Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5492 State: PUBLISHED Published: 2025-06-03T10:31:04.807Z Last Updated: 2025-06-03T13:15:55.501Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DI-500WF-WT Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub_456DE8 of the file /msp_info.htm?flag=cmd of the component /usr/sbin/jhttpd. The manipulation of the argument cmd leads to command injection. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310909 - https://vuldb.com/?ctiid.310909
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310909 - https://vuldb.com/?ctiid.310909 - https://vuldb.com/?submit.575244 - https://www.dlink.com/
CVE ID: CVE-2025-5493 State: PUBLISHED Published: 2025-06-03T10:31:07.268Z Last Updated: 2025-06-03T13:14:30.087Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Baison Products: Channel Middleware Product Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Baison Channel Middleware Product 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file /e3api/api/main/ToJsonByControlName. The manipulation of the argument data leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310910 - https://vuldb.com/?ctiid.310910 - https://vuldb.com/?submit.586972 - https://medium.com/@luoluoxi311/sql-injection-in-baison-channel-middleware-product-version-2-0-1-e0d1ec95c697
CVE ID: CVE-2025-5494 State: PUBLISHED Published: 2025-09-25T13:11:49.423Z Last Updated: 2025-09-25T15:15:34.354Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Zohocorp Products: Endpoint Central Problem Types: CWE-269 Description: ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/desktop-central/privilege-escalation-endpointcentral-agent.html
CVE ID: CVE-2025-5495 State: PUBLISHED Published: 2025-06-03T12:31:04.672Z Last Updated: 2025-06-03T13:05:08.689Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Netgear Products: WNR614 Problem Types: CWE-287 Description: A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This issue appears to have been circulating as an 0day since 2024. Additional Analyst Notes: - CISA ADP Vulnr
y be used. This issue appears to have been circulating as an 0day since 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310911 - https://vuldb.com/?ctiid.310911 - https://vuldb.com/?submit.584939 - https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.md - https://www.netgear.com/
CVE ID: CVE-2025-5496 State: PUBLISHED Published: 2025-10-21T10:04:08.316Z Last Updated: 2025-10-21T13:31:28.145Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Zohocorp Products: Endpoint Central Problem Types: CWE-269 Description: ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/desktop-central/kb/arbitrary-file-deletion-allows-local-privilege-escalation.html
CVE ID: CVE-2025-5497 State: PUBLISHED Published: 2025-06-03T13:00:16.567Z Last Updated: 2025-08-20T08:53:07.592Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: slackero Products: phpwcms Problem Types: CWE-502, CWE-20 Description: A vulnerability was detected in slackero phpwcms up to 1.9.45/1.10.8. The impacted element is an unknown function of the file include/inc_module/mod_feedimport/inc/processing.inc.php of the component Feedimport Module. Performing manipulation of the argument cnt_text results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to reso
tiated remotely. The exploit is now public and may be used. Upgrading to version 1.9.46 and 1.10.9 is sufficient to resolve this issue. The patch is named 41a72eca0baa9d9d0214fec97db2400bc082d2a9. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310912 - https://vuldb.com/?ctiid.310912 - https://vuldb.com/?submit.577999 - https://github.com/3em0/cve_repo/blob/main/phpwcms/phar%20vulnerability%20in%20phpwcms.md - https://github.com/slackero/phpwcms/commit/41a72eca0baa9d9d0214fec97db2400bc082d2a9 - https://github.com/slackero/phpwcms/releases/tag/v1.10.9
CVE ID: CVE-2025-5498 State: PUBLISHED Published: 2025-06-03T13:31:05.263Z Last Updated: 2025-06-03T13:45:36.390Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: slackero Products: phpwcms Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function file_get_contents/is_file of the file include/inc_lib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpage_custom leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and
may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310913 - https://vuldb.com/?ctiid.310913 - https://vuldb.com/?submit.578054 - https://vuldb.com/?submit.578055 - https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23file_get_contents.md - https://github.com/3em0/cve_repo/blob/main/phpwcms/cnt21.readform.inc.php%23is_file.md - https://github.com/slackero/phpwcms/releases/tag/v1.10.9
CVE ID: CVE-2025-5499 State: PUBLISHED Published: 2025-06-03T13:31:07.203Z Last Updated: 2025-06-03T13:42:05.740Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: slackero Products: phpwcms Problem Types: CWE-502, CWE-20 Description: A vulnerability classified as critical has been found in slackero phpwcms up to 1.9.45/1.10.8. Affected is the function is_file/getimagesize of the file image_resized.php. The manipulation of the argument imgfile leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affe
may be used. Upgrading to version 1.9.46 and 1.10.9 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310914 - https://vuldb.com/?ctiid.310914 - https://vuldb.com/?submit.578082 - https://vuldb.com/?submit.578083 - https://github.com/3em0/cve_repo/blob/main/phpwcms/image_resized%23getimagesize.md - https://github.com/slackero/phpwcms/releases/tag/v1.10.9
CVE ID: CVE-2025-5500 State: PUBLISHED Published: 2025-09-09T16:32:08.477Z Last Updated: 2025-09-09T19:28:57.382Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: ZhenShi Products: Mibro Fit App Problem Types: CWE-926 Description: A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xiaoxun.xunoversea.mibrofit. This manipulation causes improper export of android application components. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in an
ploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323234 - https://vuldb.com/?ctiid.323234 - https://vuldb.com/?submit.637921 - https://github.com/KMov-g/androidapps/blob/main/com.xiaoxun.xunoversea.mibrofit.md - https://github.com/KMov-g/androidapps/blob/main/com.xiaoxun.xunoversea.mibrofit.md#steps-to-reproduce
CVE ID: CVE-2025-5501 State: PUBLISHED Published: 2025-06-03T14:00:21.279Z Last Updated: 2025-06-03T14:16:02.935Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Open5GS Problem Types: CWE-617 Description: A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_switch_request_transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to reachable assertion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 2daa44adab762c47a8cef69cc
hed remotely. The exploit has been disclosed to the public and may be used. The patch is named 2daa44adab762c47a8cef69cc984946973a845b3. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310915 - https://vuldb.com/?ctiid.310915 - https://vuldb.com/?submit.582265 - https://github.com/open5gs/open5gs/issues/3909 - https://github.com/open5gs/open5gs/issues/3909#issuecomment-2926682623 - https://github.com/user-attachments/files/20362183/AMF.crash.due.to.pathswitchrequest.zip - https://github.com/open5gs/open5gs/commit/2daa44adab762c47a8cef69cc984946973a845b3
CVE ID: CVE-2025-5502 State: PUBLISHED Published: 2025-06-03T14:00:24.217Z Last Updated: 2025-06-03T14:15:32.604Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: X15 Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addition
he public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310916 - https://vuldb.com/?ctiid.310916 - https://vuldb.com/?submit.583562 - https://github.com/Yhuanhuan01/TOTOlink/blob/main/TOTOlink-x15.md#poc1-code-injection - https://www.totolink.net/
CVE ID: CVE-2025-5503 State: PUBLISHED Published: 2025-06-03T14:31:07.149Z Last Updated: 2025-06-03T14:51:44.881Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: X15 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. This affects the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addit
o the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310917 - https://vuldb.com/?ctiid.310917 - https://github.com/Yhuanhuan01/TOTOlink/blob/main/TOTOlink-x15.md#poc2-stack_overflow - https://www.totolink.net/
CVE ID: CVE-2025-5504 State: PUBLISHED Published: 2025-06-03T14:31:10.451Z Last Updated: 2025-06-03T14:48:04.322Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: X2000R Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWsc. The manipulation of the argument peerRptPin leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CIS
ed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310918 - https://vuldb.com/?ctiid.310918 - https://vuldb.com/?submit.584660 - https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formWsc/RCE_formWsc.md - https://www.totolink.net/
CVE ID: CVE-2025-5505 State: PUBLISHED Published: 2025-06-03T15:00:20.068Z Last Updated: 2025-06-04T20:29:55.827Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: TOTOLINK Products: A3002RU Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. This issue affects some unknown processing of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not res
t has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310919 - https://vuldb.com/?ctiid.310919 - https://vuldb.com/?submit.584662 - https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_virtual_server - https://www.totolink.net/
CVE ID: CVE-2025-5506 State: PUBLISHED Published: 2025-06-03T15:00:23.661Z Last Updated: 2025-06-03T17:50:49.644Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: TOTOLINK Products: A3002RU Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analy
c and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310920 - https://vuldb.com/?ctiid.310920 - https://vuldb.com/?submit.584663 - https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Nat_Mapping - https://www.totolink.net/
CVE ID: CVE-2025-5507 State: PUBLISHED Published: 2025-06-03T15:31:06.396Z Last Updated: 2025-06-03T15:56:38.419Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: TOTOLINK Products: A3002RU Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way
losed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310921 - https://vuldb.com/?ctiid.310921 - https://vuldb.com/?submit.584664 - https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_Mac_filtering - https://www.totolink.net/
CVE ID: CVE-2025-5508 State: PUBLISHED Published: 2025-06-03T16:00:20.117Z Last Updated: 2025-06-03T17:38:04.291Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: TOTOLINK Products: A3002RU Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of the component IP Port Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Add
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310922 - https://vuldb.com/?ctiid.310922 - https://vuldb.com/?submit.584671 - https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_IP_Port_Filtering - https://www.totolink.net/
CVE ID: CVE-2025-5509 State: PUBLISHED Published: 2025-06-03T16:00:21.872Z Last Updated: 2025-06-03T17:36:32.040Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: quequnlong Products: shiyi-blog Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnr
dor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310923 - https://vuldb.com/?ctiid.310923 - https://vuldb.com/?submit.584488 - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#1file-path-traversal
CVE ID: CVE-2025-5510 State: PUBLISHED Published: 2025-06-03T16:31:04.789Z Last Updated: 2025-06-03T17:35:16.577Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: quequnlong Products: shiyi-blog Problem Types: CWE-918 Description: A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CIS
ed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310924 - https://vuldb.com/?ctiid.310924 - https://vuldb.com/?submit.584489 - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#2ssrf
CVE ID: CVE-2025-5511 State: PUBLISHED Published: 2025-06-03T17:00:19.488Z Last Updated: 2025-06-03T17:33:48.688Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: quequnlong Products: shiyi-blog Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file /dev api/app/album/photos/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addit
o the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310925 - https://vuldb.com/?ctiid.310925 - https://vuldb.com/?submit.584490 - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#31bypass-password-verification-and-directly-view-photo-albums
CVE ID: CVE-2025-5512 State: PUBLISHED Published: 2025-06-03T17:00:21.115Z Last Updated: 2025-06-03T17:30:55.107Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: quequnlong Products: shiyi-blog Problem Types: CWE-287 Description: A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
sed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310926 - https://vuldb.com/?ctiid.310926 - https://vuldb.com/?submit.584491 - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#32attackers-can-bypass-screen-lock-to-access-the-backend
CVE ID: CVE-2025-5513 State: PUBLISHED Published: 2025-06-03T17:31:04.892Z Last Updated: 2025-06-03T17:55:32.831Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: quequnlong Products: shiyi-blog Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
sed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310927 - https://vuldb.com/?ctiid.310927 - https://vuldb.com/?submit.584492 - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md - https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#4stored-cross-site-scripting