Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11626 State: PUBLISHED Published: 2025-10-10T22:33:26.431Z Last Updated: 2025-10-14T14:16:08.956Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-835 Description: MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2025-04.html - https://gitlab.com/wireshark/wireshark/-/issues/20724
CVE ID: CVE-2025-11627 State: PUBLISHED Published: 2025-10-30T05:28:27.216Z Last Updated: 2025-10-30T13:53:07.955Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: sminozzi Products: Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue Problem Types: CWE-117 Description: The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion. Additional Analyst Notes: - CIS
ntent into log files, and potentially cause denial of service via disk space exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50251b17-58d7-4870-b825-a194312fb3e7?source=cve - https://plugins.trac.wordpress.org/browser/site-checkup/tags/1.47/includes/catch-errors/class_bill_catch_errors.php#L80 - https://plugins.trac.wordpress.org/changeset/3380169/
CVE ID: CVE-2025-11628 State: PUBLISHED Published: 2025-10-12T05:02:05.251Z Last Updated: 2025-10-17T14:37:00.750Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: jimit105 Products: Project-Online-Shopping-Website Problem Types: CWE-89, CWE-74 Description: A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. This manipulation of the argument product_code causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling
ssible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328040 - https://vuldb.com/?ctiid.328040 - https://vuldb.com/?submit.664647 - https://github.com/mhszed/Report/blob/main/Project-Online-Shopping-Website%20exit%20sql.docx
CVE ID: CVE-2025-11629 State: PUBLISHED Published: 2025-10-12T07:02:06.148Z Last Updated: 2025-10-15T19:52:15.161Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: RainyGao Products: DocSys Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328041 - https://vuldb.com/?ctiid.328041 - https://vuldb.com/?submit.664843 - https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md
CVE ID: CVE-2025-11630 State: PUBLISHED Published: 2025-10-12T07:32:04.891Z Last Updated: 2025-10-17T14:34:15.741Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: RainyGao Products: DocSys Problem Types: CWE-22 Description: A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload. Performing manipulation of the argument path results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vu
vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328042 - https://vuldb.com/?ctiid.328042 - https://vuldb.com/?submit.664845 - https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
CVE ID: CVE-2025-11631 State: PUBLISHED Published: 2025-10-12T08:02:06.131Z Last Updated: 2025-10-17T14:33:31.032Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: RainyGao Products: DocSys Problem Types: CWE-22 Description: A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA AD
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328043 - https://vuldb.com/?ctiid.328043 - https://vuldb.com/?submit.664848 - https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md
CVE ID: CVE-2025-11632 State: PUBLISHED Published: 2025-10-29T12:31:51.107Z Last Updated: 2025-10-29T13:24:38.942Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: jgrietveld Products: Call Now Button – The #1 Click to Call Button for WordPress Problem Types: CWE-862 Description: The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate links to billing portal, where they can view and mo
cated attackers, with Subscriber-level access and above, to generate links to billing portal, where they can view and modify billing information of the connected, account, generate chat session tokens, view domain status, etc. This vulnerability was partially fixed in version 1.5.4 and fully fixed in version 1.5.5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/379547a2-6b22-4ec9-8570-a043dda7ec09?source=cve - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/CnbAdminAjax.php#L147 - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/chat/class-cnb-chat-control
x.php#L147 - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/chat/class-cnb-chat-controller.php#L52 - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/CnbAdminAjax.php#L50 - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/CnbAdminAjax.php#L21 - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/CnbAdminAjax.php#L154 - https://plugins.trac.wordpress.org/browser/call-now-button/tags/1.5.3/src/admin/CnbAdminAjax.php#L167
CVE ID: CVE-2025-11633 State: PUBLISHED Published: 2025-10-12T12:02:05.240Z Last Updated: 2025-10-16T18:10:00.626Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-295, CWE-287 Description: A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the component HTTP Traffic Handler. The manipulation leads to improper certificate validation. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The firmware versions det
. The attack is considered to have high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328044 - https://vuldb.com/?ctiid.328044 - https://vuldb.com/?submit.661352
CVE ID: CVE-2025-11634 State: PUBLISHED Published: 2025-10-12T12:32:04.763Z Last Updated: 2025-10-16T17:39:41.035Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-200, CWE-284 Description: A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results in information disclosure. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC002
exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328045 - https://vuldb.com/?ctiid.328045 - https://vuldb.com/?submit.661353
CVE ID: CVE-2025-11635 State: PUBLISHED Published: 2025-10-12T14:02:05.607Z Last Updated: 2025-10-16T05:39:24.123Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360 Problem Types: CWE-400, CWE-404 Description: A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328046
d not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328046 - https://vuldb.com/?ctiid.328046 - https://vuldb.com/?submit.661354
