Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10321 State: PUBLISHED Published: 2025-09-12T17:32:05.863Z Last Updated: 2025-09-12T18:14:55.276Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-200, CWE-284 Description: A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
t this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323747 - https://vuldb.com/?ctiid.323747 - https://vuldb.com/?submit.643431 - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/live_online.shtml
CVE ID: CVE-2025-10322 State: PUBLISHED Published: 2025-09-12T18:02:05.947Z Last Updated: 2025-09-12T18:15:23.736Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:W/RC:R) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-640 Description: A vulnerability has been found in Wavlink WL-WN578W2 221110. The affected element is an unknown function of the file /sysinit.html. The manipulation of the argument newpass/confpass leads to weak password recovery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323748 - https://vuldb.com/?ctiid.323748 - https://vuldb.com/?submit.643433 - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/sysinit.html
CVE ID: CVE-2025-10323 State: PUBLISHED Published: 2025-09-12T19:02:05.495Z Last Updated: 2025-09-12T19:20:20.664Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is the function sub_409184 of the file /wizard_rep.shtml. The manipulation of the argument sel_EncrypTyp results in command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrich
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323749 - https://vuldb.com/?ctiid.323749 - https://vuldb.com/?submit.643434 - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/adm.cgi/wizard_rep.shtml
CVE ID: CVE-2025-10324 State: PUBLISHED Published: 2025-09-12T19:32:05.157Z Last Updated: 2025-09-12T19:44:54.702Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-77, CWE-74 Description: A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure
otely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323750 - https://vuldb.com/?ctiid.323750 - https://vuldb.com/?submit.643435 - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/firewall.cgi/websSysFirewall
CVE ID: CVE-2025-10325 State: PUBLISHED Published: 2025-09-12T20:02:05.804Z Last Updated: 2025-09-12T20:25:31.094Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:W/RC:UR) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-77, CWE-74 Description: A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub_401340/sub_401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vuln
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323751 - https://vuldb.com/?ctiid.323751 - https://vuldb.com/?submit.643436 - https://vuldb.com/?submit.643437 - https://github.com/ZZ2266/.github.io/blob/main/WAVLINK/WL-WN578W2/login.cgi/login/readme.md
CVE ID: CVE-2025-10326 State: PUBLISHED Published: 2025-09-12T20:32:05.497Z Last Updated: 2025-09-15T15:11:12.061Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-78, CWE-77 Description: A security flaw has been discovered in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/api/playlist/single.php. Performing manipulation of the argument playlist results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. A
the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323752 - https://vuldb.com/?ctiid.323752 - https://vuldb.com/?submit.643500 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce3.md - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce3.md#poc
CVE ID: CVE-2025-10327 State: PUBLISHED Published: 2025-09-12T21:02:06.202Z Last Updated: 2025-09-15T15:35:17.181Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-78, CWE-77 Description: A weakness has been identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/api/playlist/shuffle.php. Executing manipulation of the argument playlist can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but
t has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323753 - https://vuldb.com/?ctiid.323753 - https://vuldb.com/?submit.643511 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce4.md
CVE ID: CVE-2025-10328 State: PUBLISHED Published: 2025-09-12T21:32:08.718Z Last Updated: 2025-09-15T15:10:57.928Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-78, CWE-77 Description: A security vulnerability has been detected in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/api/playlist/playsinglefile.php. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond
it has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323754 - https://vuldb.com/?ctiid.323754 - https://vuldb.com/?submit.643512 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/rce5.md
CVE ID: CVE-2025-10329 State: PUBLISHED Published: 2025-09-12T22:02:05.529Z Last Updated: 2025-09-15T15:10:52.169Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: cdevroe Products: unmark Problem Types: CWE-918 Description: A vulnerability was detected in cdevroe unmark up to 1.9.3. This affects an unknown part of the file /application/controllers/Marks.php. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323755 - https://vuldb.com/?ctiid.323755 - https://vuldb.com/?submit.643531 - https://github.com/YZS17/CVE/blob/main/unmark/ssrf1.md - https://github.com/YZS17/CVE/blob/main/unmark/ssrf1.md#poc
CVE ID: CVE-2025-10330 State: PUBLISHED Published: 2025-09-12T23:02:07.130Z Last Updated: 2025-09-15T15:51:24.442Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: cdevroe Products: unmark Problem Types: CWE-79, CWE-94 Description: A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This manipulation of the argument q causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vuln
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323756 - https://vuldb.com/?ctiid.323756 - https://vuldb.com/?submit.643532 - https://github.com/YZS17/CVE/blob/main/unmark/xss1.md - https://github.com/YZS17/CVE/blob/main/unmark/xss1.md#poc
CVE ID: CVE-2025-10331 State: PUBLISHED Published: 2025-09-13T01:02:06.508Z Last Updated: 2025-09-15T15:52:21.751Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: cdevroe Products: unmark Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such manipulation of the argument Title leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
d. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323757 - https://vuldb.com/?ctiid.323757 - https://vuldb.com/?submit.643533 - https://github.com/YZS17/CVE/blob/main/unmark/xss2.md
CVE ID: CVE-2025-10332 State: PUBLISHED Published: 2025-09-13T02:02:05.972Z Last Updated: 2025-09-15T15:50:00.114Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: cdevroe Products: unmark Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in cdevroe unmark up to 1.9.3. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP V
vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323758 - https://vuldb.com/?ctiid.323758 - https://github.com/YZS17/CVE/blob/main/unmark/xss2.md
CVE ID: CVE-2025-10340 State: PUBLISHED Published: 2025-09-13T02:32:05.307Z Last Updated: 2025-09-15T15:49:02.243Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: WhatCD Products: Gazelle Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /sections/tools/managers/change_log.php of the component Commit Message Handler. Executing manipulation of the argument Message can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a
ttack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323759 - https://vuldb.com/?ctiid.323759 - https://vuldb.com/?submit.643534 - https://github.com/YZS17/CVE/blob/main/Gazelle/xss1.md - https://github.com/YZS17/CVE/blob/main/Gazelle/xss1.md#poc
CVE ID: CVE-2025-10341 State: PUBLISHED Published: 2025-09-29T08:36:57.468Z Last Updated: 2025-09-29T11:42:39.375Z Vendors: Perfex CRM Products: Perfex CRM Problem Types: CWE-79 Description: HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm
CVE ID: CVE-2025-10342 State: PUBLISHED Published: 2025-09-29T08:38:12.918Z Last Updated: 2025-09-29T11:41:02.219Z Vendors: Perfex CRM Products: Perfex CRM Problem Types: CWE-79 Description: HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint '/subscriptions/create'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm
CVE ID: CVE-2025-10343 State: PUBLISHED Published: 2025-09-29T08:39:02.142Z Last Updated: 2025-09-29T11:39:39.340Z Vendors: Perfex CRM Products: Perfex CRM Problem Types: CWE-79 Description: HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expense_name' at the endpoint '/expenses/expense'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm
CVE ID: CVE-2025-10344 State: PUBLISHED Published: 2025-09-29T08:41:38.556Z Last Updated: 2025-09-29T11:39:00.614Z Vendors: Perfex CRM Products: Perfex CRM Problem Types: CWE-79 Description: HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'clientid' at the endpoint '/projects/project/x'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm
CVE ID: CVE-2025-10345 State: PUBLISHED Published: 2025-09-29T08:42:21.781Z Last Updated: 2025-09-29T11:38:22.710Z Vendors: Perfex CRM Products: Perfex CRM Problem Types: CWE-79 Description: HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm
CVE ID: CVE-2025-10346 State: PUBLISHED Published: 2025-09-29T08:43:21.901Z Last Updated: 2025-09-29T11:18:55.983Z Vendors: Perfex CRM Products: Perfex CRM Problem Types: CWE-79 Description: HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'subject' at the endpoint 'knoewledge_base/article'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm
CVE ID: CVE-2025-10348 State: PUBLISHED Published: 2025-10-30T13:00:43.106Z Last Updated: 2025-10-30T14:26:38.615Z Vendors: Eveo Products: URVE Smart Office Problem Types: CWE-79 Description: URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication. This issue was fixed in version 1.1.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/10/CVE-2025-10348 - https://smartoffice.expert/
CVE ID: CVE-2025-10351 State: PUBLISHED Published: 2025-10-08T10:45:36.740Z Last Updated: 2025-10-08T14:51:57.851Z Vendors: Melis Technology Products: Melis Platform Problem Types: CWE-89 Description: SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform
CVE ID: CVE-2025-10352 State: PUBLISHED Published: 2025-10-08T10:46:40.687Z Last Updated: 2025-10-08T13:46:37.281Z Vendors: Melis Technology Products: Melis Platform Problem Types: CWE-862 Description: Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform
CVE ID: CVE-2025-10353 State: PUBLISHED Published: 2025-10-08T10:47:55.067Z Last Updated: 2025-10-08T13:36:16.199Z Vendors: Melis Technology Products: Melis Platform Problem Types: CWE-43 Description: File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform
CVE ID: CVE-2025-10355 State: PUBLISHED Published: 2025-10-23T11:16:30.946Z Last Updated: 2025-10-23T14:31:10.279Z Vendors: MOLGENIS Products: MOLGENIS EMX2 Problem Types: CWE-601 Description: Open redirection vulnerability in MOLGENIS EMX2 v11.14.0. This vulnerability allows an attacker to create a malicious URL using a manipulated redirection parameter, potentially leading users to phishing sites or other malicious destinations via “/%2f%2f<MALICIOUS_DOMAIN>”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/open-redirection-vulnerability-molgenis-emx2
CVE ID: CVE-2025-10357 State: PUBLISHED Published: 2025-10-14T06:00:05.180Z Last Updated: 2025-10-14T15:18:05.813Z Vendors: Unknown Products: Simple SEO Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple SEO WordPress plugin before 2.0.32 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/24fcf8ef-603f-4e1f-905d-fbaf989a617f/
CVE ID: CVE-2025-10358 State: PUBLISHED Published: 2025-09-13T08:02:06.212Z Last Updated: 2025-09-15T15:47:54.244Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-78, CWE-77 Description: A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub_404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323772 - https://vuldb.com/?ctiid.323772 - https://vuldb.com/?submit.643438 - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/wireless.cgi/DeleteMac - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/wireless.cgi/DeleteMac#proof-of-concept-poc
CVE ID: CVE-2025-10359 State: PUBLISHED Published: 2025-09-13T13:02:05.356Z Last Updated: 2025-09-15T15:36:15.362Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: WL-WN578W2 Problem Types: CWE-78, CWE-77 Description: A vulnerability was detected in Wavlink WL-WN578W2 221110. This impacts the function sub_404DBC of the file /cgi-bin/wireless.cgi. The manipulation of the argument macAddr results in os command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
y about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323773 - https://vuldb.com/?ctiid.323773 - https://vuldb.com/?submit.643444 - https://github.com/ZZ2266/.github.io/blob/main/WAVLINK/WL-WN578W2/wireless.cgi/add_mac/ - https://github.com/ZZ2266/.github.io/tree/main/WAVLINK/WL-WN578W2/wireless.cgi/add_mac#proof-of-concept-poc
CVE ID: CVE-2025-10360 State: PUBLISHED Published: 2025-09-24T15:49:47.210Z Last Updated: 2025-09-24T16:12:48.979Z Vendors: Perforce Products: Puppet Enterprise Problem Types: CWE-522 Description: In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise ver