Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9209 State: PUBLISHED Published: 2025-10-03T11:17:09.610Z Last Updated: 2025-10-03T18:02:04.328Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: magnigenie Products: RestroPress – Online Food Ordering System Problem Types: CWE-200 Description: The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them. Additiona
thenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/359833dd-de3c-48ea-8eef-06588a590da2?source=cve - https://wordpress.org/plugins/restropress/
CVE ID: CVE-2025-9212 State: PUBLISHED Published: 2025-10-03T11:17:22.865Z Last Updated: 2025-10-03T18:25:34.795Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ekndev Products: WP Dispatcher Problem Types: CWE-434 Description: The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wp_dispatcher_process_upload() function in all versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess
files on the affected site's server which may make remote code execution possible. The directory does have an .htaccess file which limits the ability to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b9c46d-72db-43f3-b17b-0747375d45c9?source=cve - https://plugins.trac.wordpress.org/browser/wp-dispatcher/trunk/admin/class-wp-dispatcher-add-new-upload.php#L110
CVE ID: CVE-2025-9213 State: PUBLISHED Published: 2025-10-03T11:17:05.566Z Last Updated: 2025-10-03T15:58:15.704Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: textbuilder Products: TextBuilder Problem Types: CWE-352 Description: The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due to missing or incorrect nonce validation on the 'handleToken' function. This makes it possible for unauthenticated attackers to update a user's authorization token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Once the token is updated, an at
ey can trick a site administrator into performing an action such as clicking on a link. Once the token is updated, an attacker can update the user's password and email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0153fb37-788e-42f2-9dfa-76418decf1f3?source=cve - https://plugins.trac.wordpress.org/changeset/3371346/
CVE ID: CVE-2025-9214 State: PUBLISHED Published: 2025-09-11T18:33:37.362Z Last Updated: 2025-09-11T18:59:36.498Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Lenovo Products: LJ2206W Printer, M7206W Printer, M7216NWA Printer, M7256WHF Printer, LJ2655DN Printer, M7615DNA, M7626DNA Printer, M7628DNA Printer, M7455DNF Printer, M7675DXF Printer, M7685DXF Printer, M7686DXF Problem Types: CWE-306 Description: A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settings via the CUPS service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
or modify network settings via the CUPS service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/431734
CVE ID: CVE-2025-9215 State: PUBLISHED Published: 2025-09-17T06:17:47.572Z Last Updated: 2025-09-17T12:51:48.860Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: kodezen Products: StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Problem Types: CWE-22 Description: The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents
nction. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07b1dc05-1340-4ea3-9315-3e1ca4a0cb7f?source=cve - https://plugins.trac.wordpress.org/browser/storeengine/trunk/addons/csv/ajax/export.php#L47 - https://github.com/d0n601/CVE-2025-9215 - https://ryankozak.com/posts/cve-2025-9215/ - https://plugins.trac.wordpress.org/changeset/3360097/storeengine/trunk/addons/csv/ajax/export.php
CVE ID: CVE-2025-9216 State: PUBLISHED Published: 2025-09-17T06:17:48.502Z Last Updated: 2025-09-17T12:53:28.622Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: kodezen Products: StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Problem Types: CWE-434 Description: The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level acc
all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f8cc393-4d6f-4d15-ad95-d4a89dfe433c?source=cve - https://plugins.trac.wordpress.org/browser/storeengine/trunk/addons/csv/ajax/import.php#L52 - https://github.com/d0n601/CVE-2025-9216 - https://ryankozak.com/posts/cve-2025-9216/ - https://plugins.trac.wordpress.org/changeset/3360097/storeengine/trunk/addons/csv/ajax/import.php
CVE ID: CVE-2025-9217 State: PUBLISHED Published: 2025-08-29T10:54:02.642Z Last Updated: 2025-08-29T11:45:43.478Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Revolution Slider Products: Slider Revolution Problem Types: CWE-22 Description: The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
n the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea49df40-e58f-4e20-8e48-ed0f9a1b94ca?source=cve - https://www.sliderrevolution.com/documentation/changelog/#6-7-37
CVE ID: CVE-2025-9219 State: PUBLISHED Published: 2025-09-03T08:27:23.212Z Last Updated: 2025-09-03T13:27:25.659Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: saadiqbal Products: Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more Problem Types: CWE-862 Description: The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback'
le to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65914bbf-6563-4bf2-a358-885e182a1365?source=cve - https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L1858 - https://plugins.trac.wordpress.org/changeset/3353624/
CVE ID: CVE-2025-9223 State: PUBLISHED Published: 2025-11-11T13:13:24.880Z Last Updated: 2025-11-13T04:55:25.666Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zohocorp Products: ManageEngine Applications Manager Problem Types: CWE-77 Description: Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-9223.html
CVE ID: CVE-2025-9225 State: PUBLISHED Published: 2025-08-20T07:26:01.629Z Last Updated: 2025-11-05T12:07:24.766Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Mobile Industrial Robots Products: MiR Robots, MiR Fleet Problem Types: CWE-79 Description: Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mobile-industrial-robots.com/security-advisories/cross-site-scripting - https://supportportal.mobile-industrial-robots.com/documentation/mir-cyberse
/security-advisories/cross-site-scripting - https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE ID: CVE-2025-9227 State: PUBLISHED Published: 2025-11-11T13:29:32.185Z Last Updated: 2025-11-12T20:03:46.907Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Zohocorp Products: ManageEngine OpManager Problem Types: CWE-79 Description: Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/itom/advisory/cve-2025-9227.html
