Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8153 State: PUBLISHED Published: 2025-09-17T02:10:09.645Z Last Updated: 2025-09-17T13:45:14.075Z Vendors: NEC Corporation Products: UNIVERGE IX, UNIVERGE IX-R/IX-V Problem Types: CWE-79 Description: Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv25-005_en.html
CVE ID: CVE-2025-8155 State: PUBLISHED Published: 2025-07-25T12:02:05.610Z Last Updated: 2025-07-25T13:24:58.268Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DCS-6010L Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in D-Link DCS-6010L 1.15.03 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vb.htm of the component Management Application. The manipulation of the argument paratest leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no long
The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317569 - https://vuldb.com/?ctiid.317569 - https://vuldb.com/?submit.620531 - https://www.dlink.com/
CVE ID: CVE-2025-8156 State: PUBLISHED Published: 2025-07-25T12:32:07.190Z Last Updated: 2025-07-25T13:03:12.943Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: User Registration & Login and User Management Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul User Registration & Login and User Management 3.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/lastsevendays-reg-users.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst
. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317570 - https://vuldb.com/?ctiid.317570 - https://vuldb.com/?submit.620586 - https://github.com/secfake/mycve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-8157 State: PUBLISHED Published: 2025-07-25T13:02:06.531Z Last Updated: 2025-07-25T13:24:24.419Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: User Registration & Login and User Management Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul User Registration & Login and User Management 3.3. It has been classified as critical. This affects an unknown part of the file /admin/lastthirtyays-reg-users.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Note
e to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317571 - https://vuldb.com/?ctiid.317571 - https://vuldb.com/?submit.620597 - https://github.com/secfake/mycve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-8158 State: PUBLISHED Published: 2025-07-25T13:32:06.411Z Last Updated: 2025-07-25T13:52:12.866Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Login and User Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Login and User Management System 3.3. It has been declared as critical. This vulnerability affects unknown code of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317572 - https://vuldb.com/?ctiid.317572 - https://vuldb.com/?submit.620608 - https://github.com/secfake/mycve/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-8159 State: PUBLISHED Published: 2025-07-25T14:32:05.932Z Last Updated: 2025-07-25T14:58:49.191Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-513 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. This issue affects the function formLanguageChange of the file /goform/formLanguageChange of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that
d remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317573 - https://vuldb.com/?ctiid.317573 - https://vuldb.com/?submit.620604 - https://github.com/boyslikesports/vul/blob/main/formLanguageChange.md - https://www.dlink.com/
CVE ID: CVE-2025-8160 State: PUBLISHED Published: 2025-07-25T15:02:07.280Z Last Updated: 2025-07-25T15:11:10.192Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/SetSysTimeCfg of the component httpd. The manipulation of the argument timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317574 - https://vuldb.com/?ctiid.317574 - https://vuldb.com/?submit.620625 - https://github.com/CH13hh/cve/blob/main/tenda1.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-8161 State: PUBLISHED Published: 2025-07-25T16:32:12.969Z Last Updated: 2025-07-25T17:39:38.091Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. Affected by this vulnerability is an unknown functionality of the file /system/role/export. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317575 - https://vuldb.com/?ctiid.317575 - https://vuldb.com/?submit.619696 - https://gitee.com/deerwms/deer-wms-2/issues/ICLQQG
CVE ID: CVE-2025-8162 State: PUBLISHED Published: 2025-07-25T17:02:11.195Z Last Updated: 2025-07-25T17:38:46.517Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the file /system/dept/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317576 - https://vuldb.com/?ctiid.317576 - https://vuldb.com/?submit.619697 - https://gitee.com/deerwms/deer-wms-2/issues/ICLQKV
CVE ID: CVE-2025-8163 State: PUBLISHED Published: 2025-07-25T17:32:09.793Z Last Updated: 2025-07-25T17:56:43.329Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/role/list. The manipulation of the argument params[dataScope] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317577 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317577 - https://vuldb.com/?ctiid.317577 - https://vuldb.com/?submit.619729 - https://gitee.com/deerwms/deer-wms-2/issues/ICLQFL
CVE ID: CVE-2025-8164 State: PUBLISHED Published: 2025-07-25T18:02:06.168Z Last Updated: 2025-07-25T18:24:17.352Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Public Chat Room Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Public Chat Room 1.0 and classified as critical. This vulnerability affects unknown code of the file send_message.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317578 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317578 - https://vuldb.com/?ctiid.317578 - https://vuldb.com/?submit.620628 - https://github.com/kbhjt/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-8165 State: PUBLISHED Published: 2025-07-25T18:32:05.931Z Last Updated: 2025-07-25T18:52:51.894Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Food Review System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Food Review System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/approve_reservation.php. The manipulation of the argument occasion leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317579 - https://vuldb.com/?ctiid.317579 - https://vuldb.com/?submit.620631 - https://github.com/ljfhhh/cve2/blob/main/cve-sql.pdf - https://code-projects.org/
CVE ID: CVE-2025-8166 State: PUBLISHED Published: 2025-07-25T19:02:05.109Z Last Updated: 2025-07-25T20:35:15.499Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/index.php of the component HTTP POST Request Handler. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CIS
aunch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317580 - https://vuldb.com/?ctiid.317580 - https://vuldb.com/?submit.620736 - https://github.com/enigma522/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8167 State: PUBLISHED Published: 2025-07-25T19:32:05.138Z Last Updated: 2025-07-25T19:58:39.013Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_members.php. The manipulation of the argument fname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Ad
d remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317581 - https://vuldb.com/?ctiid.317581 - https://vuldb.com/?submit.620742 - https://github.com/enigma522/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8168 State: PUBLISHED Published: 2025-07-25T20:02:06.070Z Last Updated: 2025-07-25T20:35:47.282Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-513 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in D-Link DIR-513 1.10. It has been rated as critical. Affected by this issue is the function websAspInit of the file /goform/formSetWanPPPoE. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Anal
nd may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317582 - https://vuldb.com/?ctiid.317582 - https://vuldb.com/?submit.620816 - https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetWanL2TP.md - https://www.dlink.com/
CVE ID: CVE-2025-8169 State: PUBLISHED Published: 2025-07-25T20:32:05.096Z Last Updated: 2025-07-28T14:48:09.802Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-513 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no
tely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317583 - https://vuldb.com/?ctiid.317583 - https://vuldb.com/?submit.620817 - https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetWanPPPoE.md - https://www.dlink.com/
CVE ID: CVE-2025-8170 State: PUBLISHED Published: 2025-07-25T21:02:07.203Z Last Updated: 2025-07-28T14:53:25.227Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317584 - https://vuldb.com/?ctiid.317584 - https://vuldb.com/?submit.620834 - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/9.md - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/9.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-8171 State: PUBLISHED Published: 2025-07-25T21:32:05.681Z Last Updated: 2025-07-28T14:54:41.035Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Document Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing of the file /insert.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317585 - https://vuldb.com/?ctiid.317585 - https://vuldb.com/?submit.621411 - https://github.com/XiaoJiesecqwq/CVE/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-8172 State: PUBLISHED Published: 2025-07-25T22:02:06.964Z Last Updated: 2025-07-28T14:58:00.654Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Employee Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317586 - https://vuldb.com/?ctiid.317586 - https://vuldb.com/?submit.621482 - https://github.com/XiaoJiesecqwq/CVE/issues/5 - https://itsourcecode.com/
CVE ID: CVE-2025-8173 State: PUBLISHED Published: 2025-07-25T23:02:06.232Z Last Updated: 2025-07-28T14:59:16.136Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: 1000 Projects Products: ABC Courier Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in 1000 Projects ABC Courier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /Add_reciver.php. The manipulation of the argument reciver_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317587 - https://vuldb.com/?ctiid.317587 - https://vuldb.com/?submit.621508 - https://github.com/Pick-program/CVE/issues/2 - https://1000projects.org/
CVE ID: CVE-2025-8174 State: PUBLISHED Published: 2025-07-26T01:04:37.269Z Last Updated: 2025-07-28T16:00:22.807Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Voting System Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/candidates_add.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317588 - https://vuldb.com/?ctiid.317588 - https://vuldb.com/?submit.621586 - https://github.com/i-Corner/cve/issues/11 - https://code-projects.org/
CVE ID: CVE-2025-8175 State: PUBLISHED Published: 2025-07-26T03:02:05.219Z Last Updated: 2025-07-28T15:59:02.067Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DI-8400 Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in D-Link DI-8400 16.07.26A1. It has been classified as problematic. This affects an unknown part of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument share_enable leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317589 - https://vuldb.com/?ctiid.317589 - https://vuldb.com/?submit.621708 - https://github.com/Kriswu1337/CVE/blob/main/DI_8400%20Null%20pointer%20dereference%20vulnerability.md - https://www.dlink.com/
CVE ID: CVE-2025-8176 State: PUBLISHED Published: 2025-07-26T03:32:08.851Z Last Updated: 2025-07-28T14:28:58.338Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: LibTIFF Problem Types: CWE-416, CWE-119 Description: A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to
may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317590 - https://vuldb.com/?ctiid.317590 - https://vuldb.com/?submit.621796 - https://gitlab.com/libtiff/libtiff/-/issues/707 - https://gitlab.com/libtiff/libtiff/-/merge_requests/727 - https://gitlab.com/libtiff/libtiff/-/commit/fe10872e53efba9cc36c66ac4ab3b41a839d5172 - http://www.libtiff.org/
CVE ID: CVE-2025-8177 State: PUBLISHED Published: 2025-07-26T04:02:07.897Z Last Updated: 2025-07-28T18:34:44.737Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C) Vendors: n/a Products: LibTIFF Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by t