CVE ID: CVE-2025-11636 State: PUBLISHED Published: 2025-10-12T15:02:04.833Z Last Updated: 2025-10-16T05:39:37.432Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360 Problem Types: CWE-918 Description: A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in
he exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328047 - https://vuldb.com/?ctiid.328047 - https://vuldb.com/?submit.661361
CVE ID: CVE-2025-11637 State: PUBLISHED Published: 2025-10-12T16:32:06.156Z Last Updated: 2025-10-16T05:39:49.182Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360 Problem Types: CWE-362 Description: A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation results in race condition. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328048 - https:/
pond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328048 - https://vuldb.com/?ctiid.328048 - https://vuldb.com/?submit.661362
CVE ID: CVE-2025-11638 State: PUBLISHED Published: 2025-10-12T17:02:05.311Z Last Updated: 2025-10-16T05:40:00.415Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-404 Description: A flaw has been found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Bluetooth Handler. Executing manipulation can lead to denial of service. The attacker needs to be present on the local network. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this discl
ed are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328049 - https://vuldb.com/?ctiid.328049 - https://vuldb.com/?submit.661363
CVE ID: CVE-2025-11639 State: PUBLISHED Published: 2025-10-12T17:32:04.778Z Last Updated: 2025-10-17T05:48:48.193Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-922, CWE-200 Description: A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component Debug Log S3 Bucket Handler. The manipulation leads to insecure storage of sensitive information. An attack has to be approached locally. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW
ocally. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328050 - https://vuldb.com/?ctiid.328050 - https://vuldb.com/?submit.661364 - https://vuldb.com/?submit.661876
CVE ID: CVE-2025-11640 State: PUBLISHED Published: 2025-10-12T18:02:05.077Z Last Updated: 2025-10-17T05:48:59.300Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-319, CWE-310 Description: A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected ar
ture are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328051 - https://vuldb.com/?ctiid.328051 - https://vuldb.com/?submit.661374
CVE ID: CVE-2025-11641 State: PUBLISHED Published: 2025-10-12T18:32:05.050Z Last Updated: 2025-10-17T05:49:10.328Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-284, CWE-266 Description: A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furb
ve high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328052 - https://vuldb.com/?ctiid.328052 - https://vuldb.com/?submit.661379
CVE ID: CVE-2025-11642 State: PUBLISHED Published: 2025-10-12T19:02:05.229Z Last Updated: 2025-10-18T07:12:29.564Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-404 Description: A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_
e exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328053 - https://vuldb.com/?ctiid.328053 - https://vuldb.com/?submit.661380
CVE ID: CVE-2025-11643 State: PUBLISHED Published: 2025-10-12T19:32:05.829Z Last Updated: 2025-10-18T07:12:43.081Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:X) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-798, CWE-259 Description: A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/furbo_img of the component MQTT Client Certificate. Performing manipulation results in hard-coded credentials. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The firmware ve
initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328054 - https://vuldb.com/?ctiid.328054 - https://vuldb.com/?submit.661875
CVE ID: CVE-2025-11644 State: PUBLISHED Published: 2025-10-12T20:02:05.648Z Last Updated: 2025-10-18T07:12:53.041Z Severity: LOW (CVSS 2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-922, CWE-200 Description: A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined
attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328055 - https://vuldb.com/?ctiid.328055 - https://vuldb.com/?submit.661878 - https://vuldb.com/?submit.661879 - https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXXX.md - https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Stor
itve%20Information%20-%20CVE-2025-XXXXX.md - https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXX.md
CVE ID: CVE-2025-11645 State: PUBLISHED Published: 2025-10-12T20:32:05.707Z Last Updated: 2025-10-18T21:27:53.120Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tomofun Products: Furbo Mobile App Problem Types: CWE-922, CWE-200 Description: A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure
l device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328056 - https://vuldb.com/?ctiid.328056 - https://vuldb.com/?submit.661899 - https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md
CVE ID: CVE-2025-11646 State: PUBLISHED Published: 2025-10-12T21:02:05.171Z Last Updated: 2025-10-18T21:28:04.687Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-284, CWE-266 Description: A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation results in improper access controls. The attack can only be performed from the local network. The exploit is now public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_
used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328057 - https://vuldb.com/?ctiid.328057 - https://vuldb.com/?submit.661900 - https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Information-Disclosure-P2PUUID.md
CVE ID: CVE-2025-11647 State: PUBLISHED Published: 2025-10-12T21:32:06.210Z Last Updated: 2025-10-18T21:28:13.642Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tomofun Products: Furbo 360, Furbo Mini Problem Types: CWE-200, CWE-284 Description: A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the argument DeviceToken causes information disclosure. The attack is only possible within the local network. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The firmware versions determined to be affec