Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311161 - https://vuldb.com/?ctiid.311161 - https://vuldb.com/?submit.590094 - https://github.com/byxs0x0/cve2/blob/main/530/2.md - https://www.totolink.net/
CVE ID: CVE-2025-5673 State: PUBLISHED Published: 2025-06-17T01:44:11.281Z Last Updated: 2025-06-17T13:37:48.627Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: pr-gateway Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-89 Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter in all versions up to, and including, 8.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to
n the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65b48fc0-27fd-4a37-afb8-2213ca0d4746?source=cve - https://plugins.trac.wordpress.org/browser/blog2social/tags/8.4.4/includes/PRG/Post/Item.php#L50
CVE ID: CVE-2025-5674 State: PUBLISHED Published: 2025-06-05T18:00:12.702Z Last Updated: 2025-06-05T19:21:02.107Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Patient Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file urinalysis_form.php. The manipulation of the argument urinalysis_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311162 - https://vuldb.com/?ctiid.311162 - https://vuldb.com/?submit.590120 - https://github.com/yuyuchenchen/vuln-pdf/blob/main/0603CVE.pdf - https://code-projects.org/
CVE ID: CVE-2025-5675 State: PUBLISHED Published: 2025-06-05T18:31:05.531Z Last Updated: 2025-06-05T19:14:13.273Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Teacher Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Teacher Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /trms/admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311163 - https://vuldb.com/?ctiid.311163 - https://vuldb.com/?submit.590124 - https://github.com/modestHonK/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-5676 State: PUBLISHED Published: 2025-06-05T18:31:07.526Z Last Updated: 2025-06-05T19:07:28.549Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311164 - https://vuldb.com/?ctiid.311164 - https://vuldb.com/?submit.590134 - https://github.com/hyx123123/cve/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-5677 State: PUBLISHED Published: 2025-06-05T19:00:17.394Z Last Updated: 2025-06-05T19:18:21.920Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=save_application. The manipulation of the argument position_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311165 - https://vuldb.com/?ctiid.311165 - https://vuldb.com/?submit.590135 - https://github.com/hyx123123/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-5678 State: PUBLISHED Published: 2025-07-09T01:44:51.406Z Last Updated: 2025-07-09T16:59:39.776Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web s
. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc712f6b-f11b-4731-8f89-0044830400d6?source=cve - https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.8/includes/blocks/class-kadence-blocks-countdown-block.php#L605 - https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.5.8/includes/assets/js/kb-countdown.min.js
CVE ID: CVE-2025-5679 State: PUBLISHED Published: 2025-06-05T19:00:23.242Z Last Updated: 2025-06-05T19:14:29.178Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Shenzhen Dashi Tongzhou Information Technology Products: AgileBPM Problem Types: CWE-502, CWE-20 Description: A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStrByFreeMarker of the file /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. The manipulation of the argument str leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may
to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311166 - https://vuldb.com/?ctiid.311166 - https://vuldb.com/?submit.585127 - https://gitee.com/agile-bpm/agile-bpm-basic/issues/ICAQWG
CVE ID: CVE-2025-5680 State: PUBLISHED Published: 2025-06-05T19:31:09.376Z Last Updated: 2025-06-05T19:53:46.399Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Shenzhen Dashi Tongzhou Information Technology Products: AgileBPM Problem Types: CWE-502, CWE-20 Description: A vulnerability classified as critical was found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected by this vulnerability is the function executeScript of the file /src/main/java/com/dstz/sys/rest/controller/SysScriptController.java of the component Groovy Script Handler. The manipulation of the argument script leads to deserialization. The attack can be launched remotely. The explo
andler. The manipulation of the argument script leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311167 - https://vuldb.com/?ctiid.311167 - https://vuldb.com/?submit.585108 - https://gitee.com/agile-bpm/agile-bpm-basic/issues/ICAPT5
CVE ID: CVE-2025-5681 State: PUBLISHED Published: 2025-07-21T11:05:46.927Z Last Updated: 2025-07-21T12:16:13.221Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Turtek Software Products: Eyotek Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers.This issue affects Eyotek: before 23.06.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0163
CVE ID: CVE-2025-5682 State: PUBLISHED Published: 2025-06-26T13:33:03.887Z Last Updated: 2025-06-26T14:12:10.936Z Vendors: Drupal Products: Klaro Cookie & Consent Management Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-080
CVE ID: CVE-2025-5683 State: PUBLISHED Published: 2025-06-05T05:31:13.926Z Last Updated: 2025-06-05T17:54:16.536Z Vendors: The Qt Company Products: Qt Description: When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issues.oss-fuzz.com/issues/415350704 - https://codereview.qt-project.org/c/qt/qtimageformats/+/644548
CVE ID: CVE-2025-5684 State: PUBLISHED Published: 2025-07-29T19:42:33.941Z Last Updated: 2025-07-29T20:00:46.035Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Problem Types: CWE-79 Description: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-template` DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above
ization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7dded505-8968-4ed2-8883-42a3ec50155c?source=cve - https://plugins.trac.wordpress.org/browser/metform/tags/3.9.9/public/assets/js/app.js
