Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-34059 State: PUBLISHED Published: 2025-07-01T14:48:51.722Z Last Updated: 2025-11-20T18:34:32.177Z Vendors: Zhejiang Dahua Technology Co., Ltd. Products: Smart Cloud Gateway Registration Management Platform Problem Types: CWE-89, CWE-200 Description: An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. Add
disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2024-38747 - https://www.cnblogs.com/LeouMaster/p/18509644 - https://www.dahuatech.com/ - https://pentest-tools.com/vulnerabilities-exploits/zhejiang-dahua-smart-cloud-gateway-registration-platform-sql-injection-cnvd-2024-38747_23762 - https://vulncheck.com/advisories/dahua-smart-cloud-gateway-sql-injection
CVE ID: CVE-2025-34060 State: PUBLISHED Published: 2025-07-01T14:49:02.069Z Last Updated: 2025-07-01T18:41:44.536Z Vendors: Monero Project Products: Forum Problem Types: CWE-502, CWE-829, CWE-20 Description: A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from con
d spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://swap.gs/posts/monero-forums/ - https://vulncheck.com/advisories/monero-forum-rce
CVE ID: CVE-2025-34061 State: PUBLISHED Published: 2025-07-03T19:46:03.207Z Last Updated: 2025-07-07T19:01:51.371Z Vendors: Henan Xiaopi Security Technology Co., Ltd. Products: PHPStudy Problem Types: CWE-94 Description: A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of incoming requests, decodes and executes the payload without proper validation. This leads to remote code execution as the web server user, compromising the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
web server user, compromising the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/phpstudy_backdoor_rce.rb - https://www.xp.cn/phpstudy
CVE ID: CVE-2025-34062 State: PUBLISHED Published: 2025-07-01T14:49:20.131Z Last Updated: 2025-07-01T15:35:09.487Z Vendors: One Identity Products: OneLogin Active Directory Connector (ADC) Problem Types: CWE-200, CWE-522 Description: An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directory_token—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext response disclosing sensitive credentials. These may include an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP con
nclude an API key, AWS IAM access and secret keys, and a base64-encoded JWT signing key used in the tenant’s SSO IdP configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.onelogin.com/product-notification/noti-00001768 - https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/ - https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise
CVE ID: CVE-2025-34063 State: PUBLISHED Published: 2025-07-01T14:49:25.544Z Last Updated: 2025-07-01T15:17:11.538Z Vendors: One Identity Products: OneLogin Active Directory Connector (ADC) Problem Types: CWE-290 Description: A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized a
n to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.onelogin.com/product-notification/noti-00001768 - https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/ - https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise
CVE ID: CVE-2025-34064 State: PUBLISHED Published: 2025-07-01T14:49:34.048Z Last Updated: 2025-07-01T15:12:31.755Z Vendors: One Identity Products: OneLogin Active Directory Connector (ADC) Problem Types: CWE-668, CWE-200 Description: A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially al
ctory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.onelogin.com/product-notification/noti-00001768 - https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys/ - https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise
CVE ID: CVE-2025-34065 State: PUBLISHED Published: 2025-07-01T14:47:23.621Z Last Updated: 2025-07-01T18:36:04.496Z Vendors: AVTECH Products: IP camera, DVR, and NVR Devices Problem Types: CWE-290 Description: An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/40500 - https://avtech.com/ - https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities -
://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities - https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH - https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns
CVE ID: CVE-2025-34066 State: PUBLISHED Published: 2025-07-01T14:47:44.573Z Last Updated: 2025-07-01T18:37:36.761Z Vendors: AVTECH Products: IP cameras, DVR devices, NVR devices Problem Types: CWE-295 Description: An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/40500 - https://avtech.com/ - https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-A
oits/40500 - https://avtech.com/ - https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities - https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH - https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns
CVE ID: CVE-2025-34067 State: PUBLISHED Published: 2025-07-02T13:44:21.664Z Last Updated: 2025-11-20T18:33:11.267Z Vendors: Hikvision Products: Integrated Security Management Platform Problem Types: CWE-502 Description: An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on th
rary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HIKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20applyCT%20Fastjson%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md - https://s4e.io/tools/hikvision-applyct-remote-code-execution - https://vulncheck.com/advisories/hikvision-ismp-rce-applyct
CVE ID: CVE-2025-34068 State: PUBLISHED Published: 2025-07-15T13:09:12.311Z Last Updated: 2025-11-20T18:31:39.938Z Vendors: Samsung Electronics Products: WLAN AP WEA453e Problem Types: CWE-306 Description: An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET parameters accept arbitrary shell commands that are executed with root privileges on the underlying operating system. An attacker can exploit this by crafting a request that injects shell commands to create output files in writable directories and the
an exploit this by crafting a request that injects shell commands to create output files in writable directories and then access their contents via the download endpoint. This flaw allows complete compromise of the device without authentication. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-04 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://omriinbar.medium.com/samsung-wlan-ap-wea453e-vulnerabilities-7aa4a57d4dba - https://fortiguard.fortinet.com/encyclopedia/ips/57323 - https://www.samsung.com/us/business/support/owners/product/400-series-wea453/ - https://s4e.io/tools/samsung-wlan-ap-remote-code-execution - https://www.vulncheck.
/owners/product/400-series-wea453/ - https://s4e.io/tools/samsung-wlan-ap-remote-code-execution - https://www.vulncheck.com/advisories/samsung-wlan-ap-wea453e-unauthenticated-rce
CVE ID: CVE-2025-34069 State: PUBLISHED Published: 2025-07-02T13:44:41.778Z Last Updated: 2025-11-19T14:36:47.656Z Vendors: GFI Software Products: Kerio Control Problem Types: CWE-306 Description: An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and weak access control in the GFIAgent service. The non-transparent proxy on TCP port 3128 can be used to forward unauthenticated requests to internal services such as GFIAgent, bypassing firewall restrictions and exposing internal management endpoints. This enables unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issu
s unauthenticated attackers to access the GFIAgent service on ports 7995 and 7996, retrieve the appliance UUID, and issue administrative requests via the proxy. Exploitation results in full administrative access to the Kerio Control appliance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/ - https://vulncheck.com/advisories/gfi-kerio-control-auth-bypass-rce
CVE ID: CVE-2025-34070 State: PUBLISHED Published: 2025-07-02T13:44:54.945Z Last Updated: 2025-11-19T14:36:47.836Z Vendors: GFI Software Products: Kerio Control Problem Types: CWE-306 Description: A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remote attackers to perform privileged operations. The GFIAgent service, responsible for integration with GFI AppManager, exposes HTTP services on ports 7995 and 7996 without proper authentication. The /proxy handler on port 7996 allows arbitrary forwarding to administrative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a
trative endpoints when provided with an Appliance UUID, which itself can be retrieved from port 7995. This results in a complete authentication bypass, permitting access to sensitive administrative APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/ - https://vulncheck.com/advisories/gfi-kerio-control-auth-bypass-rce
CVE ID: CVE-2025-34071 State: PUBLISHED Published: 2025-07-02T13:45:11.305Z Last Updated: 2025-11-19T14:36:48.159Z Vendors: GFI Software Products: Kerio Control Problem Types: CWE-306 Description: A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload and execute arbitrary code through the firmware upgrade feature. The system upgrade mechanism accepts unsigned .img files, which can be modified to include malicious scripts within the upgrade.sh or disk image components. These modified upgrade images are not validated for authenticity or integrity, and are executed by the system post-upload, enabling root access. Additional Analys
dated for authenticity or integrity, and are executed by the system post-upload, enabling root access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ssd-disclosure.com/ssd-advisory-kerio-control-authentication-bypass-and-rce/ - https://vulncheck.com/advisories/gfi-kerio-control-auth-bypass-rce
CVE ID: CVE-2025-34072 State: PUBLISHED Published: 2025-07-02T13:46:31.554Z Last Updated: 2025-07-02T20:29:17.261Z Vendors: Anthropic Products: Slack MCP Server Problem Types: CWE-200, CWE-20 Description: A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embedding sensitive data. Slack’s link preview bots (e.g., Slack-LinkExpanding, Slackbot, Slack-ImgProxy) will then issue outbound requests to the attacker-controlled URL, resulting in zero-click exfiltra
kbot, Slack-ImgProxy) will then issue outbound requests to the attacker-controlled URL, resulting in zero-click exfiltration of private data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://embracethered.com/blog/posts/2025/security-advisory-anthropic-slack-mcp-server-data-leakage/ - https://vulncheck.com/advisories/anthropic-slack-mcp-server-data-exfiltration
CVE ID: CVE-2025-34073 State: PUBLISHED Published: 2025-07-02T13:46:59.778Z Last Updated: 2025-07-02T20:30:06.806Z Vendors: Stamparm Products: Maltrail Problem Types: CWE-78, CWE-306 Description: An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of user-supplied input passed to subprocess.check_output() in core/http.py, allowing injection of shell metacharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail
acharacters. Exploitation does not require authentication and commands are executed with the privileges of the Maltrail process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb - https://huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87 - https://github.com/stamparm/maltrail - https://github.com/stamparm/maltrail/issues/19146 - https://vulncheck.com/advisories/stamparm-maltrail-rce
CVE ID: CVE-2025-34074 State: PUBLISHED Published: 2025-07-02T19:26:31.382Z Last Updated: 2025-07-03T13:17:11.697Z Vendors: Lucee Association Switzerland Products: Lucee Problem Types: CWE-94, CWE-829 Description: An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or executio
privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution. This issue is distinct from CVE-2024-55354. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/lucee_scheduled_job.rb - https://github.com/lucee/Lucee - https://vulncheck.com/advisories/lucee-admin-interface-rce
CVE ID: CVE-2025-34075 State: REJECTED Published: 2025-07-02T19:26:01.774Z Last Updated: 2025-07-16T13:23:44.080Z Description: No description available.
CVE ID: CVE-2025-34076 State: PUBLISHED Published: 2025-07-02T19:27:03.935Z Last Updated: 2025-07-03T13:14:33.315Z Vendors: Microweber Ltd. Products: CMS Problem Types: CWE-22 Description: An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then
e or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/microweber_lfi.rb - https://github.com/microweber/microweber - https://huntr.com/bounties/09218d3f-1f6a-48ae-981c-85e86ad5ed8b - https://github.com/microweber/microweber/commit/98d025467128ecc24195dcb56c5
nties/09218d3f-1f6a-48ae-981c-85e86ad5ed8b - https://github.com/microweber/microweber/commit/98d025467128ecc24195dcb56c533febc3c91af6 - https://github.com/microweber/microweber/commit/572bdc36b5b47923790016f6b961c8df53226855 - https://vulncheck.com/advisories/microweber-cms-lfi
CVE ID: CVE-2025-34077 State: PUBLISHED Published: 2025-07-09T00:49:28.535Z Last Updated: 2025-11-21T19:27:11.616Z Vendors: Genetech Solutions Products: WordPress Pie Register Plugin Problem Types: CWE-434, CWE-306, CWE-94 Description: An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload fu
session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_pie_register_bypass_rce.rb - https://www.exploit-db.com/exploits/50395 - https://pieregister.com/ - https://github.com/GTSolutions/Pie-Register - https://wordpress.org/plugins/pie-register/ - https://vulncheck.com/advisories/wordpress-pie-register-plugin-rce
CVE ID: CVE-2025-34078 State: PUBLISHED Published: 2025-07-02T19:27:26.073Z Last Updated: 2025-07-02T20:32:01.677Z Vendors: NSClient++ Products: NSClient++ Problem Types: CWE-312, CWE-269 Description: A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users. By extracting this password, an attacker can authenticate to the NSClient++ web interface (typically accessible on port 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom
t 8443) and abuse the ExternalScripts plugin to inject and execute arbitrary commands as SYSTEM by registering a custom script, saving the configuration, and triggering it via the API. This behavior is documented but insecure, as the plaintext credential exposure undermines access isolation between local users and administrative functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/nscp_pe.rb - https://www.exploit-db.com/exploits/48360 - https://www.exploit-db.com/exploits/46802 - https://vulncheck.com/advisories/nsclient-localtoremote-system-compromise
CVE ID: CVE-2025-34079 State: PUBLISHED Published: 2025-07-02T19:27:41.046Z Last Updated: 2025-07-02T19:42:36.021Z Vendors: NSClient++ Products: NSClient++ Problem Types: CWE-94, CWE-306 Description: An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface (default port 8443), inject arbitrary commands as external scripts via the /settings/query.json API, save the configuration, and trigger the script via the /query/{name} endpoint. The injected commands are executed with SYSTEM privileges, enabling full remot