Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-56301 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T19:53:58.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allowing attackers to corrupt exception handling and privilege state transitions via a flawed interaction between exception handling and MRET return mechanisms in the CSR logic when an exception is triggered during MRET execution. The Control and Status Register (CSR) logic has a flawed interaction between exception handling and exception return (MRET) mechanisms which can cause faulty trap behavior. When the
raction between exception handling and exception return (MRET) mechanisms which can cause faulty trap behavior. When the MRET instruction is executed in machine mode without being in an exception state, an Instruction Access Fault may be triggered. This results in both the exception handling logic and the exception return logic activating simultaneously, leading to conflicting updates to the control and status registers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lf-riscv.atlassian.net/wiki/spaces/HOME/pages/16154769/RISC-V+Technical+Specifications#ISA-Specifications - https://github.com/chipsalliance/rocket-chip - https://github.com/chipsalliance/rocket-chip/bl
ions#ISA-Specifications - https://github.com/chipsalliance/rocket-chip - https://github.com/chipsalliance/rocket-chip/blob/master/src/main/scala/rocket/CSR.scala - https://github.com/chipsalliance/rocket-chip/blob/f517abbf41abb65cea37421d3559f9739efd00a9/src/main/scala/rocket/CSR.scala - https://github.com/heyfenny/Vulnerability_disclosure/blob/main/RISCV/Rocket-chip/CVE-2025-56301/details.md
CVE ID: CVE-2025-56304 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:32:11.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://yzmcms.com - https://www.yzmcms.com/ - https://gitee.com/cyjsyj/cve/wikis/CVE-2025-56304?sort_id=14635721
CVE ID: CVE-2025-56311 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-10-28T20:15:50.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Shenzhen C-Data Technology Co. FD602GW-DX-R410 (firmware v2.2.14), the web management interface contains an authenticated CSRF vulnerability on the reboot endpoint (/boaform/admin/formReboot). An attacker can craft a malicious webpage that, when visited by an authenticated administrator, causes the router to reboot without explicit user consent. This lack of CSRF protection on a sensitive administrative function can lead to denial of service by disrupting network availability. Additional Analyst Notes: - CISA ADP Vuln
ive function can lead to denial of service by disrupting network availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wrathfulDiety/fd602gw-dx-r410-csrf-advisory - https://github.com/wrathfulDiety/CVE-2025-56311
CVE ID: CVE-2025-56313 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T18:22:04.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the /publix/run endpoint of JATOS 3.7.1 through 3.9.6 (inclusive). This allows remote attackers to execute arbitrary JavaScript in a user's web browser by including a malicious payload in the "code" URL parameter. When an authenticated admin user accesses the study's URL, the malicious script gets interpreted and executes within their browser, which can lead to unauthorized actions, account compromise, and privilege escalation. Additional Analyst Note
r browser, which can lead to unauthorized actions, account compromise, and privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JATOS/JATOS - https://medium.com/@ruizramisdaniel/cve-2025-56313-jatos-v3-9-6-reflected-xss-in-study-links-af1305ae09d0
CVE ID: CVE-2025-56316 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-20T19:53:27.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ming-soft/MCMS - https://gist.github.com/Erosion2020/5892757e0c6eeb647a218d1c3b323cff
CVE ID: CVE-2025-56320 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-20T19:05:25.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) in its chat box component. This allows a remote attacker to execute arbitrary code Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://enterprise.com - http://cobblestone.com - https://medium.com/@rajput.thakur/stored-xss-in-chat-box-component-cve-2025-56320-87fb10d809e2
CVE ID: CVE-2025-56379 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-03T19:08:57.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the content field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MoAlali/ - https://x.com/alaliksa_ - https://www.linkedin.com/in/mohammedaloli/ - https://github.com/MoAlali/CVE-2025-56379
CVE ID: CVE-2025-56380 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T18:06:15.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a crafted script to the fieldname parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MoAlali - https://github.com/MoAlali/CVE-2025-56380
CVE ID: CVE-2025-56381 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T18:09:21.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and group_by parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MoAlali/ - https://github.com/MoAlali/CVE-2025-56381
CVE ID: CVE-2025-56382 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:02:07.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can inject arbitrary web script or HTML via the 'Customer Name' parameter when creating or editing customer profiles. This malicious input is improperly sanitized before storage and subsequent rendering, leading to script execution in the browsers of users who view the affected customer details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://previe
who view the affected customer details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://preview.codecanyon.net/item/lims-stock-manager-pro-with-pos/full_screen_preview/22256829?_ga=2.221768668.538436323.1752589158-1013732256.1752073116 - https://github.com/Auspicious-Rook/Vulnerability-Research/tree/main/CVE-2025-56382
CVE ID: CVE-2025-56383 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-11-19T14:32:21.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/notepad-plus-plus/notepad-plus-plus - https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept - https://github.com/zer0t0/CVE-2025-5
lus/notepad-plus-plus - https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept - https://github.com/zer0t0/CVE-2025-56383-Proof-of-Concept/issues/1 - https://www.vicarius.io/vsociety/posts/cve-2025-56383-detect-notepad-vulnerability - https://www.vicarius.io/vsociety/posts/cve-2025-56383-mitigate-notepad-vulnerability
CVE ID: CVE-2025-56385 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-13T15:06:13.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, data leakage, or full system compromise of backend database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://harmony.com - http://wellsky.com - https://machevalia.blog/blog/c
t Notes: - CISA ADP Vulnrichment: References: - http://harmony.com - http://wellsky.com - https://machevalia.blog/blog/cve-2025-56385-wellsky-harmony-sql-injection
CVE ID: CVE-2025-56392 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-02T15:54:43.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perform arbitrary operations via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/syauqi/collegetivity - https://github.com/Zelilac/vulnerability-research/tree/main/CVE-2025-56392
CVE ID: CVE-2025-56394 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:32:56.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Free5gc 4.0.1 is vulnerable to Buffer Overflow. The AMF incorrectly validates the 5GS mobile identity, resulting in slice reference overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/free5gc/free5gc/issues/690 - https://gist.github.com/DDGod2025/532691e3e2db9b47c67c3d153c026e62
CVE ID: CVE-2025-56399 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:17:01.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file with a '.png` extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side validation, the file is still saved on the server. The attacker can then use the rename API to change the file extension to `.php`, and upon accessing it via a public URL, the server executes the embedded code. Additional Analys
le extension to `.php`, and upon accessing it via a public URL, the server executes the embedded code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://laravel-file-manager.com - https://github.com/Theethat-Thamwasin/CVE-2025-56399
CVE ID: CVE-2025-56400 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T20:14:42.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted
t linking flow, enabling a cross-site request forgery (CSRF)-like attack. By tricking the victim into clicking a crafted authorization link, an attacker can complete the OAuth flow on the victim's behalf, resulting in unauthorized Alexa access to the victim's Tuya-connected devices. This affects users regardless of prior Alexa linkage and does not require the Tuya application to be active at the time. Successful exploitation may allow remote control of devices such as cameras, doorbells, door locks, or alarms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tuya.com - https://src.tuya.com/announcement/30
CVE ID: CVE-2025-56401 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T16:48:33.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://wbrm.com - https://mstreet97.github.io/security/cve/sqli/2025/07/25/Zira-WBRM-SQL-Injection-CVE-2025-56401.html
CVE ID: CVE-2025-56404 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T14:27:22.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MariaDB MCP 0.1.0 allowing attackers to gain sensitive information via the SSE service as the SSE service lacks user validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MariaDB/mcp/issues/17 - https://github.com/August829/CVEP/issues/2
CVE ID: CVE-2025-56405 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T14:24:28.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in litmusautomation litmus-mcp-server thru 0.0.1 allowing unauthorized attackers to control the target's MCP service through the SSE protocol. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/litmusautomation/litmus-mcp-server/issues/4 - https://github.com/August829/CVEP/issues/3
CVE ID: CVE-2025-56406 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-16T12:59:07.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mcp-neo4j 0.3.0 allowing attackers to obtain sensitive information or execute arbitrary commands via the SSE service. NOTE: the Supplier's position is that authentication is not mandatory for MCP servers, and the mcp-neo4j MCP server is only intended for use in a local environment where authentication realistically would not be needed. Also, the Supplier provides middleware to help isolate the MCP server from external access (if needed). Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
help isolate the MCP server from external access (if needed). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/neo4j-contrib/mcp-neo4j/issues/124 - https://github.com/August829/CVEP/issues/1 - https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization
CVE ID: CVE-2025-56407 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T14:16:53.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/admin/mysql.php. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/August829/Yu/blob/main/20250810_1.md - https://github.com/August829/CVEP/issues/4
CVE ID: CVE-2025-56413 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T14:31:06.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/August829/Yu/blob/main/20250812_1.md - https://github.com/August829/CVEP/issues/5
CVE ID: CVE-2025-56423 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:31:56.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via the login error messages Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-user-enumeration/
CVE ID: CVE-2025-56426 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T19:10:53.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate quantity inputs properly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@rudranshsinghrajpurohit/cve-2025-56426-cart-price-manipulation-vulnerability-in-bagisto-cms-468b72311969
CVE ID: CVE-2025-56432 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-26T16:05:17.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://nagios.com - https://www.nagios.com/changelog/
CVE ID: CVE-2025-56435 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T20:03:55.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on the parameter id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/g/u43151774/zhyb2o/udq6lsnv80vnhbr4/collaborator/join?token=dU5eQpE4j6zEmVuK&source=doc_collaborator
CVE ID: CVE-2025-56438 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T15:41:01.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privileges to root via supplying a crafted update.tar archive file stored on a FAT32-formatted SD card. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://nous.com - https://github.com/MMarble21/Smart-camera-privilege-escalation/blob/main/ADVISORY.md
CVE ID: CVE-2025-56447 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-22T14:30:21.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: TM2 Monitoring v3.04 contains an authentication bypass and plaintext credential disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://rt.com - http://tm2.com - https://github.com/stSLAYER/ZeroDayVulnerabilities-/blob/main/RT-Systems/POC/README.md - https://gist.github.com/stSLAYER/b0be1f0fe95f56c08ef2bd69f40cd817
CVE ID: CVE-2025-56448 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T20:38:00.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does not properly rotate or invalidate used codes, allowing repeated reuse of captured transmissions. This exposes users to significant security risks, including vehicle theft and loss of trust in the alarm's anti-cloning claims. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://positron.com.br/blog/positron-lanca-alarme-px360bt-starter/ - https://
s: - CISA ADP Vulnrichment: References: - https://positron.com.br/blog/positron-lanca-alarme-px360bt-starter/ - https://medium.com/@wagneralves_87750/cve-2025-56448-replay-attack-vulnerability-in-positron-px360bt-car-alarm-system-c9f1ccea6ebe
CVE ID: CVE-2025-56449 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-10-28T20:24:22.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the default admin account was found to be locked out via the web interface but still usable through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the in
through the REST API. This allowed creation of a new privileged user, bypassing MFA protections. This undermines the intended security posture of MFA enforcement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.gregscharf.com/2025/07/11/upcoming-vulnerability-advisory/ - https://blog.gregscharf.com/2025/07/31/obsidian-scheduler-access-control-vulnerability/ - https://wiki.obsidianscheduler.com/docs/Release_Notes#Obsidian_6.3.1
CVE ID: CVE-2025-56450 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:23:03.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/selfcareLeadHistory` endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. The backend fails to sanitize the user input, allowing enumeration of database schemas, table names, and potentially leading to full database compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
potentially leading to full database compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reference1.example.com/selfcare/login - https://github.com/apboss123/CVE-2025-56450/blob/main/README.md
CVE ID: CVE-2025-56463 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T15:57:25.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com - https://github.com/MatJosephs/CVEs/tree/main/CVE-2025-56463
CVE ID: CVE-2025-56466 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-22T15:41:05.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dewcode91/security-research/blob/main/CVE-2025-56466.md