Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319370 - https://vuldb.com/?ctiid.319370 - https://vuldb.com/?submit.622409 - https://github.com/jasper-software/jasper/issues/401 - https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link - https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4
CVE ID: CVE-2025-8837 State: PUBLISHED Published: 2025-08-11T08:02:07.784Z Last Updated: 2025-08-11T19:56:29.410Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: JasPer Problem Types: CWE-416, CWE-119 Description: A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this
may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319371 - https://vuldb.com/?ctiid.319371 - https://vuldb.com/?submit.630487 - https://vuldb.com/?submit.630488 - https://github.com/jasper-software/jasper/issues/402 - https://drive.google.com/file/d/17Ic_DDOlH7mMT7IbTN2Bmo6SrujIUh24/view?usp=sharing - https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a
CVE ID: CVE-2025-8838 State: PUBLISHED Published: 2025-08-11T08:32:06.586Z Last Updated: 2025-08-11T12:52:36.979Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: WinterChenS Products: my-site Problem Types: CWE-287 Description: A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at t
exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319372 - https://vuldb.com/?ctiid.319372 - https://vuldb.com/?submit.622421 - https://github.com/WinterChenS/my-site/issues/97 - https://github.com/WinterChenS/my-site/issues/97#issuecomment-2986947791 -
://github.com/WinterChenS/my-site/issues/97 - https://github.com/WinterChenS/my-site/issues/97#issuecomment-2986947791 - https://github.com/WinterChenS/my-site/issues/97#issuecomment-2987091571
CVE ID: CVE-2025-8839 State: PUBLISHED Published: 2025-08-11T09:02:08.591Z Last Updated: 2025-08-11T12:51:21.325Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: jshERP Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319373 - https://vuldb.com/?ctiid.319373 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319373 - https://vuldb.com/?ctiid.319373 - https://vuldb.com/?submit.622569 - https://github.com/jishenghua/jshERP/issues/125
CVE ID: CVE-2025-8840 State: PUBLISHED Published: 2025-08-11T09:32:05.802Z Last Updated: 2025-08-11T12:49:40.283Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: jshERP Problem Types: CWE-285, CWE-266 Description: A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
be used. Different than CVE-2025-7947. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319374 - https://vuldb.com/?ctiid.319374 - https://vuldb.com/?submit.622573 - https://vuldb.com/?submit.622621 - https://github.com/jishenghua/jshERP/issues/126
CVE ID: CVE-2025-8841 State: PUBLISHED Published: 2025-08-11T10:02:06.203Z Last Updated: 2025-08-11T12:35:23.135Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: zlt2000 Products: microservices-platform Problem Types: CWE-434, CWE-284 Description: A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319375 - https://vuldb.com/?ctiid.319375 - https://vuldb.com/?submit.623100 - https://github.com/zlt2000/microservices-platform/issues/77 - https://github.com/zlt2000/microservices-platform/issues/77#issue-3264841808
CVE ID: CVE-2025-8842 State: PUBLISHED Published: 2025-08-11T10:32:09.151Z Last Updated: 2025-08-11T12:34:33.576Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: NASM Products: Netwide Assember Problem Types: CWE-416, CWE-119 Description: A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319376 - https://vuldb.com/?ctiid.319376 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319376 - https://vuldb.com/?ctiid.319376 - https://vuldb.com/?submit.623184 - https://bugzilla.nasm.us/show_bug.cgi?id=3392933 - https://drive.google.com/file/d/11vEV1vMHXO4BrDGhvWAMm0Qo1woiUwVV/view?usp=drive_link
CVE ID: CVE-2025-8843 State: PUBLISHED Published: 2025-08-11T11:02:09.017Z Last Updated: 2025-08-11T12:33:44.615Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: NASM Products: Netwide Assember Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in NASM Netwide Assember 2.17rc0. This affects the function macho_no_dead_strip of the file outmacho.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319377 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319377 - https://vuldb.com/?ctiid.319377 - https://vuldb.com/?submit.623185 - https://vuldb.com/?submit.623186 - https://bugzilla.nasm.us/show_bug.cgi?id=3392934 - https://drive.google.com/file/d/1JRHWdjW6FGHDV0CMJe8VinmCQ4vP9ZpR/view?usp=drive_link
CVE ID: CVE-2025-8844 State: PUBLISHED Published: 2025-08-11T11:32:08.340Z Last Updated: 2025-08-11T12:12:07.494Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: NASM Products: Netwide Assember Problem Types: CWE-476, CWE-404 Description: A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file preproc.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319378 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319378 - https://vuldb.com/?ctiid.319378 - https://vuldb.com/?submit.623187 - https://vuldb.com/?submit.623196 - https://vuldb.com/?submit.623198 - https://bugzilla.nasm.us/show_bug.cgi?id=3392936 - https://drive.google.com/file/d/10TSdMErFTBtLFIwfh_fia635cmtmFuei/view?usp=drive_link
CVE ID: CVE-2025-8845 State: PUBLISHED Published: 2025-08-11T12:02:08.301Z Last Updated: 2025-08-12T13:43:32.950Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: NASM Products: Netwide Assember Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in NASM Netwide Assember 2.17rc0. This issue affects the function assemble_file of the file nasm.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319379 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319379 - https://vuldb.com/?ctiid.319379 - https://vuldb.com/?submit.623188 - https://bugzilla.nasm.us/show_bug.cgi?id=3392937 - https://drive.google.com/file/d/1pEQb6lcdohWV53DzPPU7kaCCNg-qAaau/view?usp=drive_link
CVE ID: CVE-2025-8846 State: PUBLISHED Published: 2025-08-11T12:32:07.575Z Last Updated: 2025-08-11T19:41:08.735Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: NASM Products: Netwide Assember Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected is the function parse_line of the file parser.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319380 - https://vuldb.com/?ctiid.319380 -
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319380 - https://vuldb.com/?ctiid.319380 - https://vuldb.com/?submit.623189 - https://bugzilla.nasm.us/show_bug.cgi?id=3392938 - https://drive.google.com/file/d/1MQGtdnz58vRF2fAeJMJ4VGiBQWXpnqfy/view?usp=drive_link
CVE ID: CVE-2025-8847 State: PUBLISHED Published: 2025-08-11T13:02:06.785Z Last Updated: 2025-08-12T13:42:58.718Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipulation of the argument noticeTitle/noticeContent leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319381 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319381 - https://vuldb.com/?ctiid.319381 - https://vuldb.com/?submit.623372 - https://github.com/yangzongzhuan/RuoYi/issues/298 - https://github.com/yangzongzhuan/RuoYi/issues/298#issue-3265348205
CVE ID: CVE-2025-8848 State: PUBLISHED Published: 2025-10-22T13:54:00.389Z Last Updated: 2025-10-30T18:22:51.121Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-94 Description: A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
curity risks such as cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a05ebc1f-882a-4adc-b178-d3cefa4b730e
CVE ID: CVE-2025-8849 State: PUBLISHED Published: 2025-10-30T23:42:41.552Z Last Updated: 2025-10-31T15:09:34.057Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-400 Description: LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the ser
ely large values are submitted. This results in the inability to create new memories, impacting the stability of the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6 - https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9
CVE ID: CVE-2025-8850 State: PUBLISHED Published: 2025-10-30T19:59:36.327Z Last Updated: 2025-11-05T14:57:26.783Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-440 Description: In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw ca
roperly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8e615709-f4de-41e2-b194-f0d91ed7c75e - https://github.com/danny-avila/librechat/commit/7e4c8a5d0d2dbe5bf8fd272ff6acafb27d24744f
CVE ID: CVE-2025-8851 State: PUBLISHED Published: 2025-08-11T13:32:08.843Z Last Updated: 2025-08-12T13:43:18.136Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C) Vendors: n/a Products: LibTIFF Problem Types: CWE-121, CWE-119 Description: A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue. Additional Analys
ied as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319382 - https://vuldb.com/?ctiid.319382 - https://vuldb.com/?submit.624604 - https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3 - http://www.libtiff.org/
CVE ID: CVE-2025-8852 State: PUBLISHED Published: 2025-08-11T14:02:05.671Z Last Updated: 2025-08-11T15:36:58.682Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: WuKongOpenSource Products: WukongCRM Problem Types: CWE-209, CWE-200 Description: A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319383 - https://vuldb.com/?ctiid.319383 - https://vuldb.com/?submit.624693 - https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26 - https://github.com/WuKongOpenSource/WukongCRM-11.0-JAVA/issues/26#issue-3272864284
CVE ID: CVE-2025-8853 State: PUBLISHED Published: 2025-08-11T09:04:20.323Z Last Updated: 2025-08-11T12:50:27.146Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 2100 Technology Products: Official Document Management System Problem Types: CWE-290 Description: Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10319-adc18-1.html - https://www.twcert.org.tw/en/cp-139-10320-ad5
nt: References: - https://www.twcert.org.tw/tw/cp-132-10319-adc18-1.html - https://www.twcert.org.tw/en/cp-139-10320-ad540-2.html - https://www.chtsecurity.com/news/8618a2f0-390a-4506-9ff8-a9e74030d19e - https://www.chtsecurity.com/news/a9a90f0b-c2cb-4c66-b3d1-bc7f252fd108
CVE ID: CVE-2025-8854 State: PUBLISHED Published: 2025-08-11T04:24:02.469Z Last Updated: 2025-08-11T20:32:47.464Z Vendors: bulletphysics Products: bullet3 Problem Types: CWE-120 Description: Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bulletphysics/bullet3/blob/master/Extras/VHACD/test/src/main_vhacd.cpp#L472 - https://github.com/bulletphysics/bullet3/issues/4732
CVE ID: CVE-2025-8855 State: PUBLISHED Published: 2025-11-14T12:39:46.458Z Last Updated: 2025-11-14T13:20:17.282Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Optimus Software Products: Brokerage Automation Problem Types: CWE-639, CWE-640, CWE-302 Description: Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.This issue affects Brokerage Automation: before 1.1.71. Additional Analyst Notes: - CISA ADP Vulnrichmen
try Information.This issue affects Brokerage Automation: before 1.1.71. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0396
CVE ID: CVE-2025-8857 State: PUBLISHED Published: 2025-08-29T03:33:20.683Z Last Updated: 2025-08-29T13:26:36.549Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Changing Products: Clinic Image System Problem Types: CWE-798 Description: Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10362-c6021-1.html - https://www.twcert.org.tw/en/cp-139-10363-601c9-2.html - https://www.chtsecurity.com/news/276d7867-dfb1-
-c6021-1.html - https://www.twcert.org.tw/en/cp-139-10363-601c9-2.html - https://www.chtsecurity.com/news/276d7867-dfb1-4a91-bc34-97b0f6a117a3
CVE ID: CVE-2025-8858 State: PUBLISHED Published: 2025-08-29T03:36:21.390Z Last Updated: 2025-08-29T16:27:14.212Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Changing Products: Clinic Image System Problem Types: CWE-89 Description: Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10362-c6021-1.html - https://www.twcert.org.tw/en/cp-139-10363-601c9-2.html
CVE ID: CVE-2025-8859 State: PUBLISHED Published: 2025-08-11T14:32:05.712Z Last Updated: 2025-08-11T17:29:25.268Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: eBlog Site Problem Types: CWE-434, CWE-284 Description: A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319399 - https://vuldb.com/?ctiid.319399 - https://vuldb.com/?submit.628112 - https://github.com/unjoke/newvul/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8861 State: PUBLISHED Published: 2025-08-29T03:28:07.911Z Last Updated: 2025-08-29T13:25:39.333Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Changing Products: TSA Problem Types: CWE-306 Description: TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10360-012e7-1.html - https://www.twcert.org.tw/en/cp-139-10361-4ce04-2.html
CVE ID: CVE-2025-8862 State: PUBLISHED Published: 2025-08-11T12:40:35.201Z Last Updated: 2025-08-11T19:35:03.672Z Vendors: YugabyteDB Inc Products: YugabyteDB Problem Types: CWE-201 Description: YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE ID: CVE-2025-8863 State: PUBLISHED Published: 2025-08-11T13:03:18.238Z Last Updated: 2025-08-11T15:08:45.940Z Vendors: YugabyteDB Inc Products: YugabyteDB Problem Types: CWE-319 Description: YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/