CVE ID: CVE-2025-5685 State: PUBLISHED Published: 2025-06-05T20:00:18.106Z Last Updated: 2025-06-06T15:14:37.779Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: CH22 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, was found in Tenda CH22 1.0.0.1. This affects the function formNatlimit of the file /goform/Natlimit. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311169 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311169 - https://vuldb.com/?ctiid.311169 - https://vuldb.com/?submit.590153 - https://github.com/xubeining/Cve_report/blob/main/A%20remote%20code%20execution%20vulnerability%20in%20the%20router%20CH22%20V1.0.0.1%20manufactured%20by%20Shenzhen%20Jixiangtengda%20Technology%20Co.%2C%20Ltd1.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-5686 State: PUBLISHED Published: 2025-06-06T06:42:55.081Z Last Updated: 2025-06-06T16:08:15.547Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: andreyk Products: Paged Gallery Problem Types: CWE-80 Description: The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc7dbdbe-fd0f-404b-9f9f-06e942f60a73?source=cve - https://plugins.trac.wordpress.org/browser/paged-gallery/trunk/paged-gallery.php#L64
CVE ID: CVE-2025-5687 State: PUBLISHED Published: 2025-06-11T12:07:49.739Z Last Updated: 2025-06-14T03:56:21.196Z Vendors: Mozilla Products: Mozilla VPN 2.28.0 Problem Types: Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below. Description: A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1953736 - https://www.mozilla.org/security/advisories/mfsa2025-48/
CVE ID: CVE-2025-5688 State: PUBLISHED Published: 2025-06-04T17:09:54.718Z Last Updated: 2025-10-14T18:05:10.779Z Vendors: Amazon Products: FreeRTOS Problem Types: CWE-787 Description: We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled. Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-012/ - https://github.com/FreeRTOS/F
richment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-012/ - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.2 - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-5x4f-fvv8-wr65
CVE ID: CVE-2025-5689 State: PUBLISHED Published: 2025-06-16T11:37:12.230Z Last Updated: 2025-06-17T17:27:04.238Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Canonical Products: authd Description: A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ubuntu/authd/security/advisories/GHSA-g8qw-mgjx-rwjr
CVE ID: CVE-2025-5690 State: PUBLISHED Published: 2025-06-04T21:34:47.358Z Last Updated: 2025-06-05T18:10:03.492Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: DALIBO Products: PostgreSQL Anonymizer Problem Types: CWE-200 Description: PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pg_dump. This problem occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitl
. The problem is resolved in version 2.2.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/531
CVE ID: CVE-2025-5692 State: PUBLISHED Published: 2025-07-02T02:03:53.387Z Last Updated: 2025-08-27T13:46:51.184Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: smackcoders Products: Lead Form Data Collection to CRM Problem Types: CWE-862 Description: The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned spec
bscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26404b5c-a0f2-4223-be61-1f03873666fb?source=cve - https://plugins.trac.wordpress.org/browser/wp-leads-builder-any-crm/trunk/includes/Functions.php#L423 - https://wordpress.org/plugins/wp-leads-builder-any-crm/ - https://plugins.trac.wordpress.org/changese
nctions.php#L423 - https://wordpress.org/plugins/wp-leads-builder-any-crm/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3319750%40wp-leads-builder-any-crm&new=3319750%40wp-leads-builder-any-crm&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5693 State: PUBLISHED Published: 2025-06-05T20:00:21.447Z Last Updated: 2025-06-05T20:11:46.312Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bwdates-report-result.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Anal
tion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311209 - https://vuldb.com/?ctiid.311209 - https://vuldb.com/?submit.590183 - https://github.com/f1rstb100d/myCVE/issues/53 - https://phpgurukul.com/
CVE ID: CVE-2025-5694 State: PUBLISHED Published: 2025-06-05T20:31:06.604Z Last Updated: 2025-06-05T20:44:03.520Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Human Metapneumovirus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CI
k may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311210 - https://vuldb.com/?ctiid.311210 - https://vuldb.com/?submit.590184 - https://github.com/f1rstb100d/myCVE/issues/54 - https://phpgurukul.com/
CVE ID: CVE-2025-5695 State: PUBLISHED Published: 2025-06-05T21:00:21.192Z Last Updated: 2025-10-15T13:18:42.245Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Teledyne FLIR Products: AX8 Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. This impacts the function subscribe_to_spot/subscribe_to_delta/subscribe_to_alarm of the file /usr/www/application/models/subscriptions.php of the component Backend. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue.
motely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.49.16 will fix this issue. It is suggested to upgrade the affected component. The vendor points out: "FLIR AX8 internal web site has been refactored to be able to handle the reported vulnerabilities." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311211 - https://vuldb.com/?ctiid.311211 - https://vuldb.com/?submit.585715 - https://vuldb.com/?submit.584532 - https://vuldb.com/?submit.585716 - https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_spot()%20in%20FLIR%20AX8.md - https://github.com/YZS17/CVE/blob/main/Command
jection%20vulnerability%20in%20subscribe_to_spot()%20in%20FLIR%20AX8.md - https://github.com/YZS17/CVE/blob/main/Command%20injection%20vulnerability%20in%20subscribe_to_delta()%20in%20FLIR%20AX8.md - https://flir.custhelp.com/app/account/fl_download_software
CVE ID: CVE-2025-5696 State: PUBLISHED Published: 2025-06-05T21:31:04.964Z Last Updated: 2025-06-09T14:56:47.472Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Brilliance Products: Golden Link Secondary System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Brilliance Golden Link Secondary System up to 20250424. This vulnerability affects unknown code of the file /storagework/rentChangeCheckInfoPage.htm. The manipulation of the argument clientname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311212 - https://vuldb.com/?ctiid.311212 - https://vuldb.com/?submit.588316 - https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Astorageworkrent-ChangeCheckInfoPage.htm.md
CVE ID: CVE-2025-5697 State: PUBLISHED Published: 2025-06-05T21:31:06.730Z Last Updated: 2025-06-09T14:55:51.319Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Brilliance Products: Golden Link Secondary System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown processing of the file /reprotframework/tcCustDeferPosiQuery.htm. The manipulation of the argument custTradeId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul