/?submit.647835 - https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md - https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_1.md#exp - https://www.dlink.com/
CVE ID: CVE-2025-10441 State: PUBLISHED Published: 2025-09-15T10:32:05.537Z Last Updated: 2025-09-15T12:03:04.381Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DI-8100G, DI-8200G, DI-8003G Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
emotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323875 - https://vuldb.com/?ctiid.323875 - https://vuldb.com/?submit.647837 - https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_2.md - https://github.com/2664521593/mycve/blob/main/D-Link/D-Link_CJ_2.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-10442 State: PUBLISHED Published: 2025-09-15T11:02:06.735Z Last Updated: 2025-09-15T11:59:00.751Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC9, AC15 Problem Types: CWE-78, CWE-77 Description: A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323876 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323876 - https://vuldb.com/?ctiid.323876 - https://vuldb.com/?submit.647838 - https://vuldb.com/?submit.647839 - https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md - https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-10443 State: PUBLISHED Published: 2025-09-15T11:32:07.435Z Last Updated: 2025-09-15T11:40:44.495Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC9, AC15 Problem Types: CWE-120, CWE-119 Description: A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323877 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323877 - https://vuldb.com/?ctiid.323877 - https://vuldb.com/?submit.647840 - https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC15_AC9_Bof.md - https://github.com/2664521593/mycve/blob/main/Tenda/Tenda_AC15_AC9_Bof.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-10444 State: PUBLISHED Published: 2025-09-15T12:02:06.895Z Last Updated: 2025-09-15T20:35:58.652Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Job Finder System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Campcodes Online Job Finder System 1.0. This issue affects some unknown processing of the file /advancesearch.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
en released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323878 - https://vuldb.com/?ctiid.323878 - https://vuldb.com/?submit.647851 - https://github.com/HAO-RAY/HCR-CVE/issues/5 - https://www.campcodes.com/
CVE ID: CVE-2025-10445 State: PUBLISHED Published: 2025-09-15T12:32:08.056Z Last Updated: 2025-09-15T20:38:11.959Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Computer Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/us_transac.php?action=add. Executing manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
oit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323879 - https://vuldb.com/?ctiid.323879 - https://vuldb.com/?submit.647886 - https://github.com/e1evensu/cve/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-10446 State: PUBLISHED Published: 2025-09-15T13:02:07.176Z Last Updated: 2025-09-15T20:38:53.370Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Computer Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_searchfrm.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
ck remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323880 - https://vuldb.com/?ctiid.323880 - https://vuldb.com/?submit.647887 - https://github.com/e1evensu/cve/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-10447 State: PUBLISHED Published: 2025-09-15T13:32:06.103Z Last Updated: 2025-09-15T15:10:33.561Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Job Finder System Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in Campcodes Online Job Finder System 1.0. The impacted element is an unknown function of the file /eris/applicationform.php. The manipulation of the argument picture results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323881 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323881 - https://vuldb.com/?ctiid.323881 - https://vuldb.com/?submit.648014 - https://github.com/HAO-RAY/HCR-CVE/issues/6 - https://www.campcodes.com/
CVE ID: CVE-2025-10448 State: PUBLISHED Published: 2025-09-15T14:02:07.388Z Last Updated: 2025-09-15T14:54:20.242Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Job Finder System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Campcodes Online Job Finder System 1.0. This affects an unknown function of the file /index.php?q=result&searchfor=bycompany. This manipulation of the argument Search causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323882 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323882 - https://vuldb.com/?ctiid.323882 - https://vuldb.com/?submit.648023 - https://github.com/HAO-RAY/HCR-CVE/issues/7 - https://www.campcodes.com/
CVE ID: CVE-2025-10449 State: PUBLISHED Published: 2025-09-25T12:39:30.788Z Last Updated: 2025-09-25T12:58:39.262Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Saysis Computer Systems Trade Ltd. Co. Products: Saysis Web Portal Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows Path Traversal.This issue affects Saysis Web Portal: from 3.1.9 & 3.2.0 before 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0297
CVE ID: CVE-2025-10452 State: PUBLISHED Published: 2025-09-15T02:47:42.837Z Last Updated: 2025-09-15T17:14:02.550Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Gotac Products: Statistical Database System Problem Types: CWE-306 Description: Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10379-70d40-1.html - https://www.twcert.org.tw/en/cp-139-10380-1ce73-2.html
CVE ID: CVE-2025-10453 State: PUBLISHED Published: 2025-09-15T06:06:11.345Z Last Updated: 2025-09-15T15:51:56.654Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: PilotGaea Technologies Products: O'View MapServer Problem Types: CWE-918 Description: O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10381-4d482-1.html - https://www.twcert.org.tw/en/cp-139-10382-781cc-2.html
