Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
values, allowing them to obtain products for free by setting extremely small quantities (e.g., 0.00001) that round cart totals to $0.00, effectively bypassing payment requirements and allowing unauthorized acquisition of virtual or downloadable products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b030aa28-5310-4f69-8b86-7e0b0bae741b?source=cve - https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492
CVE ID: CVE-2025-8098 State: PUBLISHED Published: 2025-08-18T20:05:41.030Z Last Updated: 2025-08-20T03:56:02.466Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: PC Manager Problem Types: CWE-276 Description: An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/430658
CVE ID: CVE-2025-8100 State: PUBLISHED Published: 2025-08-06T03:40:59.487Z Last Updated: 2025-08-06T19:27:48.440Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Addons for Elementor – Mega Menu, Header Footer, Dynamic Builder and Ready Templates Problem Types: CWE-79 Description: The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject
output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f5d3585-19fe-4e85-87d0-7f4c62944146?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-open-street-map.js#L57 - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/open-street-map/widgets/open-street-map.php#L498 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sf
nk/modules/open-street-map/widgets/open-street-map.php#L498 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3339093%40bdthemes-element-pack-lite&new=3339093%40bdthemes-element-pack-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8101 State: PUBLISHED Published: 2025-07-25T21:52:47.287Z Last Updated: 2025-07-28T14:56:39.776Z Vendors: Linkify Products: Linkify Problem Types: CWE-1321 Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/charly - https://github.com/nfrasser/linkifyjs - https://www.npmjs.com/package/linkifyjs - https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2
CVE ID: CVE-2025-8102 State: PUBLISHED Published: 2025-08-20T11:26:09.579Z Last Updated: 2025-08-20T13:18:10.325Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-352 Description: The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged reques
s it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/636c9d92-ee62-499d-8d73-33cd63bb5af8?source=cve - https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.5.0/includes/deprecated-functions.php#L1678 - https://wordpress.org/plugins/easy-digital-downloads/#developers - https://plugins.trac.wordpress.org/changeset/3346633/easy-digital-downloads/trunk/includes/deprecated-functions.php?old=3
ttps://plugins.trac.wordpress.org/changeset/3346633/easy-digital-downloads/trunk/includes/deprecated-functions.php?old=3328623&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fdeprecated-functions.php
CVE ID: CVE-2025-8103 State: PUBLISHED Published: 2025-07-26T03:38:18.084Z Last Updated: 2025-07-28T18:58:33.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: etruel Products: WPeMatico RSS Feed Fetcher Problem Types: CWE-352 Description: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to missing nonce validation in the handle_feedback_submission() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4473de39-a122-4c2e-9f64-50157b589a28?source=cve - https://plugins.trac.wordpress.org/browser/wpematico/tags/2.8.7/app/plugin_functions.php#L207 - https://wordpress.org/plugins/wpematico/#developers - https://plugins.trac.wordpress.org/changeset/3333908/ - https://www.wpematico.com/releases/
CVE ID: CVE-2025-8104 State: PUBLISHED Published: 2025-07-27T04:23:39.777Z Last Updated: 2025-07-28T14:58:10.995Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sminozzi Products: Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions Problem Types: CWE-352 Description: The Memory Usage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.98. This is due to missing nonce validation in the wpmemory_install_plugin() function. This makes it possible for unauthenticated attackers to silently install one of the several whitelisted plugins via a forged request granted they can tri
enticated attackers to silently install one of the several whitelisted plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbaf06b2-9ac3-4882-9212-fdcecdc5fb8c?source=cve - https://plugins.trac.wordpress.org/browser/wp-memory/tags/3.98/wpmemory.php#L376 - https://wordpress.org/plugins/wp-memory/#developers - https://plugins.trac.wordpress.org/changeset/3333316
CVE ID: CVE-2025-8105 State: PUBLISHED Published: 2025-08-16T11:11:24.459Z Last Updated: 2025-08-18T18:01:30.578Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: pencidesign Products: Soledad Problem Types: CWE-94 Description: The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
ute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6c842bb-914a-47c1-aaac-e748f58e12ef?source=cve - https://themeforest.net/item/soledad-multiconcept-blogmagazine-wp-theme/12945398#item-description__update-changelog
CVE ID: CVE-2025-8107 State: PUBLISHED Published: 2025-07-24T07:12:13.878Z Last Updated: 2025-07-31T09:10:09.184Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: OB Products: OceanBase Server Problem Types: CWE-668, CWE-269 Description: In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafted commands. This vulnerability only affects OceanBase tenants in Oracle mode. Tenants in MySQL mode are unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oceanbase/oceanbase/security
CVE ID: CVE-2025-8108 State: PUBLISHED Published: 2025-11-11T07:10:31.421Z Last Updated: 2025-11-12T04:57:47.920Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-1287, CWE-732 Description: An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
victim to install a malicious ACAP application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/38/20/aa/cve-2025-8108pdf-en-US-504218.pdf
CVE ID: CVE-2025-8109 State: PUBLISHED Published: 2025-08-04T13:14:20.850Z Last Updated: 2025-09-08T19:43:47.586Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-280 Description: Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2025-8113 State: PUBLISHED Published: 2025-08-16T06:00:05.425Z Last Updated: 2025-08-18T18:59:49.339Z Vendors: Unknown Products: Ebook Store Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/752908b4-7d05-476f-8920-1d0e58fc2983/
CVE ID: CVE-2025-8114 State: PUBLISHED Published: 2025-07-24T14:14:47.745Z Last Updated: 2025-11-17T20:31:35.902Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-476 Description: A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or ser
cation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-8114 - https://bugzilla.redhat.com/show_bug.cgi?id=2383220 - https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d - https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9 - https://www.libssh.org/security/advisories/CVE-2025-8114.txt
CVE ID: CVE-2025-8115 State: PUBLISHED Published: 2025-07-24T18:32:06.650Z Last Updated: 2025-07-24T18:39:32.415Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Taxi Stand Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/new-autoortaxi-entry-form.php. The manipulation of the argument registrationnumber/licensenumber leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Ad
ss site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317497 - https://vuldb.com/?ctiid.317497 - https://vuldb.com/?submit.619641 - https://vuldb.com/?submit.619643 - https://github.com/LagonGit/ReportCVE/issues/11 - https://phpgurukul.com/
CVE ID: CVE-2025-8116 State: PUBLISHED Published: 2025-09-30T10:04:25.946Z Last Updated: 2025-09-30T19:13:04.145Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-79 Description: PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary JavaScript execution in victim's browser, when opened. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7063
CVE ID: CVE-2025-8117 State: PUBLISHED Published: 2025-09-30T10:04:38.373Z Last Updated: 2025-09-30T19:13:51.495Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-909 Description: PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that did not use reset password functionality. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7063
CVE ID: CVE-2025-8118 State: PUBLISHED Published: 2025-09-30T10:04:46.284Z Last Updated: 2025-09-30T19:14:22.705Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-307 Description: PAD CMS implements weak client-side brute-force protection by utilizing two cookies: login_count and login_timeout. Information about attempt count or timeout is not stored on the server, which allows a malicious attacker to bypass this brute-force protection by resetting those cookies. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
nd producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7063
CVE ID: CVE-2025-8119 State: PUBLISHED Published: 2025-09-30T10:04:54.900Z Last Updated: 2025-09-30T19:14:50.548Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-352 Description: PAD CMS is vulnerable to Cross-Site Request Forgery in reset password's functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send a POST request changing currently logged user's password to defined by the attacker value. This issue affects all 3 templates: www, bip and www+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ducent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7063
CVE ID: CVE-2025-8120 State: PUBLISHED Published: 2025-09-30T10:05:03.496Z Last Updated: 2025-09-30T19:15:27.470Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-434 Description: Due to client-controlled permission check parameter, PAD CMS's upload photo functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution.This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/
CVE ID: CVE-2025-8121 State: PUBLISHED Published: 2025-09-30T10:05:13.295Z Last Updated: 2025-09-30T19:15:53.681Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-89 Description: Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7063
CVE ID: CVE-2025-8122 State: PUBLISHED Published: 2025-09-30T10:05:21.046Z Last Updated: 2025-09-30T19:16:36.187Z Vendors: Polska Akademia Dostępności Products: PAD CMS Problem Types: CWE-89 Description: Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/09/CVE-2025-7063
CVE ID: CVE-2025-8123 State: PUBLISHED Published: 2025-07-24T21:02:11.636Z Last Updated: 2025-07-25T13:33:28.509Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. The manipulation of the argument ancestors leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317508 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317508 - https://vuldb.com/?ctiid.317508 - https://vuldb.com/?submit.619691 - https://gitee.com/deerwms/deer-wms-2/issues/ICLRFL
CVE ID: CVE-2025-8124 State: PUBLISHED Published: 2025-07-24T23:32:09.717Z Last Updated: 2025-07-25T13:24:20.778Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/unallocatedList. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317509 - https://vuldb.com/?ctiid.317509 - https://vuldb.com/?submit.619692 - https://gitee.com/deerwms/deer-wms-2/issues/ICLRF0
CVE ID: CVE-2025-8125 State: PUBLISHED Published: 2025-07-25T01:02:18.021Z Last Updated: 2025-07-25T13:16:48.334Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/role/authUser/allocatedList. The manipulation of the argument params[dataScope] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317510 - https://vuldb.com/?ctiid.317510 - https://vuldb.com/?submit.619693 - https://gitee.com/deerwms/deer-wms-2/issues/ICLRE9
CVE ID: CVE-2025-8126 State: PUBLISHED Published: 2025-07-25T01:32:09.707Z Last Updated: 2025-07-25T12:02:53.450Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/user/export. The manipulation of the argument params[dataScope] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317511 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317511 - https://vuldb.com/?ctiid.317511 - https://vuldb.com/?submit.619694 - https://gitee.com/deerwms/deer-wms-2/issues/ICLQUE
CVE ID: CVE-2025-8127 State: PUBLISHED Published: 2025-07-25T03:02:11.856Z Last Updated: 2025-07-25T16:47:17.399Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: deerwms Products: deer-wms-2 Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. This vulnerability affects unknown code of the file /system/user/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317512 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317512 - https://vuldb.com/?ctiid.317512 - https://vuldb.com/?submit.619695 - https://gitee.com/deerwms/deer-wms-2/issues/ICLQT8
CVE ID: CVE-2025-8128 State: PUBLISHED Published: 2025-07-25T03:32:05.309Z Last Updated: 2025-07-25T16:40:38.292Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: zhousg Products: letao Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue affects some unknown processing of the file routes\bf\product.js. The manipulation of the argument pictrdtz leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provi
e exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317513 - https://vuldb.com/?ctiid.317513 - https://vuldb.com/?submit.619740 - https://github.com/zhousg/letao/issues/13 - https://github.com/zhousg/letao/issues/13#issue-2977017027