Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
is has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/uasoft-indonesia/badaso - https://medium.com/@pat.sanitjairak/remote-code-execution-in-a-plain-view-0f86f183543d
CVE ID: CVE-2025-52357 State: PUBLISHED Published: 2025-07-09T00:00:00.000Z Last Updated: 2025-07-09T20:18:32.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks. Additional Analyst Notes: - CISA
k sessions or escalate privileges through social engineering or browser-based attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wrathfulDiety/fd602gw-dx-r410-xss-advisory/blob/main/README.md - https://github.com/wrathfulDiety/CVE-2025-52357
CVE ID: CVE-2025-52358 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T13:55:44.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vivaldigroup.it/en/ - https://github.com/MatJosephs/CVEs/blob/main/CVE-2025-52358/README.md
CVE ID: CVE-2025-52360 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T14:35:18.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user interacts with the interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/MerttTuran/32289a1d3c173f0b7934237c1696bef1
CVE ID: CVE-2025-52361 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-11-03T20:05:47.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction and on every system boot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ak-nord.de/usbserver-usb--usb-converter--usb-auf-ethernet--usb-to-ethernet--usb-auf-lan--usb-server-
nces: - https://www.ak-nord.de/usbserver-usb--usb-converter--usb-auf-ethernet--usb-to-ethernet--usb-auf-lan--usb-server--usb-konverter--print-server-80.html - https://seclists.org/fulldisclosure/2025/Jul/20
CVE ID: CVE-2025-52362 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T13:29:39.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHProxy/phproxy - https://gist.github.com/Shulelk/a18c11866be8609b22ff5df780a42422
CVE ID: CVE-2025-52363 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T17:34:22.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative access Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/product/download/cp3pro.html - https://cybermaya.in/posts/Post-39/
CVE ID: CVE-2025-52364 State: PUBLISHED Published: 2025-07-09T00:00:00.000Z Last Updated: 2025-07-14T17:04:02.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if default or weak credentials are present Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/product/download/cp3pro.html - https://cybermaya.in/posts/Post-40/
CVE ID: CVE-2025-52367 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-23T18:13:24.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pivotx.com - https://medium.com/@hayton1088/cve-2025-52367-stored-xss-to-rce-via-privilege-escalation-in-pivotx-cms-v3-0-0-rc-3-a1b870bcb7b3
CVE ID: CVE-2025-52372 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T15:33:55.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mojibake-dev/hMailEnum - https://github.com/hmailserver/hmailserver - https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52372.md
CVE ID: CVE-2025-52373 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T15:24:14.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mojibake-dev/hMailEnum - https://github.com/hmailserver/hmailserver - https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52373.md
CVE ID: CVE-2025-52374 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T15:23:10.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mojibake-dev/hMailEnum - https://github.com/hmailserver/hmailserver - https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52374.md
CVE ID: CVE-2025-52376 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T14:23:54.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet service without authentication, bypassing security controls. The Telnet server is then accessible with hard-coded credentials, allowing attackers to gain administrative shell access and execute arbitrary commands on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vagebondcur/nex
mands on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits/blob/main/CVE-2025-52376/writeup.md
CVE ID: CVE-2025-52377 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T20:36:55.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the /web/um_ping_set.cgi endpoint. The application fails to properly sanitize user input in the `Ping_host_text` parameter before passing it to the underlying system command, allowing attackers to inject and execute arbitrary shell c
parameter before passing it to the underlying system command, allowing attackers to inject and execute arbitrary shell commands as the root user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits/blob/main/CVE-2025-52377/writeup.md
CVE ID: CVE-2025-52378 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T18:53:14.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject JavaScript code that is executed in the context of administrator sessions when viewing the device management page via the DEVICE_ALIAS parameter to the /web/um_device_set_aliasname endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploit
ub.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits/blob/main/CVE-2025-52378/writeup.md
CVE ID: CVE-2025-52379 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T18:54:37.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below contains an authenticated command injection vulnerability in the firmware update feature. The /web/um_fileName_set.cgi and /web/um_web_upgrade.cgi endpoints fail to properly sanitize the upgradeFileName parameter, allowing authenticated attackers to execute arbitrary OS commands on the device, resulting in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits - https://github.com/Vagebondcur/nexxt-solutions-NCM-X1800-exploits/blob/main/CVE-2025-52379/writeup.md
CVE ID: CVE-2025-52385 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-14T13:58:09.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/78.html - https://cwe.mitre.org/data/definitions/94.html - https://robomongo.org/ - https://github.com/Studio3T/robomongo - https://github.com/Kov404/CVE-2025-52385/tree/main
CVE ID: CVE-2025-52386 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-13T20:03:31.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CycloneDX/Sunshine - https://github.com/VishalSreenivas/Formula-Injection-in-CycloneDX-Sunshine/blob/main/payload.json - https://github.com/VishalSreenivas/Formula-Injection-in-CycloneDX-Sunshine/blob/main/CVE-2025-52386.md
CVE ID: CVE-2025-52389 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T20:25:47.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other users via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.app.sodacristal.com.br - https://github.com/ktr4ck3r/CVE-2025-52389
CVE ID: CVE-2025-52390 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T17:30:08.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. The application directly concatenates user-supplied input (`$search_word`) into SQL queries without sanitization, allowing attackers to manipulate the SQL logic and potentially extract sensitive information or escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sauruscms/Saurus-CMS-Commu
ivileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sauruscms/Saurus-CMS-Community-Edition/blob/d886e5b0c1e2b42cd74e2184e7c81c720cd9de6b/classes/FulltextSearch.class.php#L331 - https://github.com/theharshkothari/vulnerability-research/blob/main/CVE-2025-52390.md
CVE ID: CVE-2025-52392 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-19T15:30:35.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/soosyze/soosyze/issues/269 - https://beafn28.gitbook.io/beafn28/cve/brute-force-lo
ent: References: - https://github.com/soosyze/soosyze/issues/269 - https://beafn28.gitbook.io/beafn28/cve/brute-force-login-vulnerability-in-soosyze-cms-2.0-cve-2025-52392 - https://www.exploit-db.com/exploits/52416
CVE ID: CVE-2025-52395 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T16:03:31.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.roadcube.com/ - https://github.com/Arakiba/CVEs/tree/main/CVE-2025-52395
CVE ID: CVE-2025-52410 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T15:33:46.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is not adequately sanitized before being used in SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mathurvishal/Institute-of-Current-Students---PHP-Project/issues/2
CVE ID: CVE-2025-52424 State: PUBLISHED Published: 2025-10-03T18:11:04.091Z Last Updated: 2025-10-03T20:47:34.895Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52425 State: PUBLISHED Published: 2025-11-07T15:15:57.937Z Last Updated: 2025-11-07T15:55:26.440Z Vendors: QNAP Systems Inc. Products: QuMagie Problem Types: CWE-89 Description: An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QuMagie 2.7.0 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-33
CVE ID: CVE-2025-52427 State: PUBLISHED Published: 2025-10-03T18:11:10.864Z Last Updated: 2025-10-03T20:46:37.025Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52428 State: PUBLISHED Published: 2025-10-03T18:11:17.308Z Last Updated: 2025-10-03T20:46:24.803Z Vendors: QNAP Systems Inc. Products: QTS Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-52429 State: PUBLISHED Published: 2025-10-03T18:11:24.368Z Last Updated: 2025-10-03T20:46:16.009Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-134 Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.c
CVE ID: CVE-2025-52432 State: PUBLISHED Published: 2025-10-03T18:11:30.922Z Last Updated: 2025-10-03T20:46:02.157Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later and later QuTS hero h5.2.6.3195 build 20250715 and later QuTS hero h5.3.0.3192 build 20250716 and later Additional Analyst Notes: - CISA ADP Vul
.6.3195 build 20250715 and later QuTS hero h5.3.0.3192 build 20250716 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-36
CVE ID: CVE-2025-52433 State: PUBLISHED Published: 2025-10-03T18:11:36.758Z Last Updated: 2025-10-03T19:13:27.504Z Vendors: QNAP Systems Inc. Products: QTS, QuTS hero Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security
CVE ID: CVE-2025-52434 State: PUBLISHED Published: 2025-07-10T19:03:47.225Z Last Updated: 2025-11-04T21:11:38.474Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-362 Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are rec
ated but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.107, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030
CVE ID: CVE-2025-52437 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:08.871Z Description: No description available.
CVE ID: CVE-2025-52438 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:08.073Z Description: No description available.
CVE ID: CVE-2025-52439 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:07.623Z Description: No description available.
CVE ID: CVE-2025-52440 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:07.144Z Description: No description available.
CVE ID: CVE-2025-52441 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:06.675Z Description: No description available.
CVE ID: CVE-2025-52442 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:06.197Z Description: No description available.
CVE ID: CVE-2025-52443 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:05.722Z Description: No description available.
CVE ID: CVE-2025-52444 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:05.165Z Description: No description available.
CVE ID: CVE-2025-52445 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:55:04.585Z Description: No description available.
CVE ID: CVE-2025-52446 State: PUBLISHED Published: 2025-07-25T18:43:13.357Z Last Updated: 2025-07-25T18:59:45.501Z Vendors: Salesforce Products: Tableau Server Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005105043&type=1