Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9700 State: PUBLISHED Published: 2025-08-30T17:32:07.386Z Last Updated: 2025-09-02T15:17:15.394Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Book Store Problem Types: CWE-89, CWE-74 Description: A flaw has been found in SourceCodester Online Book Store 1.0. This issue affects some unknown processing of the file /publisher_list.php. This manipulation of the argument pubid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321920 - https://vuldb.com/?ctiid.321
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321920 - https://vuldb.com/?ctiid.321920 - https://vuldb.com/?submit.639215 - https://github.com/0510green-hand/cve/issues/3 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9701 State: PUBLISHED Published: 2025-08-30T18:02:07.309Z Last Updated: 2025-09-02T15:17:09.999Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Simple Cafe Billing System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester Simple Cafe Billing System 1.0. The impacted element is an unknown function of the file /receipt.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321923
osed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321923 - https://vuldb.com/?ctiid.321923 - https://vuldb.com/?submit.639216 - https://github.com/0510green-hand/cve/issues/4 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9702 State: PUBLISHED Published: 2025-08-30T19:02:07.005Z Last Updated: 2025-09-02T15:17:04.440Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Simple Cafe Billing System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in SourceCodester Simple Cafe Billing System 1.0. This affects an unknown function of the file /sales_report.php. The manipulation of the argument month leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321924 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321924 - https://vuldb.com/?ctiid.321924 - https://vuldb.com/?submit.639224 - https://github.com/0510green-hand/cve/issues/5 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9703 State: PUBLISHED Published: 2025-10-06T06:00:05.327Z Last Updated: 2025-10-06T19:06:35.499Z Vendors: Unknown Products: Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4332d49b-d58c-4728-afab-6757ff9e43ee/
CVE ID: CVE-2025-9704 State: PUBLISHED Published: 2025-08-30T20:02:07.065Z Last Updated: 2025-09-02T15:16:57.826Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Water Billing System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in SourceCodester Water Billing System 1.0. This impacts an unknown function of the file /viewbill.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321925 - https://vuldb.com
oited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321925 - https://vuldb.com/?ctiid.321925 - https://vuldb.com/?submit.639225 - https://github.com/0510green-hand/cve/issues/6 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9705 State: PUBLISHED Published: 2025-08-30T21:02:06.758Z Last Updated: 2025-09-02T15:16:52.038Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Water Billing System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in SourceCodester Water Billing System 1.0. Affected is an unknown function of the file /paybill.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321926 - https://v
be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321926 - https://vuldb.com/?ctiid.321926 - https://vuldb.com/?submit.639226 - https://github.com/0510green-hand/cve/issues/7 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9706 State: PUBLISHED Published: 2025-08-30T22:02:06.588Z Last Updated: 2025-09-02T15:16:45.386Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Water Billing System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in SourceCodester Water Billing System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321927
publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321927 - https://vuldb.com/?ctiid.321927 - https://vuldb.com/?submit.639228 - https://github.com/0510green-hand/cve/issues/9 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9708 State: PUBLISHED Published: 2025-09-16T21:08:05.189Z Last Updated: 2025-11-04T21:15:23.948Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: Kubernetes CSharp Client Problem Types: CWE-295 Description: A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API imp
pt or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ - https://github.com/kubernetes/kubernetes/issues/134063
CVE ID: CVE-2025-9709 State: PUBLISHED Published: 2025-09-05T17:16:16.345Z Last Updated: 2025-09-05T18:07:49.930Z Vendors: Nordic Semiconductor Products: nRF52810 Problem Types: CWE-1191, CWE-1319, Runtime Hardware Protection Bypass Description: On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor nRF52810 allow attacker to perform EM Fault Injection and bypass APPROTECT at runtime, requiring the least amount of modification to the hardware system possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raelize.com/upload/research/2022/No_Hat_2022_-_Glitching_dev
alyst Notes: - CISA ADP Vulnrichment: References: - https://raelize.com/upload/research/2022/No_Hat_2022_-_Glitching_devices_for_code_execution_v1.1.pdf - https://raelize.com/upload/research/2025/Dartmouth_202505_False-Injections-Tales-of-Physics-Misconceptions-and-Weird-Machines_v1.1.pdf - https://nvd.nist.gov/vuln/detail/CVE-2020-27211 - https://www.toreon.com/cve-2025-9709-major-vulnerability-in-common-chip/
CVE ID: CVE-2025-9710 State: PUBLISHED Published: 2025-10-06T06:00:06.607Z Last Updated: 2025-10-06T18:50:04.946Z Vendors: Unknown Products: Responsive Lightbox & Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a45c74b7-b174-479f-9681-464601b082df/
CVE ID: CVE-2025-9712 State: PUBLISHED Published: 2025-09-09T15:09:05.375Z Last Updated: 2025-09-10T03:56:10.213Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-434 Description: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8
CVE ID: CVE-2025-9713 State: PUBLISHED Published: 2025-10-13T21:08:13.112Z Last Updated: 2025-11-11T15:05:28.949Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-22 Description: Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025
CVE ID: CVE-2025-9714 State: PUBLISHED Published: 2025-09-10T18:43:12.204Z Last Updated: 2025-11-03T18:14:19.914Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: libxml2 Products: libxml2 Problem Types: CWE-674 Description: Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a st
ecursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21
CVE ID: CVE-2025-9715 State: PUBLISHED Published: 2025-08-31T00:02:06.377Z Last Updated: 2025-09-02T15:16:39.730Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_cms_assemble_control/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fi
c and could be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322003 - https://vuldb.com/?ctiid.322003 - https://vuldb.com/?submit.637243 - https://github.com/o2oa/o2oa/issues/181 - https://github.com/o2oa/o2oa/issues/181#issuecomment-3212879547 - https://github.com/o2oa/o2oa/issues/181#issue-3332967944
CVE ID: CVE-2025-9716 State: PUBLISHED Published: 2025-08-31T04:32:05.840Z Last Updated: 2025-09-02T15:16:34.317Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_designer/jaxrs/form of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor replied in the GitHub issue (translate
remotely. The exploit has been publicly disclosed and may be utilized. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322004 - https://vuldb.com/?ctiid.322004 - https://vuldb.com/?submit.637244 - https://github.com/o2oa/o2oa/issues/182 - https://github.com/o2oa/o2oa/issues/182#issuecomment-3212879158 - https://github.com/o2oa/o2oa/issues/182#issue-3332970310
CVE ID: CVE-2025-9717 State: PUBLISHED Published: 2025-08-31T05:02:06.388Z Last Updated: 2025-09-02T15:16:28.688Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_assemble_control/jaxrs/unit/ of the component Personal Profile Page. Such manipulation of the argument name/shortName/distinguishedName/pinyin/pinyinInitial/levelName leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Additional Analyst Note
pting. The attack may be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322005 - https://vuldb.com/?ctiid.322005 - https://vuldb.com/?submit.637245 - https://github.com/o2oa/o2oa/issues/183 - https://github.com/o2oa/o2oa/issues/183#issue-3332973239
CVE ID: CVE-2025-9718 State: PUBLISHED Published: 2025-08-31T05:32:06.653Z Last Updated: 2025-09-02T15:16:23.060Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the component Personal Profile Page. Performing manipulation of the argument name/alias results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from sim
xploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322006 - https://vuldb.com/?ctiid.322006 - https://vuldb.com/?submit.637246 - https://github.com/o2oa/o2oa/issues/184 - https://github.com/o2oa/o2oa/issues/184#issuecomment-3212876305 - https://github.com/o2oa/o2oa/issues/184#issue-3332975833
CVE ID: CVE-2025-9719 State: PUBLISHED Published: 2025-08-31T06:02:06.541Z Last Updated: 2025-09-02T15:16:17.325Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_designer/jaxrs/script of the component Personal Profile Page. Executing manipulation of the argument name/alias/description/applicationName can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: -
executed remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322007 - https://vuldb.com/?ctiid.322007 - https://vuldb.com/?submit.637247 - https://github.com/o2oa/o2oa/issues/185 - https://github.com/o2oa/o2oa/issues/185#issue-3332978174
CVE ID: CVE-2025-9720 State: PUBLISHED Published: 2025-08-31T07:02:06.276Z Last Updated: 2025-10-13T20:32:37.916Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component Cadastrar tabela de arredondamento Page. The manipulation of the argument Nome results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322009 - https://vuldb.com/?ctiid.322009 - https://vuldb.com/?submit.638671 - https://karinagante.github.io/cve-2025-9720/ - https://karinagante.github.io/cve-2025-9720/#poc
CVE ID: CVE-2025-9721 State: PUBLISHED Published: 2025-08-31T07:32:06.684Z Last Updated: 2025-10-13T20:32:54.904Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. This manipulation of the argument nome/formulaMedia causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322010 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322010 - https://vuldb.com/?ctiid.322010 - https://vuldb.com/?submit.638672 - https://karinagante.github.io/cve-2025-9721/ - https://karinagante.github.io/cve-2025-9721/#poc
CVE ID: CVE-2025-9722 State: PUBLISHED Published: 2025-08-31T08:02:06.632Z Last Updated: 2025-10-13T20:33:11.971Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_tipo_ocorrencia_disciplinar_cad.php. Such manipulation of the argument nm_tipo/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322011 - https://vuldb.com/?ctiid.322011 - https://vuldb.com/?submit.638697 - https://karinagante.github.io/cve-2025-9722/ - https://karinagante.github.io/cve-2025-9722/#poc
CVE ID: CVE-2025-9723 State: PUBLISHED Published: 2025-08-31T09:02:06.092Z Last Updated: 2025-10-13T20:33:22.929Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.php. Performing manipulation of the argument nm_tipo results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322012 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322012 - https://vuldb.com/?ctiid.322012 - https://vuldb.com/?submit.638698 - https://karinagante.github.io/cve-2025-9723/ - https://karinagante.github.io/cve-2025-9723/#poc
CVE ID: CVE-2025-9724 State: PUBLISHED Published: 2025-08-31T09:32:06.226Z Last Updated: 2025-09-02T15:15:46.661Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino_cad.php. Executing manipulation of the argument nm_nivel/descricao can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322013 -
ed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322013 - https://vuldb.com/?ctiid.322013 - https://vuldb.com/?submit.638702 - https://github.com/KarinaGante/KGSec/blob/main/CVEs/i-educar/19.md
CVE ID: CVE-2025-9725 State: PUBLISHED Published: 2025-08-31T10:02:06.702Z Last Updated: 2025-09-02T15:15:41.108Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Cudy Products: LT500E Problem Types: CWE-259, CWE-255 Description: A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is
oitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322014 - https://vuldb.com/?ctiid.322014 - https://vuldb.com/?su
A ADP Vulnrichment: References: - https://vuldb.com/?id.322014 - https://vuldb.com/?ctiid.322014 - https://vuldb.com/?submit.639346 - https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md - https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduce