Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321343 - https://vuldb.com/?ctiid.321343 - https://vuldb.com/?submit.634656 - https://github.com/SwayZGl1tZyyy/n-days/blob/main/mihomo-party/README.md - https://github.com/SwayZGl1tZyyy/n-days/blob/main/mihomo-party/README.md#proof-of-concept-1
CVE ID: CVE-2025-9475 State: PUBLISHED Published: 2025-08-26T05:32:07.020Z Last Updated: 2025-08-26T19:48:46.480Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Human Resource Information System Problem Types: CWE-434, CWE-284 Description: A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin_Dashboard/process/editemployee_process.php. This manipulation of the argument employee_file201 causes unrestricted upload. The attack may be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP
attack may be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321344 - https://vuldb.com/?ctiid.321344 - https://vuldb.com/?submit.634745 - https://github.com/lrjbsyh/CVE_Hunter/issues/4 - https://github.com/lrjbsyh/CVE_Hunter/issues/4#issue-3320892747 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9476 State: PUBLISHED Published: 2025-08-26T06:02:07.311Z Last Updated: 2025-08-26T19:43:45.836Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Human Resource Information System Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality of the file /Superadmin_Dashboard/process/editemployee_process.php. Such manipulation of the argument employee_file201 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Ana
pload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321345 - https://vuldb.com/?ctiid.321345 - https://vuldb.com/?submit.634757 - https://github.com/lrjbsyh/CVE_Hunter/issues/5 - https://github.com/lrjbsyh/CVE_Hunter/issues/5#issue-3322736605 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9478 State: PUBLISHED Published: 2025-08-26T18:51:35.354Z Last Updated: 2025-08-28T16:36:16.080Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_26.html - https://issues.chromium.org/issues/437825940
CVE ID: CVE-2025-9479 State: PUBLISHED Published: 2025-11-14T02:29:54.942Z Last Updated: 2025-11-14T15:18:48.663Z Vendors: Google Products: Chrome Problem Types: CWE-125 Description: Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html - https://issues.chromium.org/issues/390743124
CVE ID: CVE-2025-9481 State: PUBLISHED Published: 2025-08-26T13:32:09.115Z Last Updated: 2025-08-26T14:40:57.042Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function setIpv6 of the file /goform/setIpv6. The manipulation of the argument tunrd_Prefix leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and
stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321396 - https://vuldb.com/?ctiid.321396 - https://vuldb.com/?submit.634819 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_35/35.md#poc - https://www.linksys.com/
CVE ID: CVE-2025-9482 State: PUBLISHED Published: 2025-08-26T13:32:11.752Z Last Updated: 2025-08-26T14:42:43.140Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This impacts the function portRangeForwardAdd of the file /goform/portRangeForwardAdd. The manipulation of the argument ruleName/schedule/inboundFilter/TCPPorts/UDPPorts results in stack-based buffer overflow. The attack can be executed remotely. The e
edule/inboundFilter/TCPPorts/UDPPorts results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321397 - https://vuldb.com/?ctiid.321397 - https://vuldb.com/?submit.634820 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_36/36.md - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_36/36.md#poc - https://www.linksys.com/
CVE ID: CVE-2025-9483 State: PUBLISHED Published: 2025-08-26T14:02:06.175Z Last Updated: 2025-08-26T15:01:59.378Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function singlePortForwardAdd of the file /goform/singlePortForwardAdd. This manipulation of the argument ruleName/schedule/inboundFilter causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has be
/inboundFilter causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321398 - https://vuldb.com/?ctiid.321398 - https://vuldb.com/?submit.634823 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_37/37.md - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_37/37.md#poc - https://www.linksys.com/
CVE ID: CVE-2025-9485 State: PUBLISHED Published: 2025-10-04T02:24:37.169Z Last Updated: 2025-10-06T14:16:32.877Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: OAuth Single Sign On – SSO (OAuth Client) Problem Types: CWE-347 Description: The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authenticat
`get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a?source=cve - https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L577 - https://plugins.trac.wordpress.org/changeset/3360768/miniorange-login-with-eve-online-google-facebook
CVE ID: CVE-2025-9487 State: PUBLISHED Published: 2025-09-22T06:00:14.172Z Last Updated: 2025-09-22T16:10:43.154Z Vendors: Unknown Products: Admin and Site Enhancements (ASE) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b957b7c4-7a7c-497e-b8e4-499c821fb1b0/
CVE ID: CVE-2025-9489 State: PUBLISHED Published: 2025-09-09T04:25:55.726Z Last Updated: 2025-09-09T13:20:10.081Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: cbutlerjr Products: WP-Members Membership Plugin Problem Types: CWE-94 Description: The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional A
sible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2035ef-5251-49cc-a480-b6c167b5ef8c?source=cve - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.2/includes/class-wp-members-shortcodes.php#L69 - https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.2/includes/class-wp-members-shortcodes.php#L983
CVE ID: CVE-2025-9490 State: PUBLISHED Published: 2025-09-26T05:27:21.171Z Last Updated: 2025-09-26T19:49:21.771Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: danieliser Products: Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder Problem Types: CWE-79 Description: The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84861460-5257-466e-b2c1-4b8abcf86bd1?source=cve - https://plugins.trac.wordpress.org/browser/popup-maker/tags/1.20.6/includes/importer/easy-modal-v2.php#L259 - https://wordpress.org/plugins/popup-maker/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3362078%40popup-maker&new=3362078%40popup-maker&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9491 State: PUBLISHED Published: 2025-08-26T16:25:15.179Z Last Updated: 2025-11-05T20:49:27.113Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Microsoft Products: Windows Problem Types: CWE-451 Description: Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous c
ous file. The specific flaw exists within the handling of .LNK files. Crafted data in an .LNK file can cause hazardous content in the file to be invisible to a user who inspects the file via the Windows-provided user interface. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25373. Additional Analyst Notes: - CISA ADP Vulnrichment: In Windows 11 25H2 the .LNK file properties user interface was changed to display and copy the full contents of the ‘Target:’ field. This change was also implemented in the October 2025 updates for Windows 11 24H2 and Windows Server 2025. Previous .LNK file properties user interface behavior did not show
updates for Windows 11 24H2 and Windows Server 2025. Previous .LNK file properties user interface behavior did not show all of the content of the 'Target:' field, including potentially malicious commands, if the content was prefaced with white space characters. References: - https://www.zerodayinitiative.com/advisories/ZDI-25-148/
CVE ID: CVE-2025-9492 State: PUBLISHED Published: 2025-08-26T22:02:07.508Z Last Updated: 2025-08-27T16:14:00.394Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Water Billing System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Campcodes Online Water Billing System 1.0. This affects an unknown function of the file /addclient1.php. Executing manipulation of the argument lname can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
be utilized. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321473 - https://vuldb.com/?ctiid.321473 - https://vuldb.com/?submit.635352 - https://github.com/skyrainoh/CVE/issues/9 - https://www.campcodes.com/
CVE ID: CVE-2025-9493 State: PUBLISHED Published: 2025-09-06T03:22:36.504Z Last Updated: 2025-09-08T20:19:00.981Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: whiteshadow Products: Admin Menu Editor Problem Types: CWE-79 Description: The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analy
, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69b9d4e1-895b-4199-bc4e-489afd9d36eb?source=cve - https://plugins.trac.wordpress.org/browser/admin-menu-editor/tags/1.14/includes/shortcodes.php#L42 - https://wordpress.org/plugins/admin-menu-editor/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3353790%40admin-menu-editor&old=3329611%40admin-menu-editor&sfp_email=&sfph_mail=#file857
CVE ID: CVE-2025-9494 State: PUBLISHED Published: 2025-09-23T01:12:17.459Z Last Updated: 2025-09-23T13:34:06.974Z Vendors: Viessmann Products: Vitogate 300 Problem Types: CWE-78 Description: An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker
put before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.corporate.carrier.com/product-security/advisories-resources/
CVE ID: CVE-2025-9495 State: PUBLISHED Published: 2025-09-23T01:16:53.619Z Last Updated: 2025-09-23T13:33:47.319Z Vendors: Viessmann Products: Vitogate 300 Problem Types: CWE-602 Description: The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.corporate.carrier.com/product-security
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://https://www.corporate.carrier.com/product-security/advisories-resources/
CVE ID: CVE-2025-9496 State: PUBLISHED Published: 2025-10-11T07:25:55.744Z Last Updated: 2025-10-14T14:12:54.077Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shortpixel Products: Enable Media Replace Problem Types: CWE-79 Description: The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07aafbe4-d2ac-4cc3-beb4-37e681ed5285?source=cve - https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.6/classes/emr-plugin.php#L645 - https://wordpress.org/plugins/enable-media-replace/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3371681%40enable-media-replace&new=3371681%40enable-media-replace&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9499 State: PUBLISHED Published: 2025-08-30T04:25:05.117Z Last Updated: 2025-09-02T15:14:08.406Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: oceanwp Products: Ocean Extra Problem Types: CWE-79 Description: The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/290e9d95-0dac-4cc8-8cef-9e7974405f36?source=cve - https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.9/includes/panel/library-shortcode.php#L57 - https://wordpress.org/plugins/ocean-extra/ - https://plugins.trac.wordpress.org/changeset/3351880
CVE ID: CVE-2025-9500 State: PUBLISHED Published: 2025-08-30T04:25:06.121Z Last Updated: 2025-09-02T14:46:54.646Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tobiasbg Products: TablePress – Tables in WordPress made easy Problem Types: CWE-79 Description: The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode_debug’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24ae23-d055-4740-bd86-126d503fce1b?source=cve - https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L635 - https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L903 - https://wordpress.org/plugins/tablepress/#developers - https://plugins.trac.wordpress.org/changeset/3352096/
CVE ID: CVE-2025-9501 State: PUBLISHED Published: 2025-11-17T06:00:02.110Z Last Updated: 2025-11-17T19:19:15.463Z Vendors: Unknown Products: W3 Total Cache Problem Types: CWE-78 OS Command Injection Description: The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6697a2c9-63ae-42f0-8931-f2e5d67d45ae/
CVE ID: CVE-2025-9502 State: PUBLISHED Published: 2025-08-27T02:32:12.849Z Last Updated: 2025-08-27T14:02:40.062Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Campcodes Online Loan Management System 1.0. This impacts an unknown function of the file /ajax.php?action=save_payment. Executing manipulation of the argument loan_id can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
ailable to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321485 - https://vuldb.com/?ctiid.321485 - https://vuldb.com/?submit.635353 - https://github.com/skyrainoh/CVE/issues/10 - https://www.campcodes.com/
CVE ID: CVE-2025-9503 State: PUBLISHED Published: 2025-08-27T03:02:06.117Z Last Updated: 2025-08-27T14:01:53.697Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Loan Management System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Affected is an unknown function of the file /ajax.php?action=save_borrower. The manipulation of the argument lastname leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld