Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11112 State: PUBLISHED Published: 2025-09-28T17:02:07.028Z Last Updated: 2025-09-29T13:16:45.906Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Employee Record Management System Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in PHPGurukul Employee Record Management System 1.3. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument First name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326193 - https://vuldb.com/?ctiid.326193 - https://vuldb.com/?submit.662498 - https://github.com/tiancesec/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-11113 State: PUBLISHED Published: 2025-09-28T17:32:08.425Z Last Updated: 2025-09-29T13:15:07.040Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Online Leave Application Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326194
might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326194 - https://vuldb.com/?ctiid.326194 - https://vuldb.com/?submit.662695 - https://github.com/yihaofuweng/cve/issues/39 - https://codeastro.com/
CVE ID: CVE-2025-11114 State: PUBLISHED Published: 2025-09-28T18:02:06.037Z Last Updated: 2025-09-29T13:03:43.551Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Online Leave Application Problem Types: CWE-89, CWE-74 Description: A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence[] can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326195 -
blished and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326195 - https://vuldb.com/?ctiid.326195 - https://vuldb.com/?submit.662699 - https://github.com/yihaofuweng/cve/issues/40 - https://codeastro.com/
CVE ID: CVE-2025-11115 State: PUBLISHED Published: 2025-09-28T18:32:05.083Z Last Updated: 2025-09-29T12:59:59.532Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the file /addtime.php. The manipulation of the argument starttime/endtime leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326196 - https://vuldb.com/?ctiid.326196 - https://vuldb.com/?submit.662700 - https://github.com/yihaofuweng/cve/issues/41 - https://code-projects.org/
CVE ID: CVE-2025-11116 State: PUBLISHED Published: 2025-09-28T19:02:05.284Z Last Updated: 2025-09-29T12:59:16.839Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argument faculty results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
ameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326197 - https://vuldb.com/?ctiid.326197 - https://vuldb.com/?submit.662701 - https://github.com/yihaofuweng/cve/issues/42 - https://code-projects.org/
CVE ID: CVE-2025-11117 State: PUBLISHED Published: 2025-09-28T19:32:06.992Z Last Updated: 2025-09-29T12:56:12.820Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: CH22 Problem Types: CWE-120, CWE-119 Description: A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326198 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326198 - https://vuldb.com/?ctiid.326198 - https://vuldb.com/?submit.662927 - https://github.com/zhaoyinshan/CVE/issues/2 - https://www.tenda.com.cn/
CVE ID: CVE-2025-11118 State: PUBLISHED Published: 2025-09-28T20:02:06.183Z Last Updated: 2025-09-29T14:46:56.033Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Student Grading System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.php. Such manipulation of the argument staffId leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326199 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326199 - https://vuldb.com/?ctiid.326199 - https://vuldb.com/?submit.663115 - https://github.com/Clw309/CVE/issues/2 - https://codeastro.com/
CVE ID: CVE-2025-11119 State: PUBLISHED Published: 2025-09-28T20:32:06.429Z Last Updated: 2025-09-29T14:07:06.147Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Hostel Management System Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the component POST Request Handler. Performing manipulation of the argument from results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vul
ack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326200 - https://vuldb.com/?ctiid.326200 - https://vuldb.com/?submit.663519 - https://github.com/iflame28/CVE/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-11120 State: PUBLISHED Published: 2025-09-28T21:02:06.820Z Last Updated: 2025-09-29T14:06:07.932Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC8 Problem Types: CWE-120, CWE-119 Description: A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326201 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326201 - https://vuldb.com/?ctiid.326201 - https://vuldb.com/?submit.664065 - https://github.com/alc9700jmo/CVE/issues/19 - https://www.tenda.com.cn/
CVE ID: CVE-2025-11121 State: PUBLISHED Published: 2025-09-28T21:32:06.431Z Last Updated: 2025-09-29T14:05:17.353Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC18 Problem Types: CWE-77, CWE-74 Description: A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326202 - https://vuldb.com/?ctiid.326202 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326202 - https://vuldb.com/?ctiid.326202 - https://vuldb.com/?submit.664191 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/AdvSetLanip.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11122 State: PUBLISHED Published: 2025-09-28T22:02:07.639Z Last Updated: 2025-09-29T12:08:29.541Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC18 Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in Tenda AC18 15.03.05.19. This affects an unknown function of the file /goform/WizardHandle. The manipulation of the argument WANT/mtuvalue results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326203 - https://vuldb.com/?ctiid.326203 - https://vuldb.com/?sub
ADP Vulnrichment: References: - https://vuldb.com/?id.326203 - https://vuldb.com/?ctiid.326203 - https://vuldb.com/?submit.664194 - https://vuldb.com/?submit.664195 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WizardHandle.md - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WizardHandle2.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-11123 State: PUBLISHED Published: 2025-09-28T22:32:07.327Z Last Updated: 2025-09-29T12:05:30.528Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC18 Problem Types: CWE-121, CWE-119 Description: A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /goform/saveAutoQos. This manipulation of the argument enable causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326204 - https://vuldb.com/?ctiid.326204 - https://vuldb.com/?submit.664197 -
hment: References: - https://vuldb.com/?id.326204 - https://vuldb.com/?ctiid.326204 - https://vuldb.com/?submit.664197 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/saveAutoQos.md - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/saveAutoQos.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-11124 State: PUBLISHED Published: 2025-09-28T23:02:05.673Z Last Updated: 2025-09-29T12:04:30.207Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Project Monitoring System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in code-projects Project Monitoring System 1.0. Affected is an unknown function of the file /onlineJobSearchEngine/postjob.php. Such manipulation of the argument txtapplyto leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP
sclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326205 - https://vuldb.com/?ctiid.326205 - https://vuldb.com/?submit.664309 - https://github.com/asd1238525/cve/blob/main/xss4.md - https://github.com/asd1238525/cve/blob/main/xss4.md#poc - https://code-projects.org/
CVE ID: CVE-2025-11125 State: PUBLISHED Published: 2025-09-28T23:32:05.582Z Last Updated: 2025-09-29T12:03:18.295Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: langleyfcu Products: Online Banking System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. Affected by this vulnerability is an unknown functionality of the file /connection_error.php of the component Error Message Handler. Performing manipulation of the argument Error results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. T
oss site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326206 - https://vuldb.com/?ctiid.326206 - https://vuldb.com/?submit.664319 - https://github.com/Lianhaorui/Report/blob/main/xss.docx
CVE ID: CVE-2025-11126 State: PUBLISHED Published: 2025-09-29T00:02:05.583Z Last Updated: 2025-09-29T12:00:34.530Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR) Vendors: Apeman Products: ID71 Problem Types: CWE-798, CWE-259 Description: A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation results in hard-coded credentials. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
acted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326209 - https://vuldb.com/?ctiid.326209 - https://vuldb.com/?submit.654168
CVE ID: CVE-2025-11127 State: PUBLISHED Published: 2025-11-21T13:41:07.728Z Last Updated: 2025-11-21T14:23:36.421Z Vendors: Unknown Products: Mstoreapp Mobile App, Mstoreapp Mobile Multivendor Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6432bd1a-6e44-4a3f-890b-df2bd877d626/
CVE ID: CVE-2025-11128 State: PUBLISHED Published: 2025-10-23T12:32:32.611Z Last Updated: 2025-10-23T13:39:12.823Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: themeisle Products: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Problem Types: CWE-918 Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web req
s' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c33ec58f-3e83-425a-9f0f-5e529be15e05?source=cve - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L280 - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L309 - https://plugins.trac.w
org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L309 - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L336 - https://plugins.trac.wordpress.org/browser/feedzy-rss-feeds/trunk/includes/gutenberg/feedzy-rss-feeds-gutenberg-block.php#L399 - https://plugins.trac.wordpress.org/changeset/3378828/
CVE ID: CVE-2025-11129 State: PUBLISHED Published: 2025-11-11T03:30:51.423Z Last Updated: 2025-11-12T20:04:49.872Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mheob Products: Include Fussball.de Widgets Problem Types: CWE-79 Description: The Include Fussball.de Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api' and 'type' parameters in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a3df32-aa07-4cc0-97ba-bb4ab64ba6b9?source=cve - https://plugins.trac.wordpress.org/browser/include-fussball-de-widgets/trunk/Frontend/Fubade.php#L231 - https://plugins.trac.wordpress.org/browser/include-fussball-de-widgets/trunk/Frontend/Fubade.php#L232
CVE ID: CVE-2025-11130 State: PUBLISHED Published: 2025-09-29T00:32:06.122Z Last Updated: 2025-09-29T11:59:04.849Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: iHongRen Products: pptp-vpn Problem Types: CWE-306, CWE-287 Description: A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTool.m of the component XPC Service. This manipulation causes missing authentication. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did
s been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326210 - https://vuldb.com/?ctiid.326210 - https://vuldb.com/?submit.655456 - https://github.com/SwayZGl1tZyyy/n-days/blob/main/pptp-vpn/README.md
CVE ID: CVE-2025-11134 State: PUBLISHED Published: 2025-09-29T01:02:05.150Z Last Updated: 2025-09-29T11:50:13.674Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Cudy Products: TR1200 Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in Cudy TR1200 1.16.3-20230804-164635. Impacted is an unknown function of the file /cgi-bin/luci/admin/network/wireless/config/ of the component Wireless Settings Page. Such manipulation of the argument SSID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but
otely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326211 - https://vuldb.com/?ctiid.326211 - https://vuldb.com/?submit.656886 - https://github.com/blackcloud411/Cudy_vuln/blob/main/CUDY_TR1200_XSS_Report.docx
CVE ID: CVE-2025-11135 State: PUBLISHED Published: 2025-09-29T01:32:06.825Z Last Updated: 2025-09-29T12:54:26.794Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: pmTicket Products: Project-Management-Software Problem Types: CWE-502, CWE-20 Description: A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. The affected element is the function loadLanguage of the file classes/class.database.php of the component Cookie Handler. Performing manipulation of the argument user_id results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery
in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326212 - https://vuldb.com/?ctiid.326212 - https://vuldb.com/?submit.657302 - https://drive.google.com/file/d/18T4Gpzic0OQ-hzZWR6YoJ127QV3Jxyxe/view - https://asciinema.org/a/kTWHQMM7n6QH98gGCW3e7T9xT
CVE ID: CVE-2025-11136 State: PUBLISHED Published: 2025-09-29T02:02:05.045Z Last Updated: 2025-09-29T12:47:12.143Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: YiFang Products: CMS Problem Types: CWE-434, CWE-284 Description: A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326213 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326213 - https://vuldb.com/?ctiid.326213 - https://vuldb.com/?submit.657903 - https://github.com/electroN1chahaha/YifangCMS-V2.0.0-Remote-Code-Execution-RCE-/issues/1
CVE ID: CVE-2025-11137 State: PUBLISHED Published: 2025-09-29T02:32:05.673Z Last Updated: 2025-09-29T12:29:33.417Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: Gstarsoft Products: GstarCAD Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Gstarsoft GstarCAD up to 9.4.0. This affects an unknown function of the component File Renaming Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Applying a patch is the recommended action to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
ended action to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.326214 - https://vuldb.com/?ctiid.326214 - https://vuldb.com/?submit.652764 - https://github.com/coolcj-stack/-CAD-GstarCAD-Viewer-Web-V9.4.0-Stored-Cross-Site-Scripting-XSS