CVE ID: CVE-2025-9228 State: PUBLISHED Published: 2025-08-20T08:24:33.175Z Last Updated: 2025-11-05T12:08:35.758Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mobile Industrial Robots Products: MiR Robots, MiR Fleet Problem Types: CWE-863 Description: MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mobile-industrial-robots.com/security-advisories/insufficient-authorization-when-creating-notes - https://supportportal.mobile-indu
strial-robots.com/security-advisories/insufficient-authorization-when-creating-notes - https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE ID: CVE-2025-9229 State: PUBLISHED Published: 2025-08-20T08:36:57.846Z Last Updated: 2025-11-05T12:09:23.900Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mobile Industrial Robots Products: MiR Robots, MiR Fleet Problem Types: CWE-209 Description: Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mobile-industrial-robots.com/security-advisories/information-disclosure - https://supportportal.mobile-in
ces: - https://mobile-industrial-robots.com/security-advisories/information-disclosure - https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE ID: CVE-2025-9230 State: PUBLISHED Published: 2025-09-30T13:17:00.808Z Last Updated: 2025-11-04T21:15:17.295Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-125, CWE-787 Description: Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be seve
ecution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://openssl-library.org/news/secadv/20250930.txt - https://github.com/openss
- CVE Program Container: References: - https://openssl-library.org/news/secadv/20250930.txt - https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482 - https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280 - https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45 - https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd - https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def - https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba - https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25
dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba - https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3
CVE ID: CVE-2025-9231 State: PUBLISHED Published: 2025-09-30T13:17:12.007Z Last Updated: 2025-11-04T21:15:18.593Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-385 Description: Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificat
iming measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://openssl-l
d algorithm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://openssl-library.org/news/secadv/20250930.txt - https://github.com/openssl/openssl/commit/fc47a2ec078912b3e914fab5734535e76c4820c2 - https://github.com/openssl/openssl/commit/eed5adc9f969d77c94f213767acbb41ff923b6f4 - https://github.com/openssl/openssl/commit/567f64386e43683888212226824b6a179885a0fe - https://github.com/openssl/openssl/commit/cba616c26ac8e7b37de5e77762e505ba5ca51698
CVE ID: CVE-2025-9232 State: PUBLISHED Published: 2025-09-30T13:17:19.172Z Last Updated: 2025-11-04T21:15:19.948Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-125 Description: Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protoco
sed directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The F
The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://openssl-library.org/news/secadv/20250930.txt - https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35 - https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3 - https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0 - https://github.com/ope
086e194af3 - https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0 - https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf - https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b
CVE ID: CVE-2025-9233 State: PUBLISHED Published: 2025-08-20T15:32:06.516Z Last Updated: 2025-08-20T17:30:11.259Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manipulation of the argument Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320766 - https://vuldb.com/?ctiid.320766 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320766 - https://vuldb.com/?ctiid.320766 - https://vuldb.com/?submit.631118 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9233.md - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20view_edit.shtm%20parameter%20name.md#poc
CVE ID: CVE-2025-9234 State: PUBLISHED Published: 2025-08-20T17:02:06.430Z Last Updated: 2025-08-20T17:27:53.599Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. The manipulation of the argument Alias results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320767 - https://vuldb.com/?ctiid.320767 - https://vuldb.com/?sub
ADP Vulnrichment: References: - https://vuldb.com/?id.320767 - https://vuldb.com/?ctiid.320767 - https://vuldb.com/?submit.631119 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9234.md - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20maintenance_events.shtm%20parameter%20Alias.md#poc
CVE ID: CVE-2025-9235 State: PUBLISHED Published: 2025-08-20T17:02:08.811Z Last Updated: 2025-08-20T17:24:42.292Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320768 - https://vuldb.com/?ctiid.320768 - https://vuldb.com
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320768 - https://vuldb.com/?ctiid.320768 - https://vuldb.com/?submit.631120 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9235.md - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20compound_events.shtm%20parameter%20name.md#poc
CVE ID: CVE-2025-9236 State: PUBLISHED Published: 2025-08-20T17:32:06.078Z Last Updated: 2025-09-11T15:22:20.376Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql injection. The attack may be performed from a remote location. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure bu
n. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320769 - https://vuldb.com/?ctiid.320769 - https://vuldb.com/?submit.631370 - https://vuldb.com/?submit.638555 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9236.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20nm_tipo%20Parameter%20on%20educar_tipo_usuario_lst.php%20Endpoint.md#poc