Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2270 State: PUBLISHED Published: 2025-04-04T05:22:46.133Z Last Updated: 2025-04-04T13:07:41.132Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: adamskaat Products: Countdown, Coming Soon, Maintenance – Countdown & Clock Problem Types: CWE-22 Description: The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to
s with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in some cases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2260d6b-1a41-4757-a063-8b8857ef416a?source=cve - https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/RegisterPostType.php#L116
CVE ID: CVE-2025-2271 State: PUBLISHED Published: 2025-03-13T06:30:03.130Z Last Updated: 2025-03-13T20:43:33.084Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: issuetrak Products: audit Problem Types: CWE-639 Description: A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive information, including user details, network and hardware information, installed programs, running processes, drives, and printers. Due to improper acces
ls, network and hardware information, installed programs, running processes, drives, and printers. Due to improper access controls, an attacker can retrieve audit data belonging to other users, potentially leading to unauthorized data exposure, privacy violations, and security risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes
CVE ID: CVE-2025-2272 State: PUBLISHED Published: 2025-05-22T12:23:05.287Z Last Updated: 2025-05-22T15:34:12.408Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Forcepoint Products: FIE Endpoint Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.forcepoint.com/s/article/Security-Advisory-Privilege-Escalation-and-Arbitrary-code-execution-in-F1E-Endpoint
CVE ID: CVE-2025-2275 State: REJECTED Published: N/A Last Updated: 2025-03-13T10:23:17.194Z Description: No description available.
CVE ID: CVE-2025-2276 State: PUBLISHED Published: 2025-03-25T23:22:00.604Z Last Updated: 2025-03-26T14:49:55.004Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: davidvongries Products: Ultimate Dashboard – Custom WordPress Dashboard Problem Types: CWE-862 Description: The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules. Additional Analyst Notes
cated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffee6564-2718-4461-b481-cbf0e204a04d?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-dashboard/tags/3.8.7/modules/feature/class-feature-module.php#L118
CVE ID: CVE-2025-2277 State: PUBLISHED Published: 2025-03-13T12:47:02.631Z Last Updated: 2025-03-18T16:30:53.932Z Vendors: Devolutions Products: Server Problem Types: CWE-200 Description: Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE ID: CVE-2025-2278 State: PUBLISHED Published: 2025-03-13T12:56:04.995Z Last Updated: 2025-03-18T16:18:46.095Z Vendors: Devolutions Products: Server Problem Types: CWE-284 Description: Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE ID: CVE-2025-2279 State: PUBLISHED Published: 2025-04-04T06:00:04.641Z Last Updated: 2025-04-04T13:28:40.790Z Vendors: Unknown Products: Maps Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cd87d7ba-86e9-45b6-a3cd-11f6486f0bd0/
CVE ID: CVE-2025-2280 State: PUBLISHED Published: 2025-03-13T13:02:47.702Z Last Updated: 2025-03-19T13:22:55.007Z Vendors: Devolutions Products: Server Problem Types: CWE-284 Description: Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE ID: CVE-2025-2284 State: PUBLISHED Published: 2025-03-13T16:35:45.891Z Last Updated: 2025-03-17T13:55:32.461Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Santesoft Products: Sante PACS Server Problem Types: CWE-824 Description: A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2025-08
CVE ID: CVE-2025-2285 State: PUBLISHED Published: 2025-04-08T15:15:11.249Z Last Updated: 2025-04-08T15:37:13.536Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-457 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726
DP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html
CVE ID: CVE-2025-2286 State: PUBLISHED Published: 2025-04-08T15:16:00.777Z Last Updated: 2025-04-08T15:36:43.255Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-457 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726
CVE ID: CVE-2025-2287 State: PUBLISHED Published: 2025-04-08T15:16:58.829Z Last Updated: 2025-04-09T13:12:00.236Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-457 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to an uninitialized pointer. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726
CVE ID: CVE-2025-2288 State: PUBLISHED Published: 2025-04-08T15:19:30.666Z Last Updated: 2025-04-08T20:38:07.069Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-787 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-
icious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html
CVE ID: CVE-2025-2289 State: PUBLISHED Published: 2025-03-14T05:24:02.910Z Last Updated: 2025-04-10T14:50:33.401Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: zozothemes Products: Zegen - Church WordPress Theme Problem Types: CWE-862 Description: The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import, export, and update theme options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordf
rt, export, and update theme options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a04db024-5198-490f-bf5f-d5bad1b21ce4?source=cve - https://themeforest.net/item/zegen-church-wordpress-theme/25116823
CVE ID: CVE-2025-2290 State: PUBLISHED Published: 2025-03-19T04:21:05.815Z Last Updated: 2025-03-19T14:03:46.870Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: chrisbadgett Products: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes Problem Types: CWE-862 Description: The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, there
8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f64dbf2-b75a-4a35-9b4e-413b8fd1fff0?source=cve - https://plugins.trac.wordpress.org/changeset/3257328/lifterlms/trunk/includes/class.llms.ajax.handler.php
CVE ID: CVE-2025-2291 State: PUBLISHED Published: 2025-04-16T18:00:05.413Z Last Updated: 2025-11-03T19:42:15.907Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: PgBouncer Problem Types: CWE-324 Description: Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.pgbouncer.org/changelog.html#pgbouncer-124x
CVE ID: CVE-2025-2292 State: PUBLISHED Published: 2025-03-31T16:38:05.888Z Last Updated: 2025-03-31T18:05:05.451Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Xorcom Products: CompletePBX Problem Types: CWE-22 Description: Xorcom CompletePBX is vulnerable to an authenticated path traversal, allowing for arbitrary file reads via the Backup and Restore functionality.This issue affects CompletePBX: through 5.2.35. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/completepbx-file-disclosure - https://www.xorcom.com/new-completepbx-release-5-2-36-1/
CVE ID: CVE-2025-2293 State: PUBLISHED Published: 2025-04-08T15:20:06.355Z Last Updated: 2025-04-08T20:37:34.048Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-787 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-
CVE ID: CVE-2025-2294 State: PUBLISHED Published: 2025-03-28T04:22:41.656Z Last Updated: 2025-03-28T15:36:25.747Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: extendthemes Products: Kubio AI Page Builder Problem Types: CWE-22 Description: The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve cod
cution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2fb44c6e-520e-4a9f-9987-8b770feb710d?source=cve - https://plugins.trac.wordpress.org/browser/kubio/tags/2.5.1/lib/integrations/third-party-themes/editor-hooks.php#L32
CVE ID: CVE-2025-2295 State: PUBLISHED Published: 2025-03-14T21:35:10.484Z Last Updated: 2025-03-18T16:19:50.500Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: TianoCore Products: EDK2 Problem Types: CWE-190 Description: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-8522-69fh-w74x
CVE ID: CVE-2025-2297 State: PUBLISHED Published: 2025-07-28T15:40:14.633Z Last Updated: 2025-07-28T17:22:18.590Z Vendors: BeyondTrust Products: Privilege Management for Windows Problem Types: CWE-268 Description: Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.beyondtrust.com/trust-center/security-advisories/bt25-05
CVE ID: CVE-2025-2298 State: PUBLISHED Published: 2025-04-21T15:12:24.391Z Last Updated: 2025-04-21T15:56:03.117Z Vendors: Dremio Corporation Products: Dremio Software Problem Types: CWE-862 Description: An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system files and files stored in remote locations such as S3, Azure Blob Storage, and local filesystems. This vulnerability exists due to insufficient access controls on an API endpoint, enabling any authenticated user to specify and delete files outside their intended scope. Exploiting this flaw could lead to data loss, denial of service (D
pecify and delete files outside their intended scope. Exploiting this flaw could lead to data loss, denial of service (DoS), and potential escalation of impact depending on the deleted files. Affected versions: * Any version of Dremio below 24.0.0 * Dremio 24.3.0 - 24.3.16 * Dremio 25.0.0 - 25.0.14 * Dremio 25.1.0 - 25.1.7 * Dremio 25.2.0 - 25.2.4 Fixed in version: * Dremio 24.3.17 and above * Dremio 25.0.15 and above * Dremio 25.1.8 and above * Dremio 25.2.5 and above * Dremio 26.0.0 and above Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.dremio.com/current/reference/bulletins/2025-04-21-01/
CVE ID: CVE-2025-2299 State: PUBLISHED Published: 2025-04-03T11:12:30.588Z Last Updated: 2025-04-03T13:17:30.399Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: theluckywp Products: LuckyWP Table of Contents Problem Types: CWE-79 Description: The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a li
ipts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82df5b2e-4c4a-402f-99c9-694fa710009b?source=cve - https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/trunk/admin/controllers/EditorBlockController.php#L30 - https://plugins.trac.wordpress.org/browser/luckywp-table-of-contents/trunk/admin/widgets/customizeSuccess/views/widget.php#L12 - https://plugins.trac.wordpress.org/changeset/3265169/
CVE ID: CVE-2025-2300 State: PUBLISHED Published: 2025-04-22T04:12:41.660Z Last Updated: 2025-04-22T13:24:55.944Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hitachi Products: Hitachi Ops Center Common Services Problem Types: CWE-532 Description: Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability. This issue affects Hitachi Ops Center Common Services: from 11.0.3-00 before 11.0.4-00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-112/index.html
CVE ID: CVE-2025-2301 State: PUBLISHED Published: 2025-07-21T11:33:12.637Z Last Updated: 2025-07-21T12:15:54.762Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Akbim Software Products: Online Exam Registration Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers.This issue affects Online Exam Registration: before 14.03.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0164
CVE ID: CVE-2025-2302 State: PUBLISHED Published: 2025-03-25T23:21:55.903Z Last Updated: 2025-03-26T13:42:50.980Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mihail-barinov Products: Advanced Woo Search Problem Types: CWE-79 Description: The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aws_search_terms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8fca84-3ea1-432f-8cfe-9a1d1f70fa6f?source=cve - https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/3.28/includes/class-aws-shortcodes.php#L50 - https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/3.28/includes/class-aws-shortcodes.php#L175
CVE ID: CVE-2025-2303 State: PUBLISHED Published: 2025-03-22T06:41:11.225Z Last Updated: 2025-04-01T16:25:59.291Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: landwire Products: Block Logic – Full Gutenberg Block Display Control Problem Types: CWE-94 Description: The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8 via the block_logic_check_logic function. This is due to the unsafe evaluation of user-controlled input. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Additional An
sible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a76f851-3f4e-4457-a33c-eede51c4b4d1?source=cve - https://plugins.trac.wordpress.org/browser/block-logic/tags/1.0.8/block-logic.php#L127
CVE ID: CVE-2025-2304 State: PUBLISHED Published: 2025-03-14T12:34:19.489Z Last Updated: 2025-03-17T07:45:14.302Z Vendors: owen2345 Products: camaleon-cms Problem Types: CWE-915 Description: A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2025-09 - https://github.com/owen2345/camaleon-cms
CVE ID: CVE-2025-2305 State: PUBLISHED Published: 2025-05-16T12:09:41.347Z Last Updated: 2025-05-16T13:04:26.030Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: SYNCPILOT Products: LIVE CONTRACT Problem Types: CWE-20 Description: A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cirosec.de/sa/sa-2025-003