Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3542 State: PUBLISHED Published: 2025-04-13T23:31:06.617Z Last Updated: 2025-04-14T18:04:09.011Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX400, Magic R3010 Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_WizardProtoProcess of the file /api/wizard/getsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may
jection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304581 - https://vuldb.com/?ctiid.304581 - https://vuldb.com/?submit.524738 - https://gist.github.com/mono7s/dd7a0a1ec444bb2c228590d298e37a5d - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3543 State: PUBLISHED Published: 2025-04-14T00:00:12.283Z Last Updated: 2025-04-14T17:14:07.365Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability affects the function FCGI_WizardProtoProcess of the file /api/wizard/setsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit
ndler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304582 - https://vuldb.com/?ctiid.304582 - https://vuldb.com/?submit.524739 - https://gist.github.com/mono7s/9369a3ef060b5655303cd234ba583bb5 - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3544 State: PUBLISHED Published: 2025-04-14T00:31:07.721Z Last Updated: 2025-04-14T15:56:21.217Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getCapabilityWeb of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is require
component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304583 - https://vuldb.com/?ctiid.304583 - https://vuldb.com/?submit.524743 - https://gist.github.com/isstabber/05dfeefa3685a369b8802626e0252e27 - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3545 State: PUBLISHED Published: 2025-04-14T01:00:09.263Z Last Updated: 2025-04-14T15:55:20.861Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/setLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be approached within
ponent HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304584 - https://vuldb.com/?ctiid.304584 - https://vuldb.com/?submit.524744 - https://gist.github.com/isstabber/cc7bc3281c0f0d6659d2f9934e1c57c1 - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3546 State: PUBLISHED Published: 2025-04-14T01:31:07.222Z Last Updated: 2025-04-14T15:54:23.768Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only b
tLanguage of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304585 - https://vuldb.com/?ctiid.304585 - https://vuldb.com/?submit.524745 - https://gist.github.com/isstabber/154661f329e4ae6bfe15dcdc0b932ff3 - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3547 State: PUBLISHED Published: 2025-04-14T02:00:09.568Z Last Updated: 2025-04-14T15:37:27.259Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: frdel Products: Agent-Zero Problem Types: CWE-22 Description: A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_dir_files. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304588 - https://vuldb.com/?ctiid.304588 - https://vuldb.com/?
ISA ADP Vulnrichment: References: - https://vuldb.com/?id.304588 - https://vuldb.com/?ctiid.304588 - https://vuldb.com/?submit.546220
CVE ID: CVE-2025-3548 State: PUBLISHED Published: 2025-04-14T02:31:05.592Z Last Updated: 2025-07-23T09:02:41.158Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. I
. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304589 - https://vuldb.com/?ctiid.304589 - https://vuldb.com/?submit.546413 - https://github.com/assimp/assimp/issues/6068 - https://github.com/user-attachments/files/19580584/aiString_Set-hbo.zip - https://github.com/assimp/assimp/pull/6073
CVE ID: CVE-2025-3549 State: PUBLISHED Published: 2025-04-14T03:00:08.855Z Last Updated: 2025-07-23T09:01:29.860Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and ma
ap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304590 - https://vuldb.com/?ctiid.304590 - https://vuldb.com/?submit.546414 - https://github.com/assimp/assimp/issues/6070 - https://github.com/user-attachments/files/19580481/Assimp_MD3Importer_ValidateSurfaceHeaderOffsets-hbo.zip
CVE ID: CVE-2025-3550 State: PUBLISHED Published: 2025-04-14T03:31:04.899Z Last Updated: 2025-04-14T14:35:49.437Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wowjoy 浙江湖州华卓信息科技有限公司 Products: Internet Doctor Workstation System Problem Types: CWE-285, CWE-266 Description: A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contact
he attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304591 - https://vuldb.com/?ctiid.304591 - https://vuldb.com/?submit.547789 - https://github.com/38279/2/issues/1
CVE ID: CVE-2025-3551 State: REJECTED Published: 2025-04-14T04:31:04.486Z Last Updated: 2025-05-05T11:25:11.296Z Description: No description available.
CVE ID: CVE-2025-3552 State: REJECTED Published: 2025-04-14T05:31:04.699Z Last Updated: 2025-05-05T11:25:13.029Z Description: No description available.
CVE ID: CVE-2025-3553 State: PUBLISHED Published: 2025-04-14T06:00:15.892Z Last Updated: 2025-04-14T14:18:05.915Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: phpshe Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pe_delete of the file /admin.php?mod=brand&act=del. The manipulation of the argument brand_id[] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304594 - https://vuldb.com/?ctiid.30459
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304594 - https://vuldb.com/?ctiid.304594 - https://vuldb.com/?submit.548265 - https://www.yuque.com/baimatangseng-iyusa/qwwm81/oz331okguefvaob4?singleDoc
CVE ID: CVE-2025-3554 State: PUBLISHED Published: 2025-04-14T06:31:07.015Z Last Updated: 2025-04-14T14:11:09.920Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: phpshe Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. The manipulation of the argument act leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304595 - https://vuldb.com/?ctiid.304595 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304595 - https://vuldb.com/?ctiid.304595 - https://vuldb.com/?submit.548411 - https://www.yuque.com/baimatangseng-iyusa/qwwm81/zwhcyq1585ec8g37?singleDoc
CVE ID: CVE-2025-3555 State: PUBLISHED Published: 2025-04-14T07:00:11.153Z Last Updated: 2025-04-16T11:20:45.429Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ScriptAndTools Products: eCommerce-website-in-PHP Problem Types: CWE-307, CWE-799 Description: A vulnerability classified as problematic has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected is an unknown function of the file /login.php. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed t
The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304596 - https://vuldb.com/?ctiid.304596 - https://vuldb.com/?submit.549168 - https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30-loginphp.html - https://github.com/Maloyroyorko/E-commerce-3.0-user-bruter
CVE ID: CVE-2025-3556 State: PUBLISHED Published: 2025-04-14T07:31:05.089Z Last Updated: 2025-04-16T11:17:32.841Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ScriptAndTools Products: eCommerce-website-in-PHP Problem Types: CWE-307, CWE-799 Description: A vulnerability classified as problematic was found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has
launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304597 - https://vuldb.com/?ctiid.304597 - https://vuldb.com/?submit.549187 - https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30.html
CVE ID: CVE-2025-3557 State: PUBLISHED Published: 2025-04-14T08:00:12.085Z Last Updated: 2025-04-16T11:15:34.274Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: ScriptAndTools Products: eCommerce-website-in-PHP Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, has been found in ScriptAndTools eCommerce-website-in-PHP 3.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in
ay be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304598 - https://vuldb.com/?ctiid.304598 - https://vuldb.com/?submit.551053 - https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30_3.html - https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30_79.html
CVE ID: CVE-2025-3558 State: PUBLISHED Published: 2025-04-14T08:31:06.643Z Last Updated: 2025-04-14T12:53:01.136Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ghostxbh Products: uzy-ssm-mall Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in ghostxbh uzy-ssm-mall 1.0.0. This affects an unknown part of the file /mall/user/uploadUserHeadImage. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
nd may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304599 - https://vuldb.com/?ctiid.304599 - https://vuldb.com/?submit.549259 - https://wiki.shikangsi.com/post/share/2f5fafb5-63d3-4784-8866-5592547a71a4
CVE ID: CVE-2025-3559 State: PUBLISHED Published: 2025-04-14T09:00:17.244Z Last Updated: 2025-04-14T12:50:53.238Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ghostxbh Products: uzy-ssm-mall Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in ghostxbh uzy-ssm-mall 1.0.0 and classified as critical. This vulnerability affects the function ForeProductListController of the file /mall/product/0/20. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
ublic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304600 - https://vuldb.com/?ctiid.304600 - https://vuldb.com/?submit.549260 - https://wiki.shikangsi.com/post/share/ba8925f0-0480-4356-9b32-4543d0ea8671
CVE ID: CVE-2025-3560 State: PUBLISHED Published: 2025-04-14T09:31:07.230Z Last Updated: 2025-04-14T12:18:03.977Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ghostxbh Products: uzy-ssm-mall Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The manipulation of the argument product_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP
e vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304601 - https://vuldb.com/?ctiid.304601 - https://vuldb.com/?submit.549261 - https://wiki.shikangsi.com/post/share/3cae2847-317e-47d6-8f2a-c6fbba301d8e
CVE ID: CVE-2025-3561 State: PUBLISHED Published: 2025-04-14T10:00:10.633Z Last Updated: 2025-04-14T12:15:04.399Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: ghostxbh Products: uzy-ssm-mall Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
his disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304602 - https://vuldb.com/?ctiid.304602 - https://vuldb.com/?submit.549268 - https://wiki.shikangsi.com/post/share/4ccab5f6-4f54-4bac-b0fc-a436884432ff
CVE ID: CVE-2025-3562 State: PUBLISHED Published: 2025-04-14T10:31:06.480Z Last Updated: 2025-04-14T12:07:47.176Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Yonyou Products: YonBIP Problem Types: CWE-22 Description: A vulnerability was found in Yonyou YonBIP MA2.7. It has been declared as problematic. Affected by this vulnerability is the function FileInputStream of the file /mobsm/common/userfile. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
ublic and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304603 - https://vuldb.com/?ctiid.304603 - https://vuldb.com/?submit.549269 - https://wiki.shikangsi.com/post/share/7329f367-dd6e-48fb-b585-e10fbfc63bb2
CVE ID: CVE-2025-3563 State: PUBLISHED Published: 2025-04-14T11:00:12.175Z Last Updated: 2025-04-14T12:03:24.216Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: WuzhiCMS Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=index&_su=wuzhicms&v=set&submit=1 of the component Setting Handler. The manipulation of the argument Setting leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304604 - https://vuldb.com/?ctiid.304604 - https://vuldb.com/?submit.549270 - https://wiki.shikangsi.com/post/share/915aeba9-7d7c-4d7f-92e2-bbd5560de1a7
CVE ID: CVE-2025-3564 State: PUBLISHED Published: 2025-04-14T11:31:05.131Z Last Updated: 2025-04-14T13:23:55.873Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: huanfenz, code-projects Products: StudentManager Problem Types: CWE-285, CWE-266 Description: A vulnerability classified as problematic has been found in huanfenz/code-projects StudentManager up to 1.0. This affects an unknown part of the component Teacher String Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304605 - https://vuldb.com/?ctiid.304605 - https://vuldb.com/?submit.549309 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-authority.md