Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54491 State: PUBLISHED Published: 2025-08-25T13:53:46.586Z Last Updated: 2025-11-03T18:13:32.550Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9191 of biosig.c on the current master branch (35a819fa), when the Tag is 65: else if (tag==65) /
lity manifests on line 9191 of biosig.c on the current master branch (35a819fa), when the Tag is 65: else if (tag==65) //0x41: patient event { // event table curPos += ifread(buf,1,len,hdr); Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE ID: CVE-2025-54492 State: PUBLISHED Published: 2025-08-25T13:53:46.704Z Last Updated: 2025-11-03T18:13:33.495Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9141 of biosig.c on the current master branch (35a819fa), when the Tag is 67: else if (tag==67) /
lity manifests on line 9141 of biosig.c on the current master branch (35a819fa), when the Tag is 67: else if (tag==67) //0x43: Sample skew { int skew=0; // [1] curPos += ifread(&skew, 1, len,hdr); In this case, the address of the newly-defined integer `skew` \[1\] is overflowed instead of `buf`. This means a stack overflow can occur using much smaller values of `len` in this code path. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE ID: CVE-2025-54493 State: PUBLISHED Published: 2025-08-25T13:53:46.822Z Last Updated: 2025-11-03T18:13:34.435Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9184 of biosig.c on the current master branch (35a819fa), when the Tag is 131: else if (tag==131)
lity manifests on line 9184 of biosig.c on the current master branch (35a819fa), when the Tag is 131: else if (tag==131) //0x83 { // Patient Age if (len!=7) fprintf(stderr,"Warning MFER tag131 incorrect length %i!=7\n",len); curPos += ifread(buf,1,len,hdr); Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE ID: CVE-2025-54494 State: PUBLISHED Published: 2025-08-25T13:53:46.942Z Last Updated: 2025-11-03T18:13:35.370Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9205 of biosig.c on the current master branch (35a819fa), when the Tag is 133: else if (tag==133)
lity manifests on line 9205 of biosig.c on the current master branch (35a819fa), when the Tag is 133: else if (tag==133) //0x85 { curPos += ifread(buf,1,len,hdr); Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE ID: CVE-2025-54496 State: PUBLISHED Published: 2025-11-04T21:36:46.018Z Last Updated: 2025-11-04T21:46:35.254Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT-6 Problem Types: CWE-122 Description: A maliciously crafted project file may cause a heap-based buffer overflow in Fuji Electric Monitouch V-SFT-6, which may allow the attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://felib.fujielectric.co.jp/en/document_search?tab=software&document1%5B1%5D=M10009&document2%5B1%5D=M20104&product1%5B1%5D=P10003&product2%5B1%5D=P20023&product3%5B1%5D=P30623&product4%5B1%5
B1%5D=M10009&document2%5B1%5D=M20104&product1%5B1%5D=P10003&product2%5B1%5D=P20023&product3%5B1%5D=P30623&product4%5B1%5D=S11133&discontinued%5B1%5D=0&count=20&sort=en_title&page=1&region=en-glb - https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-01.json
CVE ID: CVE-2025-54497 State: PUBLISHED Published: 2025-09-18T21:24:05.023Z Last Updated: 2025-09-19T13:12:37.793Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Cognex Products: In-Sight 2000 series, In-Sight 7000 series, In-Sight 8000 series, In-Sight 9000 series, In-Sight Explorer Problem Types: CWE-732 Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication. A user with protected privileges can successfully invoke the SetSerialPort functionality to modify relevant device properties (such as serial in
ivileges can successfully invoke the SetSerialPort functionality to modify relevant device properties (such as serial interface settings), contradicting the security model proposed in the user manual. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE ID: CVE-2025-54499 State: PUBLISHED Published: 2025-10-16T08:17:20.937Z Last Updated: 2025-10-16T13:51:10.320Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-208 Description: Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-54500 State: PUBLISHED Published: 2025-08-13T14:46:55.097Z Last Updated: 2025-11-03T20:06:30.935Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: F5 Products: BIG-IP, BIG-IP Next, BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes Problem Types: CWE-770 Description: An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - ht
t (EoTS) are not evaluated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000152001
CVE ID: CVE-2025-54515 State: PUBLISHED Published: 2025-11-23T17:15:28.948Z Last Updated: 2025-11-24T17:18:45.934Z Vendors: AMD Products: Versal™ Adaptive SoC Devices, Versal™ RF Series, Versal™ AI Edge Series, Versal™ Prime Series, Versal™ Premium Series, Versal™ AI Core Series, Versal™ HBM Series, Alveo™ V80 Compute Accelerator Problem Types: CWE-1284 Description: The Secure Flag passed to Versal™ Adaptive SoC’s Arm® Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the se
the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8020.html
CVE ID: CVE-2025-54520 State: PUBLISHED Published: 2025-09-24T21:29:03.846Z Last Updated: 2025-09-25T13:48:41.693Z Vendors: AMD Products: Kintex™ 7-Series FPGA, Artix™ 7-Series FPGA Problem Types: CWE-1247 Description: Improper Protection Against Voltage and Clock Glitches in FPGA devices, could allow an attacker with physical access to undervolt the platform resulting in a loss of confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8018.html
