Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-60784 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T21:01:51.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase votes at a reduced cost. Furthermore, by modifying the zid parameter, attackers can influence purchases made by other users, amplifying the impact. This issue stems from insufficient server-side validation of these parameters, po
by other users, amplifying the impact. This issue stems from insufficient server-side validation of these parameters, potentially leading to economic loss and unfair manipulation of vote counts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GoogTech/CVE/blob/master/Incorrect%20Access%20Control/Incorrect-Access-Control-in-XiaozhangBang-Voluntary-Like-System-V8.8.md - https://github.com/GoogTech/CVE/blob/master/Incorrect-Access-Control-in-XiaozhangBang-Voluntary-Like-System-V8.8.md
CVE ID: CVE-2025-60785 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-04T15:14:25.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a crafted HTML page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://zdaylabs.com/CVE-2025-60785.html
CVE ID: CVE-2025-60787 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T15:00:19.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://motioneye-project.com - https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter
CVE ID: CVE-2025-60790 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-27T15:39:25.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/processwire/processwire-issues/issues/2120 - https://github.com/NomanProdhan/security-vulnerability-research/tree/master/CVE-2025-60790
CVE ID: CVE-2025-60791 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T19:56:13.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/easyworkaccounting/ - https://packetstorm.
otes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/easyworkaccounting/ - https://packetstorm.news/files/id/210832
CVE ID: CVE-2025-60794 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-20T21:25:10.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.npmjs.com/package/@perfood/couch-auth - https://github.com/perfood/couch-auth - https://github.com/pr0wl1n
- https://www.npmjs.com/package/@perfood/couch-auth - https://github.com/perfood/couch-auth - https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.md
CVE ID: CVE-2025-60796 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T16:08:17.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions. Additi
ipt in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316 - https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29 - https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35 - https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60796.md
CVE ID: CVE-2025-60797 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T15:38:33.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
mplete database compromise, data theft, or privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118 - https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md
CVE ID: CVE-2025-60798 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T15:38:02.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phppgadmin/phppgadmin/blob/m
romise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phppgadmin/phppgadmin/blob/master/display.php#L396 - https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md - https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60798.md
CVE ID: CVE-2025-60799 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-20T21:34:31.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access
ulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phppgadmin/phppgadmin/blob/master/sql.php#L68-L76 - https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60799.md
CVE ID: CVE-2025-60800 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T17:32:48.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jishenghua/jshERP/issues/130
CVE ID: CVE-2025-60801 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:10:29.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: jshERP up to commit fbda24da was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the jsh_erp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jishenghua/jshERP/issues/132 - https://fushuling.com/index.php/2025/08/17/%e7%bb%95%e8%bf%87%e8%a1%a5%e4%b8%81%ef%bc%8c%e5%86%8d%e6%ac%a1%e5%ae%9e%e7%8e%b0%e5%8d%8e%e5%a4%8ferp%e6%9c%aa%e6%8e%88%e6%9d%83rce%e5%b7%b2%e4%bf%ae%e5%a4%8d/
CVE ID: CVE-2025-60803 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T17:41:12.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Antabot/White-Jotter/issues/162
CVE ID: CVE-2025-60805 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T17:29:47.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BESSystem BES Application Server thru 9.5.x allowing unauthorized attackers to gain sensitive information via the "pre-resource" option in bes-web.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bes.com - http://www.bessystem.com/appserver/dtds/bes-web-app_2_5-0.dtd - https://www.bessystem.com/product/0ad9b8c4d6af462b8d15723a5f25a87d/info?p=101 - https://gist.github.com/Liu2000622/7a6294f7421ef50c378a456ca9494714
CVE ID: CVE-2025-60828 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:44:07.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChangeYourWay/post/blob/main/WukongCRM-9.0-JAVA.md - https://gist.github.com/ChangeYourWay/424478421d6a78d1f87d324cddcbfd59
CVE ID: CVE-2025-60830 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:45:57.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yyjccc/document/blob/main/redragon-erp/redragon-erp.md - https://gist.github.com/ChangeYourWay/3b3d3dd5727272c435f1b1f6c17b7181
CVE ID: CVE-2025-60833 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:47:22.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChangeYourWay/post/blob/main/uzy-ssm-mall.md - https://gist.github.com/ChangeYourWay/1364b9e78490ebd5cd31bcdc105a914f
CVE ID: CVE-2025-60834 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:53:08.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChangeYourWay/post/blob/main/uzy-ssm-mall2.md - https://gist.github.com/ChangeYourWay/5f2b0100b167edf868dd702c0fa3cc35
CVE ID: CVE-2025-60837 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T20:34:38.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://mcms.com - https://gitee.com/mingSoft/MCMS - https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