CVE ID: CVE-2025-10456 State: PUBLISHED Published: 2025-09-19T05:21:33.363Z Last Updated: 2025-09-19T11:57:01.588Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-190 Description: A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on
n. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hcc8-3qr7-c9m8
CVE ID: CVE-2025-10457 State: PUBLISHED Published: 2025-09-19T05:17:40.189Z Last Updated: 2025-09-19T13:09:35.846Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-358 Description: The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xqj6-vh76-2vv8
CVE ID: CVE-2025-10458 State: PUBLISHED Published: 2025-09-19T05:20:20.097Z Last Updated: 2025-09-19T13:08:35.786Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: zephyrproject-rtos Products: Zephyr Problem Types: CWE-130 Description: Parameters are not validated or sanitized, and are later used in various internal operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vmww-237q-2fwp
CVE ID: CVE-2025-10459 State: PUBLISHED Published: 2025-09-15T15:02:07.440Z Last Updated: 2025-09-15T15:22:56.149Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/all-appointment.php. The manipulation of the argument delid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323887 - https://vuldb.com/?ctiid.323887 - https://vuldb.com/?submit.648355 - https://github.com/xiaoxinkaishi/cve/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-10460 State: PUBLISHED Published: 2025-11-17T02:48:25.684Z Last Updated: 2025-11-17T16:42:22.769Z Vendors: BEIMS Products: Contractor Web Problem Types: CWE-20 Description: A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unauthorised user to retrieve sensitive database contents via unsanitized parameter input. This vulnerability occurs due to improper input validation on /BEIMSWeb/contractor.asp endpoint and successful exploitation requires a contractor.asp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising th
sp endpoint open to the internet. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity and potentially the availability of the database. Version 5.7.139 has been confirmed as vulnerable. Other versions have not been confirmed by the vendor and users should assume that all versions of BEIMS Contractor Web may be impacted until further guidance is provided by the vendor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.fmiworks.com/knowledge/beims-web - https://help.fmiworks.com/knowledge/contractor-web-operational-requirements
CVE ID: CVE-2025-10467 State: PUBLISHED Published: 2025-09-25T13:30:04.076Z Last Updated: 2025-09-25T15:13:08.666Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: PROLIZ Computer Software Hardware Service Trade Ltd. Co. Products: OBS (Student Affairs Information System) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS.This issue affects OBS (Student Affairs Information System): before v25.0401. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
s OBS (Student Affairs Information System): before v25.0401. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0298
CVE ID: CVE-2025-10468 State: PUBLISHED Published: 2025-09-19T11:07:44.328Z Last Updated: 2025-09-19T11:22:35.519Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Beyaz Computer Products: CityPlus Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal.This issue affects CityPlus: before 24.29375. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0279
CVE ID: CVE-2025-10471 State: PUBLISHED Published: 2025-09-15T16:32:07.024Z Last Updated: 2025-09-16T15:46:24.806Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: ZKEACMS Problem Types: CWE-918 Description: A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of the argument url results in server-side request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323890 - https://vuldb.com/?ctiid.323890 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323890 - https://vuldb.com/?ctiid.323890 - https://vuldb.com/?submit.648387 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb022.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb022.md#poc
CVE ID: CVE-2025-10472 State: PUBLISHED Published: 2025-09-15T18:32:07.097Z Last Updated: 2025-09-15T18:51:43.540Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: harry0703 Products: MoneyPrinterTurbo Problem Types: CWE-22 Description: A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function download_video/stream_video of the file app/controllers/v1/video.py of the component URL Handler. The manipulation of the argument file_path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323892 - https://vuldb.com/?ctiid.323892 - https://vuldb.com/?submit.648393 - https://www.notion.so/Path-Traversal-Vulnerability-in-MoneyPrinterTurbo-1-2-6-265014c4d9ca80e38da4deaeee8b46f5?source=copy_link
CVE ID: CVE-2025-10473 State: PUBLISHED Published: 2025-09-15T19:02:05.869Z Last Updated: 2025-09-16T13:50:09.596Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the file /com/ruoyi/common/utils/sql/SqlUtil.java of the component Blacklist Handler. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323905 - https://vuldb.com/?ctiid.323905 - https://vuldb.com/?submit.648475 - https://github.com/mo957/vuln/blob/main/ruoyi_sqlinject/ruoyi_sqlinject.md
CVE ID: CVE-2025-10475 State: PUBLISHED Published: 2025-09-15T20:02:08.772Z Last Updated: 2025-09-15T20:14:24.220Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: n/a Products: SpyShelter Problem Types: CWE-404 Description: A weakness has been identified in SpyShelter up to 15.4.0.1015. Affected is an unknown function in the library SpyShelter.sys of the component IOCTL Handler. This manipulation causes denial of service. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. Upgrading to version 15.4.0.1028 is able to address this issue. It is advisable to upgrade the affected compone