Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6255 State: PUBLISHED Published: 2025-08-28T06:42:35.703Z Last Updated: 2025-08-28T14:48:21.454Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: plugincy Products: Dynamic AJAX Product Filters for WooCommerce Problem Types: CWE-79 Description: The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50bfbde2-2ccc-483a-95f5-a2ad284fda23?source=cve - https://plugins.trac.wordpress.org/browser/dynamic-ajax-product-filters-for-woocommerce/tags/1.1.7/includes/blocks_widget_create.php#L408 - https://wordpress.org/plugins/dynamic-ajax-product-filters-for-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3350071/
CVE ID: CVE-2025-6256 State: PUBLISHED Published: 2025-08-06T01:45:12.660Z Last Updated: 2025-08-06T15:59:40.431Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dragwp Products: Flex Guten – A Multipurpose Gutenberg Blocks Plugin Problem Types: CWE-79 Description: The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca149cc0-b256-41cd-b64d-dd905bd72602?source=cve - https://plugins.trac.wordpress.org/browser/flex-guten/trunk/build/blocks/dwp-latest-posts/render.php#L107 - https://wordpress.org/plugins/flex-guten/#developers
CVE ID: CVE-2025-6257 State: PUBLISHED Published: 2025-06-20T08:22:08.666Z Last Updated: 2025-06-20T13:10:41.216Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: joostdekeijzer Products: Euro FxRef Currency Converter Problem Types: CWE-79 Description: The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e7637e96-3afe-46af-b99d-70abe9ca3e20?source=cve - https://wordpress.org/plugins/euro-fxref-currency-converter/#developers - https://github.com/joostdekeijzer/wp_eurofxref/commit/131108428f0d88dab1070048350bdd54f10c36a0 - https://plugins.trac.wordpress.org/changeset/3314562
CVE ID: CVE-2025-6258 State: PUBLISHED Published: 2025-06-26T02:06:35.531Z Last Updated: 2025-06-26T13:26:57.859Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: grosbouff Products: WP SoundSystem Problem Types: CWE-79 Description: The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f027626a-471c-48aa-add6-7597254dcfa9?source=cve - https://wordpress.org/plugins/wp-soundsystem/#developers
CVE ID: CVE-2025-6259 State: PUBLISHED Published: 2025-08-06T01:45:11.309Z Last Updated: 2025-08-06T16:04:35.873Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: geoplay9 Products: esri-map-view Problem Types: CWE-79 Description: The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67001e61-c7f5-46bc-9d32-b121ce5d6fd5?source=cve - https://wordpress.org/plugins/esri-map-view/#developers
CVE ID: CVE-2025-6260 State: PUBLISHED Published: 2025-07-24T20:53:17.534Z Last Updated: 2025-07-25T13:31:50.926Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Network Thermostat Products: X-Series WiFi thermostats Problem Types: CWE-306 Description: The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface. Additional Analyst Notes: - CISA A
set user credentials by manipulating specific elements of the embedded web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02
CVE ID: CVE-2025-6261 State: PUBLISHED Published: 2025-07-23T02:24:38.610Z Last Updated: 2025-07-23T15:47:30.431Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fleetwire Products: Fleetwire Fleet Management Problem Types: CWE-79 Description: The Fleetwire Fleet Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fleetwire_list shortcode in all versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut
henticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7593b8b5-36c0-4c68-b1f2-d505fafc3328?source=cve - https://wordpress.org/plugins/fleetwire-fleet-management/#developers
CVE ID: CVE-2025-6262 State: PUBLISHED Published: 2025-07-24T09:22:19.019Z Last Updated: 2025-07-24T13:22:16.718Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: museai Products: muse.ai video embedding Problem Types: CWE-79 Description: The muse.ai video embedding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's muse-ai shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/790d6336-0c16-4058-9ddb-d182ef56263c?source=cve - https://wordpress.org/plugins/muse-ai/#developers
CVE ID: CVE-2025-6264 State: PUBLISHED Published: 2025-06-20T02:01:33.993Z Last Updated: 2025-10-22T19:18:43.198Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Rapid7 Products: Velociraptor Problem Types: CWE-276 Description: Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional req
teClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/
CVE ID: CVE-2025-6265 State: PUBLISHED Published: 2025-07-15T01:32:10.377Z Last Updated: 2025-07-19T03:55:15.778Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: NWA50AX PRO firmware Problem Types: CWE-22 Description: A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-s
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-aps-07-15-2025
CVE ID: CVE-2025-6266 State: PUBLISHED Published: 2025-06-19T12:00:17.929Z Last Updated: 2025-10-15T13:18:37.106Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Teledyne FLIR Products: AX8 Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in Teledyne FLIR AX8 up to 1.46. Affected by this vulnerability is an unknown functionality of the file /upload.php. Performing manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out
pgrading to version 1.49.16 addresses this issue. Upgrading the affected component is recommended. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313270 - https://vuldb.com/?ctiid.313270 - https://vuldb.com/?submit.586692 - https://github.com/YZS17/CVE/blob/main/FLIR-AX8/Unauthority_file_upload_vulnerabililty.md
CVE ID: CVE-2025-6267 State: PUBLISHED Published: 2025-06-19T14:00:15.455Z Last Updated: 2025-06-23T19:31:11.315Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR) Vendors: zhilink 智互联(深圳)科技有限公司 Products: ADP Application Developer Platform 应用开发者平台 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /adpweb/a/base/barcodeDetail/. The manipulation of the argument barcodeNo/barcode/itemNo leads to sql injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure
temNo leads to sql injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313271 - https://vuldb.com/?ctiid.313271 - https://vuldb.com/?submit.586697
CVE ID: CVE-2025-6268 State: PUBLISHED Published: 2025-06-19T15:00:16.319Z Last Updated: 2025-06-23T19:31:06.192Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: Luna Products: Imaging Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Luna Imaging up to 7.5.5.6. Affected is an unknown function of the file /luna/servlet/view/search. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes:
be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313272 - https://vuldb.com/?ctiid.313272 - https://vuldb.com/?submit.592218
CVE ID: CVE-2025-6269 State: PUBLISHED Published: 2025-06-19T16:00:17.595Z Last Updated: 2025-06-23T19:30:59.733Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical was found in HDF5 up to 1.14.6. Affected by this vulnerability is the function H5C__reconstruct_cache_entry of the file H5Cimage.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313273 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313273 - https://vuldb.com/?ctiid.313273 - https://vuldb.com/?submit.592587 - https://github.com/HDFGroup/hdf5/issues/5579 - https://github.com/user-attachments/files/20626503/reproduce.tar.gz
CVE ID: CVE-2025-6270 State: PUBLISHED Published: 2025-06-19T16:31:06.224Z Last Updated: 2025-06-23T19:30:54.188Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, has been found in HDF5 up to 1.14.6. Affected by this issue is the function H5FS__sect_find_node of the file H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313274 - https://vuldb.com/?ctiid.313274 - https://vuldb.com/?submit.592588 - https://github.com/HDFGroup/hdf5/issues/5580 - https://github.com/user-attachments/files/20626642/reproduce.tar.gz
CVE ID: CVE-2025-6271 State: PUBLISHED Published: 2025-06-19T17:31:06.353Z Last Updated: 2025-06-23T19:30:48.937Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: swftools Problem Types: CWE-125, CWE-119 Description: A vulnerability, which was classified as problematic, was found in swftools up to 0.9.2. This affects the function wav_convert2mono in the library lib/wav.c of the component wav2swf. The manipulation leads to out-of-bounds read. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3132
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313275 - https://vuldb.com/?ctiid.313275 - https://vuldb.com/?submit.593005 - https://github.com/swftools/swftools/issues/239 - https://github.com/user-attachments/files/19415662/wav2swf_crash.txt
CVE ID: CVE-2025-6272 State: PUBLISHED Published: 2025-06-19T18:00:11.510Z Last Updated: 2025-06-23T19:30:43.645Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: wasm3 Problem Types: CWE-787, CWE-119 Description: A vulnerability has been found in wasm3 0.5.0 and classified as problematic. This vulnerability affects the function MarkSlotAllocated of the file source/m3_compile.c. The manipulation leads to out-of-bounds write. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313276 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313276 - https://vuldb.com/?ctiid.313276 - https://vuldb.com/?submit.593008 - https://github.com/wasm3/wasm3/issues/531 - https://github.com/user-attachments/files/19516600/wasm3_crash.txt
CVE ID: CVE-2025-6273 State: PUBLISHED Published: 2025-06-19T18:31:06.692Z Last Updated: 2025-06-23T19:30:37.748Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: WebAssembly Products: wabt Problem Types: CWE-617 Description: A vulnerability was found in WebAssembly wabt up to 1.0.37 and classified as problematic. This issue affects the function LogOpcode of the file src/binary-reader-objdump.cc. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer expl
ublic and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains that this issue might not affect "real world wasm programs". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313277 - https://vuldb.com/?ctiid.313277 - https://vuldb.com/?submit.593010 - https://github.com/WebAssembly/wabt/issues/2574 - https://github.com/user-attachments/files/19529411/wabt_crash.txt
CVE ID: CVE-2025-6274 State: PUBLISHED Published: 2025-06-19T19:00:16.150Z Last Updated: 2025-06-23T19:30:32.208Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: WebAssembly Products: wabt Problem Types: CWE-400, CWE-404 Description: A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been classified as problematic. Affected is the function OnDataCount of the file src/interp/binary-reader-interp.cc. The manipulation leads to resource consumption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer beca
the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313278 - https://vuldb.com/?ctiid.313278 - https://vuldb.com/?submit.593016 - https://github.com/WebAssembly/wabt/issues/2598 - https://github.com/user-attachments/files/20191325/wabt_crash_4.txt
CVE ID: CVE-2025-6275 State: PUBLISHED Published: 2025-06-19T19:31:06.618Z Last Updated: 2025-06-23T19:30:26.829Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: WebAssembly Products: wabt Problem Types: CWE-416, CWE-119 Description: A vulnerability was found in WebAssembly wabt up to 1.0.37. It has been declared as problematic. Affected by this vulnerability is the function GetFuncOffset of the file src/interp/binary-reader-interp.cc. The manipulation leads to use after free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was d
. The exploit has been disclosed to the public and may be used. A similar issue reported during the same timeframe was disputed by the code maintainer because it might not affect "real world wasm programs". Therefore, this entry might get disputed as well in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313279 - https://vuldb.com/?ctiid.313279 - https://vuldb.com/?submit.593017 - https://github.com/WebAssembly/wabt/issues/2614 - https://github.com/user-attachments/files/20623626/wabt_crash_5.txt
CVE ID: CVE-2025-6276 State: PUBLISHED Published: 2025-06-19T20:00:12.445Z Last Updated: 2025-06-23T19:30:21.538Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Brilliance Products: Golden Link Secondary System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Brilliance Golden Link Secondary System up to 20250609. It has been rated as critical. Affected by this issue is some unknown functionality of the file /storagework/rentTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: -
ack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313280 - https://vuldb.com/?ctiid.313280 - https://vuldb.com/?submit.593067 - https://github.com/eeeeeekkkkkkkk/POC/blob/main/%E9%BB%84%E9%87%91%E9%80%9A%E4%BA%8C%E7%BA%A7%E7%B3%BB%E7%BB%9F%E4%B8%89%E4%BB%A3%E7%AE%A1%E7%90%86%E7%AB%AF%E7%B3%BB%E7%BB%9FrentTakeInfoPage%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5.md
CVE ID: CVE-2025-6277 State: PUBLISHED Published: 2025-06-19T20:29:32.333Z Last Updated: 2025-06-23T19:30:16.622Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Brilliance Products: Golden Link Secondary System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown part of the file /storagework/custTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric