Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0918 State: PUBLISHED Published: 2025-02-22T12:39:21.418Z Last Updated: 2025-02-24T12:51:45.764Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yaycommerce Products: SMTP for SendGrid – YaySMTP Problem Types: CWE-79 Description: The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b98f2a85-9535-4bf5-900c-f4f630c7b502?source=cve - https://plugins.trac.wordpress.org/browser/smtp-sendgrid/trunk/includes/Functions.php - https://wordpress.org/plugins/smtp-sendgrid/#developers - https://plugins.trac.wordpress.org/changeset/3056461/ - https://plugins.trac.wordpress.org/changeset/3234377/
CVE ID: CVE-2025-0919 State: REJECTED Published: N/A Last Updated: 2025-02-12T16:59:59.842Z Description: No description available.
CVE ID: CVE-2025-0921 State: PUBLISHED Published: 2025-05-15T22:36:37.902Z Last Updated: 2025-08-06T06:26:05.929Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: Mitsubishi Electric Corporation, Mitsubishi Electric Iconics Digital Solutions Products: GENESIS64, MC Works64, GENESIS Problem Types: CWE-250 Description: Execution with Unnecessary Privileges vulnerability in multiple services of Mitsubishi Electric Iconics Digital Solutions GENESIS64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS version 11.00, Mitsubishi Electric GENESIS64 all versions, Mitsubishi Electric MC Works64 all versions, and Mitsubishi Electric GENESIS version 11.0
ectric GENESIS64 all versions, Mitsubishi Electric MC Works64 all versions, and Mitsubishi Electric GENESIS version 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the services of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-002_en.pdf -
: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-002_en.pdf - https://jvn.jp/vu/JVNVU93838985 - https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04
CVE ID: CVE-2025-0923 State: PUBLISHED Published: 2025-06-11T17:28:57.762Z Last Updated: 2025-08-24T11:57:12.698Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-540 Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234674
CVE ID: CVE-2025-0924 State: PUBLISHED Published: 2025-02-17T04:22:45.608Z Last Updated: 2025-02-18T15:32:09.879Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: melapress Products: WP Activity Log Problem Types: CWE-79 Description: The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
t will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91699d32-1768-4d87-a4f2-91969b3e3355?source=cve - https://wordpress.org/plugins/wp-security-audit-log/#developers - https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Controllers/class-alert-manager.php - https://plugins.trac.wordpress.org/browser/wp-security-audit-log/trunk/classes/Controllers/class-alert.php - https://plugins.trac.wordpress.org/changeset/3238760/
CVE ID: CVE-2025-0925 State: REJECTED Published: N/A Last Updated: 2025-02-12T16:59:42.033Z Description: No description available.
CVE ID: CVE-2025-0926 State: PUBLISHED Published: 2025-04-23T05:22:03.489Z Last Updated: 2025-04-23T13:08:49.871Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H) Vendors: Axis Communications AB Products: AXIS Camera Station Pro Problem Types: CWE-732 Description: Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/9d/fe/3f/cve-2025-0926pdf-en-US-479105.pdf
CVE ID: CVE-2025-0927 State: REJECTED Published: 2025-03-23T15:00:47.770Z Last Updated: 2025-04-08T08:07:06.833Z Description: No description available.
CVE ID: CVE-2025-0928 State: PUBLISHED Published: 2025-07-08T17:20:04.608Z Last Updated: 2025-07-08T17:36:20.075Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Canonical Products: Juju Problem Types: CWE-285 Description: In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.
lly resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv
CVE ID: CVE-2025-0929 State: PUBLISHED Published: 2025-01-31T13:37:42.158Z Last Updated: 2025-01-31T14:58:50.857Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lewe Products: TeamCal Neo Problem Types: CWE-89 Description: SQL injection vulnerability in TeamCal Neo, version 3.8.2. This could allow an attacker to retrieve, update and delete all database information by injecting a malicious SQL statement via the ‘abs’ parameter in ‘/teamcal/src/index.php’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teamcal-neo
CVE ID: CVE-2025-0930 State: PUBLISHED Published: 2025-01-31T13:45:09.339Z Last Updated: 2025-01-31T14:52:24.753Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Lewe Products: TeamCal Neo Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the ‘abs’ parameter in ‘/teamcal/src/index.php’. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-teamcal-neo
CVE ID: CVE-2025-0932 State: PUBLISHED Published: 2025-08-04T10:00:57.639Z Last Updated: 2025-08-06T03:55:29.726Z Vendors: Arm Ltd Products: Bifrost GPU Userspace Driver, Valhall GPU Userspace Driver, Arm 5th Gen GPU Architecture Userspace Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Val
dy freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/110626/latest/
CVE ID: CVE-2025-0934 State: PUBLISHED Published: 2025-01-31T19:31:04.260Z Last Updated: 2025-02-12T20:51:23.054Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. This affects an unknown part of the file /parse/_call_job_search_ajax.php. The manipulation of the argument n leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294243 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294243 - https://vuldb.com/?ctiid.294243 - https://vuldb.com/?submit.491802 - https://github.com/1337g/CVE-2025-X/blob/main/job-recruitment_call_job_search_ajax-sqli.pdf - https://code-projects.org/
CVE ID: CVE-2025-0935 State: PUBLISHED Published: 2025-02-15T08:25:05.509Z Last Updated: 2025-02-18T21:12:36.868Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: maxfoundry Products: Media Library Folders Problem Types: CWE-862 Description: The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
in settings related to things such as IP-blocking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f810102-cf25-4898-a3a6-3cdc9a96aaea?source=cve - https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L697 - https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L6296 - https://plugins.trac.wordpress.org/browser/media-library-plus/trunk/media-library-plus.php#L7198 - https://plugins.trac.wordpress.org/changeset/3234676/media-library-plus/trunk/media-library-plus.php
CVE ID: CVE-2025-0936 State: PUBLISHED Published: 2025-05-07T22:52:25.444Z Last Updated: 2025-05-08T13:02:27.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-256 Description: On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/s
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21394-security-advisory-0117
CVE ID: CVE-2025-0937 State: PUBLISHED Published: 2025-02-12T18:59:25.011Z Last Updated: 2025-02-12T19:32:54.537Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-863 Description: Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-02-nomad-vulnerable-to-event-stream-namespace-acl-policy-bypass-through-wildcard-namespace/73191
CVE ID: CVE-2025-0938 State: PUBLISHED Published: 2025-01-31T17:51:35.898Z Last Updated: 2025-11-03T20:56:43.285Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-20 Description: The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github
nt URL parsers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/issues/105704 - https://github.com/python/cpython/pull/129418 - https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/ - https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a - https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403 - https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568 - https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba - https://github.com/python/cpython/commit/b8b4b713c
.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba - https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab - https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32
CVE ID: CVE-2025-0939 State: PUBLISHED Published: 2025-02-01T06:41:51.508Z Last Updated: 2025-02-03T16:37:39.052Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: dcooperman Products: MagicForm Problem Types: CWE-862 Description: The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
to delete or view logs, modify forms or modify plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b?source=cve - https://plugins.trac.wordpress.org/browser/magicform/trunk/admin/admin-menu.php
CVE ID: CVE-2025-0941 State: PUBLISHED Published: 2025-02-26T16:28:36.746Z Last Updated: 2025-02-26T17:02:46.560Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Beckman Coulter Life Sciences Products: MET ONE 3400+ Problem Types: CWE-209 Description: MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.beckman.com/about-us/compliance/coordinated-vulnerability-disclosure/product-security-updates
CVE ID: CVE-2025-0942 State: PUBLISHED Published: 2025-04-07T21:35:31.322Z Last Updated: 2025-11-19T20:28:43.044Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Jalios Products: JPlatform Problem Types: CWE-89 Description: The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an SQL command allows for unauthenticated users to trigger SQL Injection. This issue affects JPlatform before 10.0.6 and a PatchPlugin release 10.0.6 was issued 2023-02-06. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.jalios.com/jcms/jc2_734797/fr/avertissement-de-securite-2023-02-06 - h
ADP Vulnrichment: References: - https://community.jalios.com/jcms/jc2_734797/fr/avertissement-de-securite-2023-02-06 - https://community.jalios.com/patchplugin-10.0.6 - https://www.vulncheck.com/advisories/jalios-jplatform-record-chooser-sqli
CVE ID: CVE-2025-0943 State: PUBLISHED Published: 2025-02-01T10:31:05.431Z Last Updated: 2025-02-12T20:41:39.579Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file deldoc.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294298 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294298 - https://vuldb.com/?ctiid.294298 - https://vuldb.com/?submit.488498 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0944 State: PUBLISHED Published: 2025-02-01T12:31:05.348Z Last Updated: 2025-02-12T20:41:39.429Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file customerview.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29429
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294299 - https://vuldb.com/?ctiid.294299 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0945 State: PUBLISHED Published: 2025-02-01T15:00:16.506Z Last Updated: 2025-02-12T20:41:39.291Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file typedelete.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294300 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294300 - https://vuldb.com/?ctiid.294300 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0946 State: PUBLISHED Published: 2025-02-01T16:00:10.468Z Last Updated: 2025-02-12T20:41:39.139Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file templatedelete.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294301 - https://vuldb.com/?ctiid.294301 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0947 State: PUBLISHED Published: 2025-02-01T17:00:12.174Z Last Updated: 2025-02-12T20:41:39.009Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in itsourcecode Tailoring Management System 1.0. Affected by this issue is some unknown functionality of the file expview.php. The manipulation of the argument expid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294302 - https://vuldb.com/?ctiid.294302 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0948 State: PUBLISHED Published: 2025-02-01T18:00:13.333Z Last Updated: 2025-02-03T17:21:19.162Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file incview.php. The manipulation of the argument incid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294303
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294303 - https://vuldb.com/?ctiid.294303 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-0949 State: PUBLISHED Published: 2025-02-01T19:00:14.618Z Last Updated: 2025-02-03T17:20:27.942Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file partview.php. The manipulation of the argument typeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294304
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.294304 - https://vuldb.com/?ctiid.294304 - https://github.com/magic2353112890/cve/issues/7 - https://itsourcecode.com/