CVE ID: CVE-2025-60838 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T18:57:51.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://mcms.com - https://gitee.com/mingSoft/MCMS - https://gist.github.com/xuzhiwei66666666/8a990104861ce31cf73ea38e7eb32a7d
CVE ID: CVE-2025-60852 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T16:28:33.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built with affected versions of the framework did not properly sanitize user-controlled input before including it in CSV exports. This issue could lead to code execution on the system where the exported CSV file is opened. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://instantdeveloper.com/lp/cloud-freelance/index.html - https://github.com/valeriocassoni/CSV-Injection-in-Instant-Develo
//instantdeveloper.com/lp/cloud-freelance/index.html - https://github.com/valeriocassoni/CSV-Injection-in-Instant-Developer-Foundation-25.0-PoC - https://doc.instantdeveloper.com/eng/default.aspx?artid=a6c69034-d1ee-4057-b19d-40505151ec8e&lang=eng
CVE ID: CVE-2025-60855 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-21T12:50:21.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink Video Doorbell WiFi DB_566128M5MP_W performs insufficient validation of firmware update signatures. This allows attackers to load malicious firmware images, resulting in arbitrary code execution with root privileges. NOTE: this is disputed by the Supplier because the integrity of updates is instead assured via a "private encryption algorithm" and other "tamper-proof verification." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reolink.com/download-center/ - https://cybermaya.in/posts/Pos
lyst Notes: - CISA ADP Vulnrichment: References: - https://reolink.com/download-center/ - https://cybermaya.in/posts/Post-45/
CVE ID: CVE-2025-60856 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T12:52:58.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to the exposed interface and execute arbitrary commands with root privileges. NOTE: this is disputed by the Supplier because of "certain restrictions on users privately connecting serial port cables" and because "the root user has a password and it meets the requirements of password security complexity." Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
eets the requirements of password security complexity." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reolink.com/download-center/ - https://cybermaya.in/posts/Post-46/
CVE ID: CVE-2025-60858 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:23:48.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers to intercept or extract sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reolink.com/download-center/ - https://cybermaya.in/posts/Post-47/
CVE ID: CVE-2025-60859 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T20:33:15.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://creeperkirby.notion.site/Gnboard5-5-6-15-reflected-XSS-25c4fe7db8cf80efa20fc2ebefcfe61e?source=copy_link - https://github.com/gnuboard/gnuboard5/commit/002e43e5fb84b465357b445772c881e196e100d3
CVE ID: CVE-2025-60868 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T14:26:35.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://statamic.com/addons/alt-design/alt-redirects/release-notes - https://gist.github.com/kasiasok/870933de18d1400fa8be88e1bcadec6c
CVE ID: CVE-2025-60869 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T15:06:15.500Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and "Footer Follow Buttons". An attacker can inject arbitrary JavaScript, which is stored in the project and executed in the browsers of remote visitors viewing the generated static site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://getpublii.com/download/ - https://gist.gith
te. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://getpublii.com/download/ - https://gist.github.com/kasiasok/63f7dcc9c453857005066ee9738318a9
CVE ID: CVE-2025-60876 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:47:02.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attac
: - CISA ADP Vulnrichment: References: - https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm - https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm - https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092
CVE ID: CVE-2025-60880 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-17T16:49:39.186Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
ssion hijacking, data theft, or unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98 - https://github.com/Shenal01/CVE-2025-60880
CVE ID: CVE-2025-60892 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T21:00:06.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintentionally re-adds a user's id_rsa.pub key from their local Windows machine to the authorized_keys file on the Raspberry Pi, even after the user explicitly deletes the key from the user interface. This creates an unintended attack surface, as it could allow an attacker to use a different key than the intended one to login to the device. Additional Analyst Notes: - CISA A
llow an attacker to use a different key than the intended one to login to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/raspberrypi/rpi-imager/issues/1185
CVE ID: CVE-2025-60898 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T17:23:16.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a user-supplied URI without adequate allow/blocklist validation and returns a 307 redirect that can disclose internal URLs in the Location header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://halo.com - https:/
URLs in the Location header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://halo.com - https://github.com/abdulr7mann/CVEs/blob/main/CVE-2025-60898/CVE-2025-60898.md
CVE ID: CVE-2025-60914 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:33:05.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via sending a crafted GET request to the /display_logo endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-unautorisierter-zugriff-display_logo/
CVE ID: CVE-2025-60915 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:33:58.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-lfi-konfigurationsdatei-exfiltration/