Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6811 State: PUBLISHED Published: 2025-07-07T14:52:02.981Z Last Updated: 2025-07-07T15:01:42.611Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mescius Products: ActiveReports.NET Problem Types: CWE-502 Description: Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the TypeResolutionSer
ility but attack vectors may vary depending on the implementation. The specific flaw exists within the TypeResolutionService class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25397. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-449/
CVE ID: CVE-2025-6813 State: PUBLISHED Published: 2025-07-18T04:23:00.831Z Last Updated: 2025-07-18T13:47:18.545Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aapanel Products: aapanel WP Toolkit Problem Types: CWE-862 Description: The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vuln
privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/430a0b93-2cb7-45bf-86ac-4a8b3a0be77a?source=cve - https://wordpress.org/plugins/aapanel-wp-toolkit/#developers - https://plugins.trac.wordpress.org/browser/aapanel-wp-toolkit/tags/1.1/includes/class-aapanel-wp-toolkit-agent.php#L74
CVE ID: CVE-2025-6814 State: PUBLISHED Published: 2025-07-04T01:44:04.204Z Last Updated: 2025-07-08T14:21:21.771Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dunskii Products: Booking X – Appointment and Reservation Availability Calendar Problem Types: CWE-862 Description: The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal credentials, by issuing a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnric
unts, user meta, and PayPal credentials, by issuing a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a30d572-e086-4b83-8cb7-4cef9a3253bd?source=cve - https://wordpress.org/plugins/booking-x/#developers - https://plugins.trac.wordpress.org/browser/booking-x/tags/1.1.2/admin/class-bookingx-admin.php#L784 - https://plugins.trac.wordpress.org/browser/booking-x/tags/1.1.2/includes/class-bookingx.php#L322
CVE ID: CVE-2025-6815 State: PUBLISHED Published: 2025-09-30T04:27:06.415Z Last Updated: 2025-09-30T15:39:14.032Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: latepoint Products: LatePoint – Calendar Booking Plugin for Appointments and Events Problem Types: CWE-79 Description: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘service[name]’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scr
caping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28e9c77c-5c36-4449-ab90-86f2385ba1ae?source=cve - https://wordpress.org/plugins/latepoint/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3366851%40latepoint&new=3366851%40latepoint&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6816 State: PUBLISHED Published: 2025-06-28T08:00:18.877Z Last Updated: 2025-06-30T16:07:24.252Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /src/H5Ofsinfo.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314254 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314254 - https://vuldb.com/?ctiid.314254 - https://vuldb.com/?submit.602291 - https://github.com/HDFGroup/hdf5/issues/5571 - https://github.com/user-attachments/files/20623354/hdf5_crash_3.txt
CVE ID: CVE-2025-6817 State: PUBLISHED Published: 2025-06-28T11:31:05.770Z Last Updated: 2025-06-30T16:06:39.966Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-400, CWE-404 Description: A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5C__load_entry of the file /src/H5Centry.c. The manipulation leads to resource consumption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314255 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314255 - https://vuldb.com/?ctiid.314255 - https://vuldb.com/?submit.602294 - https://github.com/HDFGroup/hdf5/issues/5572 - https://github.com/user-attachments/files/20623368/hdf5_crash_4.txt
CVE ID: CVE-2025-6818 State: PUBLISHED Published: 2025-06-28T15:31:06.437Z Last Updated: 2025-06-30T16:05:49.951Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5O__chunk_protect of the file /src/H5Ochunk.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314256 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314256 - https://vuldb.com/?ctiid.314256 - https://vuldb.com/?submit.602326 - https://github.com/HDFGroup/hdf5/issues/5573 - https://github.com/user-attachments/files/20623382/hdf5_crash_5.txt
CVE ID: CVE-2025-6819 State: PUBLISHED Published: 2025-06-28T16:31:05.642Z Last Updated: 2025-06-30T20:18:37.551Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/removeBrand.php. The manipulation of the argument brandId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul
aunched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314257 - https://vuldb.com/?ctiid.314257 - https://vuldb.com/?submit.602609 - https://github.com/AlbaDove/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6820 State: PUBLISHED Published: 2025-06-28T17:31:05.378Z Last Updated: 2025-06-30T20:17:59.647Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /php_action/createProduct.php. The manipulation of the argument productName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
ed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314258 - https://vuldb.com/?ctiid.314258 - https://vuldb.com/?submit.602617 - https://github.com/AlbaDove/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-6821 State: PUBLISHED Published: 2025-06-28T18:00:13.459Z Last Updated: 2025-06-30T20:17:03.677Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/createOrder.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314259 - https://vuldb.com/?ctiid.314259 - https://vuldb.com/?submit.602640 - https://github.com/Dav1d-safe/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-6822 State: PUBLISHED Published: 2025-06-28T18:31:05.801Z Last Updated: 2025-06-30T16:00:21.697Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/removeProduct.php. The manipulation of the argument productId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314260 - https://vuldb.com/?ctiid.314260 - https://vuldb.com/?submit.602641 - https://github.com/Dav1d-safe/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6823 State: PUBLISHED Published: 2025-06-28T19:31:06.419Z Last Updated: 2025-06-30T15:58:47.762Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/editProduct.php. The manipulation of the argument editProductName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314261 - https://vuldb.com/?ctiid.314261 - https://vuldb.com/?submit.602642 - https://github.com/Dav1d-safe/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6824 State: PUBLISHED Published: 2025-06-28T20:00:17.046Z Last Updated: 2025-06-30T15:57:14.695Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: X15 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in TOTOLINK X15 up to 1.0.0-B20230714.1105. Affected is an unknown function of the file /boafrm/formParentControl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314262 - https://vuldb.com/?ctiid.314262 - https://vuldb.com/?submit.602643 - https://github.com/awindog/cve/blob/main/688/28.md - https://github.com/awindog/cve/blob/main/688/28.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6825 State: PUBLISHED Published: 2025-06-28T20:31:07.693Z Last Updated: 2025-06-30T15:55:59.251Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in TOTOLINK A702R up to 4.0.0-B20230721.1521. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWlSiteSurvey of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314263 - https://vuldb.com/?ctiid.314263 - https://vuldb.com/?submit.602655 - https://github.com/awindog/cve/blob/main/688/29.md - https://github.com/awindog/cve/blob/main/688/29.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-6826 State: PUBLISHED Published: 2025-06-28T21:00:18.376Z Last Updated: 2025-06-30T15:55:04.688Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Payroll Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /Payroll_Management_System/ajax.php?action=save_department. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analy
ion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314264 - https://vuldb.com/?ctiid.314264 - https://vuldb.com/?submit.602674 - https://github.com/Cashbeebee/CVE/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6827 State: PUBLISHED Published: 2025-06-28T22:00:16.543Z Last Updated: 2025-06-30T16:18:08.713Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/editOrder.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314265 - https://vuldb.com/?ctiid.314265 - https://vuldb.com/?submit.602999 - https://github.com/YunQipao/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-6828 State: PUBLISHED Published: 2025-06-28T22:31:05.926Z Last Updated: 2025-06-30T16:16:25.929Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314266 - https://vuldb.com/?ctiid.314266 - https://vuldb.com/?submit.603000 - https://github.com/YunQipao/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6829 State: PUBLISHED Published: 2025-06-28T23:00:12.800Z Last Updated: 2025-06-30T16:13:57.657Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR) Vendors: aaluoxiang Products: oa_system Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst No
ot use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314267 - https://vuldb.com/?ctiid.314267 - https://vuldb.com/?submit.603033 - https://github.com/chujianxin0101/vuln/issues/5
CVE ID: CVE-2025-6831 State: PUBLISHED Published: 2025-07-22T01:44:28.244Z Last Updated: 2025-07-22T20:02:07.250Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpeverest Products: User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin Problem Types: CWE-79 Description: The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke
ent input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50f3e469-f788-45da-95e7-aa6da1e87fd1?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.2.4/modules/content-restriction/class-urcr-shortcodes.php - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.2.4/modules/content-restriction/class-urcr-shortcodes.php#L147 -
ins.trac.wordpress.org/browser/user-registration/tags/4.2.4/modules/content-restriction/class-urcr-shortcodes.php#L147 - https://wordpress.org/plugins/user-registration/#developers - https://plugins.trac.wordpress.org/changeset/3329704/
CVE ID: CVE-2025-6832 State: PUBLISHED Published: 2025-08-02T08:24:47.167Z Last Updated: 2025-08-04T13:43:11.470Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codebangers Products: All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Problem Types: CWE-79 Description: The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that
and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/844b7471-3adf-45fd-9906-f0c817d6565c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6833 State: PUBLISHED Published: 2025-10-22T09:24:37.989Z Last Updated: 2025-10-22T13:35:53.370Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: codebangers Products: All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Problem Types: CWE-639 Description: The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above
alidation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above, to clock other users in and out. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c48173-ffe3-40f8-a2fa-cee66869e343?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6834 State: PUBLISHED Published: 2025-06-28T23:31:05.813Z Last Updated: 2025-06-30T16:09:33.331Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/editPayment.php. The manipulation of the argument orderId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314278 - https://vuldb.com/?ctiid.314278 - https://vuldb.com/?submit.603127 - https://vuldb.com/?submit.603855 - https://github.com/xiaoqitc/cve-/issues/5 - https://code-projects.org/