Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
xploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325820 - https://vuldb.com/?ctiid.325820 - https://vuldb.com/?submit.652461 - https://github.com/geyang/ml-logger/issues/72
CVE ID: CVE-2025-10951 State: PUBLISHED Published: 2025-09-25T15:02:06.416Z Last Updated: 2025-09-26T18:07:15.542Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: geyang Products: ml-logger Problem Types: CWE-22 Description: A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function log_handler of the file ml_logger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Theref
available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325821 - https://vuldb.com/?ctiid.325821 - https://vuldb.com/?submit.652462 - https://github.com/geyang/ml-logger/issues/73
CVE ID: CVE-2025-10952 State: PUBLISHED Published: 2025-09-25T15:32:05.845Z Last Updated: 2025-09-25T15:47:56.179Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: geyang Products: ml-logger Problem Types: CWE-200, CWE-284 Description: A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler of the file ml_logger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious de
e. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325822 - https://vuldb.com/?ctiid.325822 - https://vuldb.com/?submit.652463 - https://github.com/geyang/ml-logger/issues/74
CVE ID: CVE-2025-10953 State: PUBLISHED Published: 2025-09-25T16:02:05.628Z Last Updated: 2025-09-25T18:35:52.000Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: UTT Products: 1200GW, 1250GW Problem Types: CWE-120, CWE-119 Description: A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /goform/formApMail. The manipulation of the argument senderEmail leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
ublicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325824 - https://vuldb.com/?ctiid.325824 - https://vuldb.com/?submit.652687 - https://vuldb.com/?submit.652688 - https://github.com/cymiao1978/cve/blob/main/8.md - https://github.com/cymiao1978/cve/blob/main/9.md
CVE ID: CVE-2025-10954 State: PUBLISHED Published: 2025-09-27T05:00:00.966Z Last Updated: 2025-09-29T13:42:17.769Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P) Vendors: n/a Products: github.com/nyaruka/phonenumbers Problem Types: CWE-1286 Description: Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHO
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMNYARUKAPHONENUMBERS-6084070 - https://github.com/nyaruka/phonenumbers/issues/148 - https://github.com/nyaruka/phonenumbers/commit/0479e35488e8a002a261cdb515ef8a7f80ca37fe
CVE ID: CVE-2025-10955 State: PUBLISHED Published: 2025-11-06T14:46:09.596Z Last Updated: 2025-11-07T08:38:36.099Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Netcad Software Inc. Products: Netigma Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows XSS Through HTTP Query Strings.This issue affects Netigma: from 6.3.5 before 6.3.5 V8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0378
CVE ID: CVE-2025-10957 State: PUBLISHED Published: 2025-09-25T11:43:15.981Z Last Updated: 2025-09-25T13:10:45.506Z Vendors: Syrotech Networks Products: Syrotech SY-GPON-2010-WADONT Problem Types: CWE-284 Description: This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vulnerability by establishing an FTP connection using default credentials, potentially gaining unauthorized access to configuration files, user credentials, or other sensitive information stored on the targeted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?
eted device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0223
CVE ID: CVE-2025-10958 State: PUBLISHED Published: 2025-09-25T17:32:05.478Z Last Updated: 2025-09-25T18:04:26.829Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325826 - https://vuldb.com/?ctiid.325826 - https://vuldb.com/?submit.652768 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md#poc
CVE ID: CVE-2025-10959 State: PUBLISHED Published: 2025-09-25T17:32:07.833Z Last Updated: 2025-09-25T18:04:15.127Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA A
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325827 - https://vuldb.com/?ctiid.325827 - https://vuldb.com/?submit.652769 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/DMZ.md - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/DMZ.md#poc
CVE ID: CVE-2025-10960 State: PUBLISHED Published: 2025-09-25T18:02:05.128Z Last Updated: 2025-09-25T18:44:34.761Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument delete_list results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in a
it has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325828 - https://vuldb.com/?ctiid.325828 - https://vuldb.com/?submit.652780 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/DeleteMac.md - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/DeleteMac.md#poc
CVE ID: CVE-2025-10961 State: PUBLISHED Published: 2025-09-25T18:02:07.678Z Last Updated: 2025-09-25T19:07:47.668Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
isclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325829 - https://vuldb.com/?ctiid.325829 - https://vuldb.com/?submit.652781 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/Delete_Mac_list.md
CVE ID: CVE-2025-10962 State: PUBLISHED Published: 2025-09-25T18:32:05.547Z Last Updated: 2025-09-25T18:57:06.821Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac_5g leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analy
and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325830 - https://vuldb.com/?ctiid.325830 - https://vuldb.com/?submit.652782 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/SetName.md - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/SetName.md#poc
CVE ID: CVE-2025-10963 State: PUBLISHED Published: 2025-09-25T19:02:05.324Z Last Updated: 2025-09-25T19:27:26.632Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
loited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325831 - https://vuldb.com/?ctiid.325831 - https://vuldb.com/?submit.652784 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/singlePortForwardDelete.md - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/singlePortForwardDelete.md#poc
CVE ID: CVE-2025-10964 State: PUBLISHED Published: 2025-09-25T19:32:05.493Z Last Updated: 2025-09-26T17:57:04.542Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: NU516U1 Problem Types: CWE-77, CWE-74 Description: A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
nd could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325832 - https://vuldb.com/?ctiid.325832 - https://vuldb.com/?submit.652785 - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/websSysFirewall.md - https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/websSysFirewall.md#poc
CVE ID: CVE-2025-10965 State: PUBLISHED Published: 2025-09-25T20:02:07.825Z Last Updated: 2025-09-26T17:56:55.163Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: LazyAGI Products: LazyLLM Problem Types: CWE-502, CWE-20 Description: A security vulnerability has been detected in LazyAGI LazyLLM up to 0.6.1. Affected by this issue is the function lazyllm_call of the file lazyllm/components/deploy/relay/server.py. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325833 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325833 - https://vuldb.com/?ctiid.325833 - https://vuldb.com/?submit.652936 - https://github.com/LazyAGI/LazyLLM/issues/764
CVE ID: CVE-2025-10966 State: PUBLISHED Published: 2025-11-07T07:26:30.351Z Last Updated: 2025-11-10T20:26:07.282Z Vendors: curl Products: curl Problem Types: CWE-322 Key Exchange without Entity Authentication Description: curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2025-10966.json - https://curl.se/docs/CVE-2025-10966.html - https://hackerone.com/reports/3355218
CVE ID: CVE-2025-10967 State: PUBLISHED Published: 2025-09-25T20:02:10.381Z Last Updated: 2025-09-26T17:56:04.405Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: MuFen-mker Products: PHP-Usermm Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Performing manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for
. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325834 - https://vuldb.com/?ctiid.325834 - https://vuldb.com/?submit.653138 - https://github.com/Miker132/CVE-/issues/3
CVE ID: CVE-2025-10968 State: PUBLISHED Published: 2025-11-07T13:08:41.209Z Last Updated: 2025-11-07T13:22:39.031Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GG Soft Software Services Inc. Products: PaperWork Problem Types: CWE-89, CWE - 564 - SQL Injection: Hibernate Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection.This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bild
.0.9390 before 6.1.0.9398. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0381
CVE ID: CVE-2025-10973 State: PUBLISHED Published: 2025-09-25T21:02:05.564Z Last Updated: 2025-09-26T17:55:39.385Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: JackieDYH Products: Resume-management-system Problem Types: CWE-89, CWE-74 Description: A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273. Affected by this issue is some unknown functionality of the file /admin/show.php. This manipulation of the argument userid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a r
loit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325844 - https://vuldb.com/?ctiid.325844 - https://vuldb.com/?submit.653139 - https://github.com/Miker132/CVE-/issues/5
CVE ID: CVE-2025-10974 State: PUBLISHED Published: 2025-09-25T21:32:05.444Z Last Updated: 2025-09-26T17:55:26.429Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: giantspatula Products: SewKinect Problem Types: CWE-502, CWE-20 Description: A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /calculate of the component Endpoint. Such manipulation of the argument body_parts/point_cloud leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ens
ely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325845 - https://vuldb.com/?ctiid.325845 - https://vuldb.com/?submit.653270 - https://github.com/giantspatula/SewKinect/issues/3 - https://github.com/giantspatula/SewKinect/issues/3#issue-3408883003
CVE ID: CVE-2025-10975 State: PUBLISHED Published: 2025-09-25T21:32:07.791Z Last Updated: 2025-09-26T17:53:07.057Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: GuanxingLu Products: vlarl Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in GuanxingLu vlarl up to 31abc0baf53ef8f5db666a1c882e1ea64def2997. This vulnerability affects the function experiments.robot.bridge.reasoning_server::run_reasoning_server of the file experiments/robot/bridge/reasoning_server.py of the component ZeroMQ. Performing manipulation of the argument Message results in deserialization. Remote exploitation of the attack is possible. The exploit has been made public
ment Message results in deserialization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325846 - https://vuldb.com/?ctiid.325846 - https://vuldb.com/?submit.653279 - https://github.com/GuanxingLu/vlarl/issues/18 - https://github.com/GuanxingLu/vlarl/issues/18#issue-3408978610
CVE ID: CVE-2025-10976 State: PUBLISHED Published: 2025-09-25T22:02:08.243Z Last Updated: 2025-09-26T17:52:54.563Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: JeecgBoot Problem Types: CWE-285, CWE-266 Description: A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor
y. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325847 - https://vuldb.com/?ctiid.325847 - https://vuldb.com/?submit.653333 - https://www.cnblogs.com/aibot/p/19063349
CVE ID: CVE-2025-10977 State: PUBLISHED Published: 2025-09-25T22:32:08.286Z Last Updated: 2025-09-26T15:38:18.442Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: JeecgBoot Problem Types: CWE-285, CWE-266 Description: A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early abou
bility is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325848 - https://vuldb.com/?ctiid.325848 - https://vuldb.com/?submit.653335 - https://www.cnblogs.com/aibot/p/19063351
CVE ID: CVE-2025-10978 State: PUBLISHED Published: 2025-09-25T22:32:11.908Z Last Updated: 2025-09-26T19:11:50.060Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: JeecgBoot Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filter Handler. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Addit
public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325849 - https://vuldb.com/?ctiid.325849 - https://vuldb.com/?submit.653336 - https://www.cnblogs.com/aibot/p/19063352