Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-13300 State: PUBLISHED Published: 2025-11-17T20:32:05.863Z Last Updated: 2025-11-17T20:49:54.222Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Web-Based Internet Laboratory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected is an unknown function of the file /settings/controller.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332640 - https://vuldb.com/?ctiid.332640 - https://vuldb.com/?submit.691790 - https://github.com/f14g-orz/CVE/issues/6 - https://itsourcecode.com/
CVE ID: CVE-2025-13301 State: PUBLISHED Published: 2025-11-17T21:02:06.509Z Last Updated: 2025-11-17T21:28:56.955Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Web-Based Internet Laboratory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /subject/controller.php. The manipulation results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
motely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332641 - https://vuldb.com/?ctiid.332641 - https://vuldb.com/?submit.691793 - https://github.com/f14g-orz/CVE/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2025-13302 State: PUBLISHED Published: 2025-11-17T21:32:05.929Z Last Updated: 2025-11-17T21:49:59.914Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Courier Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in code-projects Courier Management System 1.0. This affects an unknown part of the file /add-new-officer.php. Such manipulation of the argument ManagerName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332643 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332643 - https://vuldb.com/?ctiid.332643 - https://vuldb.com/?submit.691791 - https://github.com/labi1106/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-13303 State: PUBLISHED Published: 2025-11-17T22:02:08.138Z Last Updated: 2025-11-18T16:36:53.948Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Courier Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in code-projects Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /search-edit.php. This manipulation of the argument Consignment causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
icly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332642 - https://vuldb.com/?ctiid.332642 - https://vuldb.com/?submit.691792 - https://github.com/labi1106/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-13304 State: PUBLISHED Published: 2025-11-17T22:32:07.051Z Last Updated: 2025-11-18T16:36:42.638Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DWR-M920, DWR-M921, DWR-M960, DWR-M961, DIR-825M Problem Types: CWE-120, CWE-119 Description: A security flaw has been discovered in D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961 and DIR-825M 1.01.07/1.1.47. This vulnerability affects unknown code of the file /boafrm/formPingDiagnosticRun. Performing manipulation of the argument host results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Note
ack may be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332644 - https://vuldb.com/?ctiid.332644 - https://vuldb.com/?submit.691808 - https://vuldb.com/?submit.691810 - https://vuldb.com/?submit.691812 - https://vuldb.com/?submit.691817 - https://vuldb.com/?submit.691821 - https://github.com/LX-LX88/cve/issues/11 - https://www.dlink.com/
CVE ID: CVE-2025-13305 State: PUBLISHED Published: 2025-11-17T23:02:06.147Z Last Updated: 2025-11-18T14:41:07.089Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DWR-M920, DWR-M921, DWR-M960, DIR-822K, DIR-825M Problem Types: CWE-120, CWE-119 Description: A weakness has been identified in D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K and DIR-825M 1.01.07. This issue affects some unknown processing of the file /boafrm/formTracerouteDiagnosticRun. Executing manipulation of the argument host can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst
may be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332645 - https://vuldb.com/?ctiid.332645 - https://vuldb.com/?submit.691809 - https://vuldb.com/?submit.691816 - https://vuldb.com/?submit.693784 - https://vuldb.com/?submit.693806 - https://vuldb.com/?submit.695424 - https://github.com/LX-LX88/cve/issues/12 - https://www.dlink.com/
CVE ID: CVE-2025-13306 State: PUBLISHED Published: 2025-11-17T23:32:06.249Z Last Updated: 2025-11-18T16:36:07.550Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DWR-M920, DWR-M921, DIR-822K, DIR-825M Problem Types: CWE-77, CWE-74 Description: A security vulnerability has been detected in D-Link DWR-M920, DWR-M921, DIR-822K and DIR-825M 1.1.5. Impacted is the function system of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
le. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332646 - https://vuldb.com/?ctiid.332646 - https://vuldb.com/?submit.691813 - https://vuldb.com/?submit.693805 - https://vuldb.com/?submit.693807 - https://vuldb.com/?submit.695426 - https://github.com/LX-LX88/cve/issues/15 - https://www.dlink.com/
CVE ID: CVE-2025-13310 State: REJECTED Published: N/A Last Updated: 2025-11-17T14:50:48.253Z Description: No description available.
CVE ID: CVE-2025-13311 State: PUBLISHED Published: 2025-11-25T07:28:26.238Z Last Updated: 2025-11-25T07:28:26.238Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: sigalitam Products: Just Highlight Problem Types: CWE-79 Description: The Just Highlight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Highlight Color' setting in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin's settings page. Ref
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin's settings page. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d21187bc-5bd0-49b9-9ef2-6654263cd93c?source=cve - https://plugins.trac.wordpress.org/browser/just-highlight/trunk/just-highlight.php#L169 - https://plugins.trac.wordpress.org/browser/just-highlight/tags/1.0.3/just-highlight.php#L169
CVE ID: CVE-2025-13315 State: PUBLISHED Published: 2025-11-19T17:41:36.996Z Last Updated: 2025-11-19T18:20:50.718Z Vendors: Lynxtechnology Products: Twonky Server Problem Types: CWE-420 Description: Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/
CVE ID: CVE-2025-13316 State: PUBLISHED Published: 2025-11-19T17:53:42.934Z Last Updated: 2025-11-19T18:19:43.388Z Vendors: Lynxtechnology Products: Twonky Server Problem Types: CWE-321 Description: Twonky Server 8.5.2 on Linux and Windows is vulnerable to a cryptographic flaw, use of hard-coded cryptographic keys. An attacker with knowledge of the encrypted administrator password can decrypt the value with static keys to view the plain text password and gain administrator-level access to Twonky Server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/
CVE ID: CVE-2025-13317 State: PUBLISHED Published: 2025-11-22T07:29:18.875Z Last Updated: 2025-11-24T19:30:08.188Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: codepeople Products: Appointment Booking Calendar Problem Types: CWE-862 Description: The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes i
yment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/638217c4-7a37-49e4-8660-5510ace692ec?source=cve - https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.96/inc/cpabc_apps_go.inc.php#L14 - https://plugins.trac.wordpress.org/browser/appointment-bo
t-booking-calendar/tags/1.3.96/inc/cpabc_apps_go.inc.php#L14 - https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.96/inc/cpabc_apps_go.inc.php#L363 - https://plugins.trac.wordpress.org/browser/appointment-booking-calendar/tags/1.3.96/inc/cpabc_apps_go.inc.php#L476 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399113%40appointment-booking-calendar&new=3399113%40appointment-booking-calendar&sfp_email=&sfph_mail=
CVE ID: CVE-2025-13318 State: PUBLISHED Published: 2025-11-22T08:30:29.623Z Last Updated: 2025-11-24T19:35:04.659Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: codepeople Products: Booking Calendar Contact Form Problem Types: CWE-862 Description: The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and bypass payment requirements via the 'dex_bccf_ipn' parameter. Addit
icated attackers to arbitrarily confirm bookings and bypass payment requirements via the 'dex_bccf_ipn' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83b0ae2c-6b08-4b71-a728-c60722ec20c7?source=cve - https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/tags/1.2.59/dex_bccf.php#L1409 - https://plugins.trac.wordpress.org/browser/booking-calendar-contact-form/trunk/dex_bccf.php#L1409 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399906%40booking-calendar-contact-form&new=3399906%40booking-calendar-contact-form&sfp_email=&sfph_mail=
CVE ID: CVE-2025-13319 State: PUBLISHED Published: 2025-11-17T16:37:40.377Z Last Updated: 2025-11-17T16:46:47.902Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Nettec AS Products: Digi On-Prem Manager Problem Types: CWE-20, CWE-89 Description: An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dom.nettec.no/security-advisories/DOM-25-001/
CVE ID: CVE-2025-13322 State: PUBLISHED Published: 2025-11-21T07:31:46.308Z Last Updated: 2025-11-21T14:57:40.598Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: husainali52 Products: WP AUDIO GALLERY Problem Types: CWE-73 Description: The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and a
efore passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when critical files like wp-config.php are deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/101675ae-88cf-42fc-b9ea-5dd37cdf7464?source=cve - https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L150 - https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L513 - https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.
p-audio-gallery/tags/2.0/wp-audio-gallery.php#L513 - https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L607
CVE ID: CVE-2025-13323 State: PUBLISHED Published: 2025-11-18T00:02:09.376Z Last Updated: 2025-11-18T16:35:55.240Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Pizza Ordering System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332
public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332662 - https://vuldb.com/?ctiid.332662 - https://vuldb.com/?submit.691844 - https://github.com/daojian1/Simple-Pizza-Ordering-System_V1.0_003 - https://code-projects.org/
CVE ID: CVE-2025-13325 State: PUBLISHED Published: 2025-11-18T00:02:12.022Z Last Updated: 2025-11-18T16:35:46.697Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /enrollment_edit1.php. Executing manipulation of the argument en_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
ublicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332669 - https://vuldb.com/?ctiid.332669 - https://vuldb.com/?submit.691929 - https://github.com/chenxiyue-2006/CVE/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-13343 State: PUBLISHED Published: 2025-11-18T11:32:06.222Z Last Updated: 2025-11-18T21:24:53.026Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Interview Management System Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manipulation of the argument Question results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332761 - https://vuldb.com/?ctiid.332761 - https://vuldb.com/?submit.691936 - https://github.com/puppytgyh/-CVE/issues/11 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13344 State: PUBLISHED Published: 2025-11-18T12:02:05.989Z Last Updated: 2025-11-18T21:32:29.790Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Train Station Ticketing System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment:
exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332762 - https://vuldb.com/?ctiid.332762 - https://vuldb.com/?submit.691940 - https://github.com/puppytgyh/-CVE/issues/14 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13345 State: PUBLISHED Published: 2025-11-18T12:02:08.105Z Last Updated: 2025-11-18T18:23:48.029Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Train Station Ticketing System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_ticket. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332763 - https://vuldb.com/?ctiid.332763 - https://vuldb.com/?submit.691943 - https://github.com/puppytgyh/-CVE/issues/15 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13346 State: PUBLISHED Published: 2025-11-18T12:32:06.129Z Last Updated: 2025-11-18T20:24:38.427Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Train Station Ticketing System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Train Station Ticketing System 1.0. This affects an unknown part of the file /ajax.php?action=save_station. Performing manipulation of the argument id/station results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332764
w public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332764 - https://vuldb.com/?ctiid.332764 - https://vuldb.com/?submit.691944 - https://github.com/puppytgyh/-CVE/issues/16 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13347 State: PUBLISHED Published: 2025-11-18T13:02:05.198Z Last Updated: 2025-11-18T20:21:19.715Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Train Station Ticketing System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in SourceCodester Train Station Ticketing System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=save_user. Executing manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3327
n published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332765 - https://vuldb.com/?ctiid.332765 - https://vuldb.com/?submit.691945 - https://github.com/puppytgyh/-CVE/issues/17 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13349 State: PUBLISHED Published: 2025-11-18T14:02:06.819Z Last Updated: 2025-11-18T14:20:14.687Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Student Grades Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of the component Add New Grade Page. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
he attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332766 - https://vuldb.com/?ctiid.332766 - https://vuldb.com/?submit.692065 - https://medium.com/@ankitkaushal43731/title-student-grades-management-system-stored-xss-authenticated-in-grades-php-remarks-field-d9625243df06 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13357 State: PUBLISHED Published: 2025-11-21T15:02:27.081Z Last Updated: 2025-11-24T18:00:33.469Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: HashiCorp Products: Tooling Problem Types: CWE-1188 Description: Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
2025-13357, is fixed in Vault Terraform Provider v5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822