Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9387 State: PUBLISHED Published: 2025-08-24T12:02:06.813Z Last Updated: 2025-08-25T18:33:54.771Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: DCN Products: DCME-720 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in DCN DCME-720 9.1.5.11. This affects an unknown function of the file /usr/local/www/function/audit/newstatistics/ip_block.php of the component Web Management Backend. Performing manipulation of the argument ip results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Other products might be affected as well. The vendor was contacted ear
e exploit has been made public and could be used. Other products might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321220 - https://vuldb.com/?ctiid.321220 - https://vuldb.com/?submit.630727 - https://github.com/lin-3-start/lin-cve/blob/main/DCME-720/DCME-720.md - https://github.com/lin-3-start/lin-cve/blob/main/DCME-720/DCME-720.md#%E9%AA%8C%E8%AF%81
CVE ID: CVE-2025-9388 State: PUBLISHED Published: 2025-08-24T12:32:08.200Z Last Updated: 2025-08-25T18:32:41.856Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321221 - https://vuldb.com/?ctiid.321221 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321221 - https://vuldb.com/?ctiid.321221 - https://vuldb.com/?submit.630800 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9388.md - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored_XSS_endpoint_watch_list.shtm_parameter_name.md#poc
CVE ID: CVE-2025-9389 State: PUBLISHED Published: 2025-08-24T13:02:07.721Z Last Updated: 2025-08-25T18:31:29.738Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C) Vendors: n/a Products: vim Problem Types: CWE-119 Description: A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on". Additional Analyst
e this. One of the users mentions that this appears not to be working, "when coloring is turned on". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321222 - https://vuldb.com/?ctiid.321222 - https://vuldb.com/?submit.630898 - https://github.com/vim/vim/issues/17940 - https://github.com/vim/vim/issues/17940#issuecomment-3203415781 - https://drive.google.com/file/d/1iFbTpW79vqBPkFjWYzGYIh_E6esPhYVY/view?usp=sharing
CVE ID: CVE-2025-9390 State: PUBLISHED Published: 2025-08-24T14:02:09.444Z Last Updated: 2025-08-25T18:30:05.930Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: vim Problem Types: CWE-120, CWE-119 Description: A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function main of the file src/xxd/xxd.c of the component xxd. The manipulation results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and may be exploited. Upgrading to version 9.1.1616 addresses this issue. The patch is identified as eeef7c77436a78cd27047b0f5fa6925d56de3cb0
Upgrading to version 9.1.1616 addresses this issue. The patch is identified as eeef7c77436a78cd27047b0f5fa6925d56de3cb0. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321223 - https://vuldb.com/?ctiid.321223 - https://vuldb.com/?submit.630903 - https://github.com/vim/vim/issues/17944 - https://github.com/vim/vim/pull/17947 - https://drive.google.com/file/d/1JLnqrdcGsjUhbYzIEweXIGZyETjHlKtX/view?usp=sharing - https://github.com/vim/vim/commit/eeef7c77436a78cd27047b0f5fa6925d56de3cb0 - https://github.com/vim/vim/releases/tag/v9.1.1616
CVE ID: CVE-2025-9391 State: PUBLISHED Published: 2025-08-24T14:32:10.324Z Last Updated: 2025-08-25T18:27:33.818Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Bjskzy Products: Zhiyou ERP Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.artery.workflow.ServiceImpl. This manipulation of the argument sql causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
nd could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321224 - https://vuldb.com/?ctiid.321224 - https://vuldb.com/?submit.631536 - https://www.yuque.com/u49060589/ek4il4/thnillii14w421ib?singleDoc
CVE ID: CVE-2025-9392 State: PUBLISHED Published: 2025-08-24T15:02:06.506Z Last Updated: 2025-08-25T17:37:11.597Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function qosClassifier of the file /goform/qosClassifier. Such manipulation of the argument dir/sFromPort/sToPort/dFromPort/dToPort/protocol/layer7/dscp/remark_dscp leads to stack-based buffer overflow. The attack may be
Port/sToPort/dFromPort/dToPort/protocol/layer7/dscp/remark_dscp leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321225 - https://vuldb.com/?ctiid.321225 - https://vuldb.com/?submit.631537 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_32/32.md - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_32/32.md#poc - https://www.linksys.com/
CVE ID: CVE-2025-9393 State: PUBLISHED Published: 2025-08-24T15:32:06.793Z Last Updated: 2025-08-25T17:20:38.495Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaProfile of the file /goform/addStaProfile. Performing manipulation of the argument profile_name/Ssid/wep_key_1/wep_key_2/wep_key_3/wep_key_4/wep_key_length/wep_default_key/cipher/passphrase results in stack
file_name/Ssid/wep_key_1/wep_key_2/wep_key_3/wep_key_4/wep_key_length/wep_default_key/cipher/passphrase results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321226 - https://vuldb.com/?ctiid.321226 - https://vuldb.com/?submit.631538 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_33/33.md#poc - https://www.linksys.com/
