Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3388 State: PUBLISHED Published: 2025-04-07T23:00:14.566Z Last Updated: 2025-04-08T18:24:45.369Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: hailey888 Products: oa_system Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/gson/oasys/controller/login/LoginsController.java of the component Frontend. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is
ed remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303634 - https://vuldb.com/?ctiid.303634 - https://gitee.com/hailey888/oa_system/issues/IBRQYI
CVE ID: CVE-2025-3389 State: PUBLISHED Published: 2025-04-07T23:31:08.797Z Last Updated: 2025-04-08T18:24:37.446Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: hailey888 Products: oa_system Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the file cn/gson/oasys/controller/inform/InformManageController.java of the component Backend. The manipulation of the argument menu leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning
e initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303635 - https://vuldb.com/?ctiid.303635 - https://gitee.com/hailey888/oa_system/issues/IBRQXH
CVE ID: CVE-2025-3390 State: PUBLISHED Published: 2025-04-08T00:00:20.109Z Last Updated: 2025-04-08T13:29:49.170Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: hailey888 Products: oa_system Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file cn/gson/oass/controller/daymanager/DaymanageController.java of the component Backend. The manipulation of the argument scheduleList leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a r
e to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303636 - https://vuldb.com/?ctiid.303636 - https://gitee.com/hailey888/oa_system/issues/IBRRZX
CVE ID: CVE-2025-3391 State: PUBLISHED Published: 2025-04-08T00:31:08.246Z Last Updated: 2025-04-08T14:26:23.838Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: hailey888 Products: oa_system Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress of the file cn/gson/oass/controller/address/AddrController. java of the component Backend. The manipulation of the argument outtype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach
can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303637 - https://vuldb.com/?ctiid.303637 - https://gitee.com/hailey888/oa_system/issues/IBRRX3
CVE ID: CVE-2025-3392 State: PUBLISHED Published: 2025-04-08T01:00:16.164Z Last Updated: 2025-04-08T15:50:31.007Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: hailey888 Products: oa_system Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gson/oasys/controller/mail/MailController.java of the component Backend. The manipulation of the argument MailNumberId leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used
emotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303638 - https://vuldb.com/?ctiid.303638 - https://gitee.com/hailey888/oa_system/issues/IBRQZ9
CVE ID: CVE-2025-3393 State: PUBLISHED Published: 2025-04-08T01:00:21.778Z Last Updated: 2025-04-08T14:24:44.731Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: mrcen Products: springboot-ucan-admin Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an unknown part of the file /ucan-admin/index of the component Personal Settings Interface. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. T
e attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303639 - https://vuldb.com/?ctiid.303639 - https://gitee.com/mrcen/springboot-ucan-admin/issues/IBT2W5
CVE ID: CVE-2025-3394 State: PUBLISHED Published: 2025-04-30T12:34:50.577Z Last Updated: 2025-04-30T13:25:28.737Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Automation Builder Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-3395 State: PUBLISHED Published: 2025-04-30T12:40:37.562Z Last Updated: 2025-04-30T13:18:13.992Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ABB Products: Automation Builder Problem Types: CWE-732, CWE-312 Description: Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR011407&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-3396 State: PUBLISHED Published: 2025-07-10T08:31:04.703Z Last Updated: 2025-07-10T20:12:01.609Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue has been discovered in GitLab EE affecting all versions from 13.3 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated project owners to bypass group-level forking restrictions by manipulating API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/534636 - https://hackerone.com/reports/3079956
CVE ID: CVE-2025-3397 State: PUBLISHED Published: 2025-04-08T01:31:07.697Z Last Updated: 2025-04-08T14:23:46.699Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: YzmCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303642 - https://vuldb.com/?ctiid.303642 - https://vuldb.com/?submit.525203 - https://www.yuque.com/baimatangseng-iyusa/qwwm81/sqn7nf0irphq7f1k?singleDoc
CVE ID: CVE-2025-3398 State: PUBLISHED Published: 2025-04-08T01:31:09.596Z Last Updated: 2025-04-08T14:22:58.586Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: lenve Products: VBlog Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/src/main/java/org/sang/config/WebSecurityConfig.java. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303643 - https://vuldb.com/?ctiid.303643 - https://vuldb.com/?submit.525609 - https://magnificent-dill-351.notion.site/Improper-Authentication-Vulnerability-in-VBlog-1-0-0-1c0c693918ed80f2ace4fff7d1d51619
CVE ID: CVE-2025-3399 State: PUBLISHED Published: 2025-04-08T02:00:13.365Z Last Updated: 2025-04-08T15:49:05.951Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by this issue is some unknown functionality of the file /pubinfo/updateNotice.jsp. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analys
and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303644 - https://vuldb.com/?ctiid.303644 - https://vuldb.com/?submit.525610 - https://github.com/Rain1er/report/blob/main/CDG/MTA%3D.md
CVE ID: CVE-2025-3400 State: PUBLISHED Published: 2025-04-08T02:00:15.262Z Last Updated: 2025-04-08T15:48:28.220Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unknown part of the file /client/UnChkMailApplication.jsp. The manipulation of the argument typename leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303645 - https://vuldb.com/?ctiid.303645 - https://vuldb.com/?submit.525611 - https://github.com/Rain1er/report/blob/main/CDG/NA%3D%3D.md
CVE ID: CVE-2025-3401 State: PUBLISHED Published: 2025-04-08T02:31:04.193Z Last Updated: 2025-04-08T14:17:39.954Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in ESAFENET CDG 5.6.3.154.205_20250114 and classified as critical. This vulnerability affects unknown code of the file /parameter/getLimitIPList.jsp. The manipulation of the argument noticeId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
e used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303646 - https://vuldb.com/?ctiid.303646 - https://vuldb.com/?submit.525612 - https://github.com/Rain1er/report/blob/main/CDG/Ng%3D%3D.md
CVE ID: CVE-2025-3402 State: PUBLISHED Published: 2025-04-08T02:31:05.732Z Last Updated: 2025-04-08T18:24:29.189Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Seeyon Products: Zhiyuan Interconnect FE Collaborative Office Platform Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown processing of the file /sysform/042/check.js%70. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this di
ted remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303647 - https://vuldb.com/?ctiid.303647 - https://vuldb.com/?submit.542343 - https://github.com/Angel12345623/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-3403 State: PUBLISHED Published: 2025-04-08T03:00:11.278Z Last Updated: 2025-04-08T18:24:22.074Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N) Vendors: Vivotek Products: NVR ND8422P, NVR ND9525P, NVR ND9541P Problem Types: CWE-540, CWE-200 Description: A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacte
ble to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303648 - https://vuldb.com/?ctiid.303648 - https://vuldb.com/?submit.543589 - https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md
CVE ID: CVE-2025-3404 State: PUBLISHED Published: 2025-04-19T07:23:39.977Z Last Updated: 2025-04-21T14:11:45.109Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: codename065 Products: Download Manager Problem Types: CWE-22 Description: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function in all versions up to, and including, 3.3.12. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Ad
on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21f8f5be-b513-4040-af39-c1a61d7e313f?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.12/src/Admin/Menu/Packages.php#L45 - https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.12/src/Admin/Menu/Packages.php#L56
CVE ID: CVE-2025-3405 State: PUBLISHED Published: 2025-04-08T03:31:10.514Z Last Updated: 2025-04-08T18:24:13.628Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: FCJ Venture Builder Products: appclientefiel Problem Types: CWE-99 Description: A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDER_ID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public
roper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303649 - https://vuldb.com/?ctiid.303649 - https://vuldb.com/?submit.544136 - https://drive.google.com/file/d/1yhZiKFX0avpLDsYDlbnmmkTk4XTY8Y2h/view
CVE ID: CVE-2025-3406 State: PUBLISHED Published: 2025-04-08T03:31:12.145Z Last Updated: 2025-04-08T18:24:06.292Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:P/I:N/A:N) Vendors: Nothings Products: stb Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The ven
e to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303684 - https://vuldb.com/?ctiid.303684 - https://vuldb.com/?submit.544226
CVE ID: CVE-2025-3407 State: PUBLISHED Published: 2025-04-08T04:00:11.732Z Last Updated: 2025-04-08T18:23:58.113Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Nothings Products: stb Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_from_image. The manipulation of the argument h_count/v_count leads to out-of-bounds read. The attack can be launched remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vend
to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303685 - https://vuldb.com/?ctiid.303685 - https://vuldb.com/?submit.544227
CVE ID: CVE-2025-3408 State: PUBLISHED Published: 2025-04-08T04:00:13.361Z Last Updated: 2025-04-08T15:47:32.644Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Nothings Products: stb Problem Types: CWE-190, CWE-189 Description: A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Add
updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303686 - https://vuldb.com/?ctiid.303686 - https://vuldb.com/?submit.544230
CVE ID: CVE-2025-3409 State: PUBLISHED Published: 2025-04-08T04:31:03.810Z Last Updated: 2025-04-08T15:59:31.301Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Nothings Products: stb Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Nothings stb up to f056911. This affects the function stb_include_string. The manipulation of the argument path_to_includes leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond
fected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303687 - https://vuldb.com/?ctiid.303687 - https://vuldb.com/?submit.544231
CVE ID: CVE-2025-3410 State: PUBLISHED Published: 2025-04-08T05:00:10.078Z Last Updated: 2025-04-08T15:29:59.354Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: mymagicpower Products: AIAS Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in mymagicpower AIAS 20250308. This vulnerability affects unknown code of the file training_platform/train-platform/src/main/java/top/aias/training/controller/LocalStorageController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this discl
remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303688 - https://vuldb.com/?ctiid.303688 - https://vuldb.com/?submit.544243 - https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_RCE.md
CVE ID: CVE-2025-3411 State: PUBLISHED Published: 2025-04-08T05:00:12.594Z Last Updated: 2025-04-08T15:29:48.726Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: mymagicpower Products: AIAS Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, has been found in mymagicpower AIAS 20250308. This issue affects some unknown processing of the file 3_api_platform/api-platform/src/main/java/top/aias/platform/controller/AsrController.java. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this d