CVE ID: CVE-2025-54525 State: PUBLISHED Published: 2025-08-11T18:57:06.841Z Last Updated: 2025-08-11T19:40:57.217Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-1287 Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-54526 State: PUBLISHED Published: 2025-11-04T21:37:56.067Z Last Updated: 2025-11-04T21:46:06.843Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Monitouch V-SFT-6 Problem Types: CWE-121 Description: Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://felib.fujielectric.co.jp/en/document_search?tab=software&document1%5B1%5D=M10009&document2%5B1%5D=M20104&product1%5B1%5D=P10003&product2%5B1%5D=P20023&product3%5B1%5D=P3
oftware&document1%5B1%5D=M10009&document2%5B1%5D=M20104&product1%5B1%5D=P10003&product2%5B1%5D=P20023&product3%5B1%5D=P30623&product4%5B1%5D=S11133&discontinued%5B1%5D=0&count=20&sort=en_title&page=1&region=en-glb - https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-01.json
CVE ID: CVE-2025-54527 State: PUBLISHED Published: 2025-07-28T16:20:38.600Z Last Updated: 2025-07-28T17:26:29.884Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-1021 Description: In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54528 State: PUBLISHED Published: 2025-07-28T16:20:39.378Z Last Updated: 2025-07-28T17:41:56.186Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-352 Description: In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54529 State: PUBLISHED Published: 2025-07-28T16:20:40.171Z Last Updated: 2025-07-28T17:43:24.941Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-352 Description: In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54530 State: PUBLISHED Published: 2025-07-28T16:20:42.098Z Last Updated: 2025-07-29T03:55:21.431Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-276 Description: In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54531 State: PUBLISHED Published: 2025-07-28T16:20:42.843Z Last Updated: 2025-07-29T03:55:20.327Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L) Vendors: JetBrains Products: TeamCity Problem Types: CWE-23 Description: In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54532 State: PUBLISHED Published: 2025-07-28T16:20:43.516Z Last Updated: 2025-07-28T17:27:43.634Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-863 Description: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54533 State: PUBLISHED Published: 2025-07-28T16:20:44.053Z Last Updated: 2025-07-28T17:31:53.566Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-863 Description: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54534 State: PUBLISHED Published: 2025-07-28T16:20:44.842Z Last Updated: 2025-07-28T17:31:26.157Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54535 State: PUBLISHED Published: 2025-07-28T16:20:45.628Z Last Updated: 2025-07-28T17:29:53.025Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-328 Description: In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54536 State: PUBLISHED Published: 2025-07-28T16:20:46.257Z Last Updated: 2025-07-28T17:28:51.312Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-352 Description: In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54537 State: PUBLISHED Published: 2025-07-28T16:20:46.792Z Last Updated: 2025-07-28T17:28:27.931Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-312 Description: In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54538 State: PUBLISHED Published: 2025-07-28T16:20:47.459Z Last Updated: 2025-07-28T17:23:48.567Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-312 Description: In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-54539 State: PUBLISHED Published: 2025-10-16T08:26:06.766Z Last Updated: 2025-11-04T21:12:50.366Z Vendors: Apache Software Foundation Products: Apache ActiveMQ NMS AMQP Client Problem Types: CWE-502 Description: A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client. This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deser
may lead to arbitrary code execution on the client side. Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions. In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases. Mitigation and Recommendations: Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy. Additional Analyst No
AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xjmkz1g2n
CVE ID: CVE-2025-54540 State: PUBLISHED Published: 2025-08-28T10:12:29.653Z Last Updated: 2025-08-28T13:39:04.760Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst N
as tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/08/CVE-2025-54540 - https://opensolution.org
CVE ID: CVE-2025-54541 State: PUBLISHED Published: 2025-08-28T10:12:31.827Z Last Updated: 2025-08-28T13:37:34.787Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-352 Description: QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: -
d and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/08/CVE-2025-54540 - https://opensolution.org
CVE ID: CVE-2025-54542 State: PUBLISHED Published: 2025-08-28T10:12:38.118Z Last Updated: 2025-08-28T13:36:30.203Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-598 Description: QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
ions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/08/CVE-2025-54540 - https://opensolution.org
CVE ID: CVE-2025-54543 State: PUBLISHED Published: 2025-08-28T10:12:40.384Z Last Updated: 2025-08-28T13:34:08.399Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnera
pond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/08/CVE-2025-54540 - https://opensolution.org
CVE ID: CVE-2025-54544 State: PUBLISHED Published: 2025-08-28T10:12:42.041Z Last Updated: 2025-08-28T13:31:14.661Z Vendors: OpenSolution Products: QuickCMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulne
espond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/08/CVE-2025-54540 - https://opensolution.org
CVE ID: CVE-2025-54545 State: PUBLISHED Published: 2025-10-29T22:36:24.379Z Last Updated: 2025-10-30T14:14:49.068Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Arista Networks Products: DANZ Monitoring Fabric Problem Types: CWE-732 Description: On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/22538-security-advisory-0124