CVE ID: CVE-2025-9394 State: PUBLISHED Published: 2025-08-24T16:02:07.701Z Last Updated: 2025-08-25T16:50:51.065Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: PoDoFo Problem Types: CWE-416, CWE-119 Description: A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTokenizer.cpp of the component PDF Dictionary Parser. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should
ploit has been published and may be used. This patch is called 22d16cb142f293bf956f66a4d399cdd65576d36c. A patch should be applied to remediate this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321227 - https://vuldb.com/?ctiid.321227 - https://vuldb.com/?submit.632364 - https://vuldb.com/?submit.632365 - https://github.com/podofo/podofo/issues/275 - https://drive.google.com/file/d/1edJH17GAiK9R441Gjyj8tiV_2ptoL16U/view?usp=sharing - https://github.com/podofo/podofo/commit/22d16cb142f293bf956f66a4d399cdd65576d36c
CVE ID: CVE-2025-9395 State: PUBLISHED Published: 2025-08-24T22:02:05.588Z Last Updated: 2025-08-25T16:49:34.326Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: wangsongyan Products: wblog Problem Types: CWE-918 Description: A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of the argument fileName leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
d early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321231 - https://vuldb.com/?ctiid.321231 - https://vuldb.com/?submit.632367 - https://github.com/on-theway/wblog/blob/main/README.md - https://github.com/on-theway/wblog/blob/main/README.md#vulnerability-details-and-poc
CVE ID: CVE-2025-9396 State: PUBLISHED Published: 2025-08-24T22:32:07.835Z Last Updated: 2025-08-25T16:49:00.937Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: ckolivas Products: lrzip Problem Types: CWE-476, CWE-404 Description: A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l.c. Performing manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321232 - https://v
be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321232 - https://vuldb.com/?ctiid.321232 - https://vuldb.com/?submit.632368 - https://github.com/ckolivas/lrzip/issues/264 - https://drive.google.com/file/d/1EFbiiM1d7Ozb0ucZt6zRO3ngU8ugUnCn/view?usp=sharing
CVE ID: CVE-2025-9397 State: PUBLISHED Published: 2025-08-24T23:02:06.248Z Last Updated: 2025-08-25T20:27:24.701Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: givanz Products: Vvveb Problem Types: CWE-434, CWE-284 Description: A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executing manipulation of the argument files[] can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. Applying a patch is advised to resolve this issue. The code maintainer explains, that "[he] fixed the code to remove
d. Applying a patch is advised to resolve this issue. The code maintainer explains, that "[he] fixed the code to remove this vulnerability and will make a new release". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321233 - https://vuldb.com/?ctiid.321233 - https://vuldb.com/?submit.632530 - https://github.com/August829/Yu/blob/main/20250812_2.md - https://github.com/August829/Yu/blob/main/20250812_2.md#poc
CVE ID: CVE-2025-9398 State: PUBLISHED Published: 2025-08-24T23:32:06.686Z Last Updated: 2025-08-25T20:27:57.281Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: YiFang Products: CMS Problem Types: CWE-200, CWE-284 Description: A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/base/database/Migrate.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321234 - https://vuldb.com/?ctiid.321234 - https://vuldb.com/?submit.632533 - https://github.com/August829/Yu/blob/main/20250811_5.md - https://github.com/August829/Yu/blob/main/20250811_5.md#poc
CVE ID: CVE-2025-9399 State: PUBLISHED Published: 2025-08-25T00:02:05.588Z Last Updated: 2025-08-25T20:28:32.941Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YiFang Products: CMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.php. The manipulation of the argument new_url results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
out this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321235 - https://vuldb.com/?ctiid.321235 - https://vuldb.com/?submit.632534 - https://github.com/August829/Yu/blob/main/20250811_4.md - https://github.com/August829/Yu/blob/main/20250811_4.md#poc
CVE ID: CVE-2025-9400 State: PUBLISHED Published: 2025-08-25T00:32:06.112Z Last Updated: 2025-08-25T20:29:09.150Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YiFang Products: CMS Problem Types: CWE-434, CWE-284 Description: A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: R
ntacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321236 - https://vuldb.com/?ctiid.321236 - https://vuldb.com/?submit.632535 - https://github.com/August829/Yu/blob/main/20250811_3.md - https://github.com/August829/Yu/blob/main/20250811_3.md#poc
CVE ID: CVE-2025-9401 State: PUBLISHED Published: 2025-08-25T01:02:08.708Z Last Updated: 2025-08-25T20:29:38.215Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: HuangDou Products: UTCMS Problem Types: CWE-697 Description: A vulnerability has been found in HuangDou UTCMS 9. This vulnerability affects unknown code of the file app/modules/ut-frame/admin/login.php of the component Login. Such manipulation of the argument code leads to incorrect comparison. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.
lexity. It is stated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321237 - https://vuldb.com/?ctiid.321237 - https://vuldb.com/?submit.632536 - https://github.com/August829/Yu/blob/main/20250811_2.md - https://github.com/August829/Yu/blob/main/20250811_2.md#poc
CVE ID: CVE-2025-9402 State: PUBLISHED Published: 2025-08-25T01:32:07.248Z Last Updated: 2025-08-25T20:30:20.427Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: HuangDou Products: UTCMS Problem Types: CWE-918 Description: A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Config Handler. Performing manipulation of the argument UPDATEURL results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any
has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321238 - https://vuldb.com/?ctiid.321238 - https://vuldb.com/?submit.632537 - https://github.com/August829/Yu/blob/main/20250811_1.md - https://github.com/August829/Yu/blob/main/20250811_1.md#poc
CVE ID: CVE-2025-9403 State: PUBLISHED Published: 2025-08-25T02:02:07.038Z Last Updated: 2025-08-25T16:48:14.466Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: jqlang Products: jq Problem Types: CWE-617 Description: A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321239 - htt
be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321239 - https://vuldb.com/?ctiid.321239 - https://vuldb.com/?submit.633170 - https://github.com/jqlang/jq/issues/3393 - https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing
CVE ID: CVE-2025-9404 State: PUBLISHED Published: 2025-08-25T02:32:06.446Z Last Updated: 2025-08-25T16:40:58.638Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder Handler. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321240 - https
and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321240 - https://vuldb.com/?ctiid.321240 - https://vuldb.com/?submit.633445 - https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md - https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md#poc
CVE ID: CVE-2025-9405 State: PUBLISHED Published: 2025-08-25T03:02:08.364Z Last Updated: 2025-08-31T08:08:22.918Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: Open5GS Problem Types: CWE-617 Description: A security flaw has been discovered in Open5GS up to 2.7.5. The impacted element is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The patch is identified as 8e5fed16114f2f5e40bee1b161914b592b2b7b8f. Applying a patch is advised to resolve this issue. Addi
patch is identified as 8e5fed16114f2f5e40bee1b161914b592b2b7b8f. Applying a patch is advised to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321241 - https://vuldb.com/?ctiid.321241 - https://vuldb.com/?submit.633467 - https://github.com/open5gs/open5gs/issues/3947 - https://github.com/open5gs/open5gs/issues/3947#issuecomment-3029992728 - https://github.com/user-attachments/files/21013084/amf_udm-uecm.zip - https://github.com/open5gs/open5gs/commit/8e5fed16114f2f5e40bee1b161914b592b2b7b8f - https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-9405
CVE ID: CVE-2025-9406 State: PUBLISHED Published: 2025-08-25T03:32:06.413Z Last Updated: 2025-08-25T15:31:01.987Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: xuhuisheng Products: lemon Problem Types: CWE-434, CWE-284 Description: A weakness has been identified in xuhuisheng lemon up to 1.13.0. This affects the function uploadImage of the file CmsArticleController.java of the component com.mossle.cms.web.CmsArticleController.uploadImage. This manipulation of the argument Upload causes unrestricted upload. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnri
y. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321242 - https://vuldb.com/?ctiid.321242 - https://vuldb.com/?submit.633593 - https://github.com/xuhuisheng/lemon/issues/212 - https://github.com/xuhuisheng/lemon/issues/212#issue-3317490086
CVE ID: CVE-2025-9407 State: PUBLISHED Published: 2025-08-25T10:32:11.332Z Last Updated: 2025-08-25T18:00:27.199Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: mtons Products: mblog Problem Types: CWE-79, CWE-94 Description: A flaw has been found in mtons mblog up to 3.5.0. Affected by this vulnerability is an unknown functionality of the file /settings/profile. Executing manipulation of the argument signature can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32124
might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321245 - https://vuldb.com/?ctiid.321245 - https://vuldb.com/?submit.633635 - https://gitee.com/mtons/mblog/issues/ICPML3