Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1796 State: PUBLISHED Published: 2025-03-20T10:08:46.897Z Last Updated: 2025-10-15T12:50:50.782Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-338 Description: A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses `random.randint` for this purpose, which is not suitable for cryptographic use and can be cracked. An attacker with access to workflow tools can extract the PRNG output and predict future p
aphic use and can be cracked. An attacker with access to workflow tools can extract the PRNG output and predict future password reset codes, leading to a complete compromise of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a60f3039-5394-4e22-8de7-a7da9c6a6e00
CVE ID: CVE-2025-1797 State: PUBLISHED Published: 2025-03-01T14:31:04.156Z Last Updated: 2025-03-03T20:36:21.488Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Hunan Zhonghe Baiyi Information Technology Products: Baiyiyun Asset Management and Operations System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System up to 20250217. Affected by this issue is some unknown functionality of the file /wuser/anyUserBoundHouse.php. The manipulation of the argument huid leads to sql injection. The attack may be launched remotely. The exploit
ouse.php. The manipulation of the argument huid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298028 - https://vuldb.com/?ctiid.298028 - https://vuldb.com/?submit.502649 - https://github.com/chichi24-ver/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-1798 State: PUBLISHED Published: 2025-03-25T06:00:14.685Z Last Updated: 2025-03-25T13:36:41.604Z Vendors: Unknown Products: design-comuni-wordpress-theme Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c5c30191-857c-419c-9096-d1fe14d34eaa/
CVE ID: CVE-2025-1799 State: PUBLISHED Published: 2025-03-01T17:31:04.651Z Last Updated: 2025-03-03T20:35:03.718Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Zorlan Products: SkyCaiji Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, was found in Zorlan SkyCaiji 2.9. This affects the function previewAction of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the argument data leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298029
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298029 - https://vuldb.com/?ctiid.298029 - https://vuldb.com/?submit.502650 - https://github.com/sheratan4/cve/issues/6
CVE ID: CVE-2025-1800 State: PUBLISHED Published: 2025-03-01T18:00:05.956Z Last Updated: 2025-03-05T02:45:15.673Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000 Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical. This vulnerability affects the function get_ip_addr_details of the file /view/vpn/sxh_vpn/sxh_vpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument ethname leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no lon
. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.298030 - https://vuldb.com/?ctiid.298030 - https://vuldb.com/?submit.502971 - https://github.com/sjwszt/CVE/blob/main/CVE_1.md - https://www.dlink.com/
CVE ID: CVE-2025-1801 State: PUBLISHED Published: 2025-03-03T15:03:15.439Z Last Updated: 2025-11-20T07:25:00.512Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-362 Description: A flaw was found in the Ansible aap-gateway. Concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confide
ed user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:1954 - https://access.redhat.com/security/cve/CVE-2025-1801 - https://bugzilla.redhat.com/show_bug.cgi?id=2349081
CVE ID: CVE-2025-1802 State: PUBLISHED Published: 2025-03-20T11:11:27.417Z Last Updated: 2025-03-20T13:12:57.440Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘marker_title’, 'notification_content', and 'stt_button_text' parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary
caping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68530904-22d2-4228-b9f2-76f5ee1fd541?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/extensions/scroll-to-top/assets/js/htmega-scroll-to-top.js - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_googlemap.php - https://plugins.trac.wo
s.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_googlemap.php - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/trunk/includes/widgets/htmega_notify.php - https://plugins.trac.wordpress.org/changeset/3249106/ - https://plugins.trac.wordpress.org/changeset/3257530/
CVE ID: CVE-2025-1803 State: REJECTED Published: N/A Last Updated: 2025-03-01T00:06:48.900Z Description: No description available.
CVE ID: CVE-2025-1804 State: PUBLISHED Published: 2025-03-01T18:31:04.185Z Last Updated: 2025-03-07T19:52:42.595Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Blizzard Products: Battle.Net Problem Types: CWE-427, CWE-426 Description: A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor assigns this issue a low risk level. Additional Anal
rather high. The exploitation is known to be difficult. The vendor assigns this issue a low risk level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298040 - https://vuldb.com/?ctiid.298040 - https://vuldb.com/?submit.485034
CVE ID: CVE-2025-1805 State: PUBLISHED Published: 2025-04-02T12:53:08.960Z Last Updated: 2025-04-03T19:11:47.221Z Vendors: HACHI Products: Crypt::Salt Problem Types: CWE-338 Description: Crypt::Salt for Perl version 0.01 uses insecure rand() function when generating salts for cryptographic purposes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://metacpan.org/release/HACHI/Crypt-Salt-0.01/source/lib/Crypt/Salt.pm#L76 - https://perldoc.perl.org/functions/rand - https://security.metacpan.org/docs/guides/random-data-for-security.html
CVE ID: CVE-2025-1806 State: PUBLISHED Published: 2025-03-01T23:31:04.940Z Last Updated: 2025-04-09T12:06:27.362Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Eastnets Products: PaymentSafe Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as problematic, has been found in Eastnets PaymentSafe 2.5.26.0. Affected by this issue is some unknown functionality of the file /Default.aspx of the component URL Handler. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.27.0 is able to address this issue. Additi
it has been disclosed to the public and may be used. Upgrading to version 2.5.27.0 is able to address this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298064 - https://vuldb.com/?ctiid.298064 - https://vuldb.com/?submit.502539 - https://drive.google.com/file/d/1WT5mJwL9NvKxBLIIj7TDbeAq6dchs5Gk/view?usp=sharing
CVE ID: CVE-2025-1807 State: PUBLISHED Published: 2025-03-02T00:00:08.805Z Last Updated: 2025-04-09T12:06:24.626Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Eastnets Products: PaymentSafe Problem Types: CWE-80, CWE-74 Description: A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of the component Edit Manual Reply Handler. The manipulation of the argument Title leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.5.27.0 is able to address this issue. Addit
oit has been disclosed to the public and may be used. Upgrading to version 2.5.27.0 is able to address this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298065 - https://vuldb.com/?ctiid.298065 - https://vuldb.com/?submit.502668 - https://drive.google.com/file/d/1-4BwJxzKUdVRsi6PYh68mKzeIPAqug1Q/view
CVE ID: CVE-2025-1808 State: PUBLISHED Published: 2025-03-02T00:31:04.998Z Last Updated: 2025-03-03T20:32:35.762Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Pixsoft Products: E-Saphira Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login&tipo=1 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Add
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298066 - https://vuldb.com/?ctiid.298066 - https://vuldb.com/?submit.503260 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1809 State: PUBLISHED Published: 2025-03-02T06:00:10.691Z Last Updated: 2025-03-03T20:31:59.195Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Pixsoft Products: Sol Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?act=login&submit=1&evento=0&pixrnd=0125021816444195731041 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
iated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298067 - https://vuldb.com/?ctiid.298067 - https://vuldb.com/?submit.503275 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1810 State: PUBLISHED Published: 2025-03-02T07:00:08.129Z Last Updated: 2025-03-03T21:43:44.340Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Pixsoft Products: Vivaz Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Pixsoft Vivaz 6.0.11. It has been classified as problematic. Affected is an unknown function of the file /servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231 of the component Login Endpoint. The manipulation of the argument sistema leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disc
k remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298068 - https://vuldb.com/?ctiid.298068 - https://vuldb.com/?submit.503323 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1811 State: PUBLISHED Published: 2025-03-02T08:31:04.374Z Last Updated: 2025-03-03T20:31:15.465Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: AT Software Solutions Products: ATSVD Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.aspx of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.2 is able to address this issue.
The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.2 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298069 - https://vuldb.com/?ctiid.298069 - https://vuldb.com/?submit.504099 - https://github.com/yago3008/cves
CVE ID: CVE-2025-1812 State: PUBLISHED Published: 2025-03-02T09:00:10.612Z Last Updated: 2025-03-03T20:30:27.845Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zj1983 Products: zz Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in zj1983 zz up to 2024-08. Affected is the function GetUserOrg of the file com/futvan/z/framework/core/SuperZ.java. The manipulation of the argument userId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA A
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298080 - https://vuldb.com/?ctiid.298080 - https://vuldb.com/?submit.504273 - https://github.com/A7cc/cve/issues/3
CVE ID: CVE-2025-1813 State: PUBLISHED Published: 2025-03-02T10:00:12.614Z Last Updated: 2025-03-03T21:42:51.879Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: zj1983 Products: zz Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic was found in zj1983 zz up to 2024-08. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
ure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298081 - https://vuldb.com/?ctiid.298081 - https://vuldb.com/?submit.504281 - https://www.yuque.com/u123456789-6sobi/cdgcbq/icmicuv9nkkvixb4?singleDoc#%20%E3%80%8AZZ_CSRF%E3%80%8B
CVE ID: CVE-2025-1814 State: PUBLISHED Published: 2025-03-02T11:00:09.784Z Last Updated: 2025-03-03T20:29:12.616Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC6 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is some unknown functionality of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298082 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298082 - https://vuldb.com/?ctiid.298082 - https://vuldb.com/?submit.506532 - https://github.com/Raining-101/IOT_cve/blob/main/ac6.md_goform_WifiExtraSet.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-1815 State: PUBLISHED Published: 2025-03-02T12:00:08.869Z Last Updated: 2025-03-03T20:28:30.500Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: pbrong Products: hrms Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as critical, was found in pbrong hrms up to 1.0.1. This affects the function HrmsDB of the file \resource\resource.go. The manipulation of the argument user_cookie leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298083 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298083 - https://vuldb.com/?ctiid.298083 - https://vuldb.com/?submit.506544 - https://github.com/A7cc/cve/issues/4 - https://github.com/A7cc/cve/issues/4#issue-2877111776
CVE ID: CVE-2025-1816 State: PUBLISHED Published: 2025-03-02T14:00:07.515Z Last Updated: 2025-03-03T20:12:37.842Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: n/a Products: FFmpeg Problem Types: CWE-401, CWE-404 Description: A vulnerability classified as problematic has been found in FFmpeg up to 6e26f57f672b05e7b8b052007a83aef99dc81ccb. This affects the function audio_element_obu of the file libavformat/iamf_parse.c of the component IAMF File Handler. The manipulation of the argument num_parameters leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd26
emotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 0526535cd58444dd264e810b2f3348b4d96cff3b. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298089 - https://vuldb.com/?ctiid.298089 - https://vuldb.com/?submit.506575 - https://trac.ffmpeg.org/ticket/11475 - https://trac.ffmpeg.org/attachment/ticket/11475/poc - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0526535cd58444dd264e810b2f3348b4d96cff3b - https://ffmpeg.org/
CVE ID: CVE-2025-1817 State: PUBLISHED Published: 2025-03-02T14:31:04.431Z Last Updated: 2025-03-03T21:28:06.320Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: Mini-Tmall Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Mini-Tmall up to 20250211. This vulnerability affects unknown code of the file /admin of the component Admin Name Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298090 - https://vuldb.com/?ctiid.298090 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298090 - https://vuldb.com/?ctiid.298090 - https://vuldb.com/?submit.504302 - https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/XSS.md
CVE ID: CVE-2025-1818 State: PUBLISHED Published: 2025-03-02T16:00:09.825Z Last Updated: 2025-03-03T20:10:48.782Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zj1983 Products: zz Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.upload. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
osed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298091 - https://vuldb.com/?ctiid.298091 - https://vuldb.com/?submit.504304 - https://www.yuque.com/u123456789-6sobi/cdgcbq/bg2g3eit41o4cpd4
CVE ID: CVE-2025-1819 State: PUBLISHED Published: 2025-03-02T16:31:05.928Z Last Updated: 2025-03-03T20:10:12.362Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: AC7 1200M Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. The manipulation of the argument lan_ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298092 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298092 - https://vuldb.com/?ctiid.298092 - https://vuldb.com/?submit.504429 - https://github.com/Raining-101/IOT_cve/blob/main/Tenda%20a7%20V15.03.06.44%20Command%20injection.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-1820 State: PUBLISHED Published: 2025-03-02T17:00:06.863Z Last Updated: 2025-03-03T19:02:30.496Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zj1983 Products: zz Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in zj1983 zz up to 2024-8 and classified as critical. Affected by this vulnerability is the function getOaWid of the file src/main/java/com/futvan/z/system/zworkflow/ZworkflowAction.java. The manipulation of the argument tableId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any