Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-57452 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-18T20:38:25.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: In realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash and potential XSS via crafted ADB intents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://realme.com/ - https://gist.github.com/Brucewebva/8a37010c5b1f05fd5e61591830bcbb37
CVE ID: CVE-2025-57457 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T19:31:40.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://curo.com - https://github.com/restdone/CVE-2025-57457/tree/main
CVE ID: CVE-2025-57483 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-09-29T18:45:01.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the vulnerable parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ticketsmonk.com/events/details/412291 - https://github.com/Jainil-89/CVE/blob/main/cve.md
CVE ID: CVE-2025-57515 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T19:16:55.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnerable input fields, enabling the execution of time-delay functions to infer database responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanchitsahni/CVE-2025-57515/blob/main/Uniclare%20Student%20Portal%20v2.pdf - https://github.com/sanchitsahni/CVE-2025-57515/
CVE ID: CVE-2025-57516 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-10-28T20:28:23.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command injection vulnerability in PublicCMS PublicCMS-V5.202506.a, and PublicCMS-V5.202506.b allowing attackers to execute arbitrary commands via crafted DATABASE, USERNAME, or PASSWORD variables to the backupDB.bat file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sanluan/PublicCMS/issues/97
CVE ID: CVE-2025-57520 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-11T18:26:06.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized before being rendered in the content preview pane. This enables an attacker to inject arbitrary JavaScript which executes whenever a user views the preview panel. The vulnerability affects multiple input vectors and does not require user interaction beyond viewing the affected content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://onurcang
n beyond viewing the affected content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://onurcangenc.com.tr/blog/decap-cms-xss-analysis - https://github.com/decaporg/decap-cms - https://onurcangenc.com.tr/posts/cve-2025-57520--stored-xss-in-decap-cms-3-8-3/
CVE ID: CVE-2025-57521 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T19:11:33.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a network plugin without validating its digital signature or verifying its authenticity. A local attacker can exploit this behavior by placing a malicious component in the expected location, which is controllable by the attacker (e.g., under %APPDATA%), resulting in code execution within the context of the user. The main application is digitally signed, which may allow a
resulting in code execution within the context of the user. The main application is digitally signed, which may allow a malicious component to inherit trust and evade detection by security solutions that rely on signed parent processes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bambulab/BambuStudio/issues/7405 - https://github.com/piuppi/Proof-of-Concepts/blob/main/Bambu%20Lab/Bambu%20Studio/README.md - https://wiki.bambulab.com/en/software/bambu-studio/release/release-note-2-3-0
CVE ID: CVE-2025-57528 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T14:55:11.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tendaAc6_formSetCfm_funcname_overflow/detail.md
CVE ID: CVE-2025-57538 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:34.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss - https://w
s: - CISA ADP Vulnrichment: References: - https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss - https://www.youtube.com/watch?v=mN-0Zia1LZw - https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010
CVE ID: CVE-2025-57539 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:28.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss - https://www.youtube.com/watch?v=-wvkN-7oT5U -
es: - https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss - https://www.youtube.com/watch?v=-wvkN-7oT5U - https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010
CVE ID: CVE-2025-57540 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:22.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss - https://www.youtube.com/watch?v=-wvkN-7oT5U - https://forum.pro
ub.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss - https://www.youtube.com/watch?v=-wvkN-7oT5U - https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010
CVE ID: CVE-2025-57563 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T18:24:54.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.starnet.com/fastx/ - https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md?ref_type=heads
CVE ID: CVE-2025-57564 State: PUBLISHED Published: 2025-10-07T00:00:00.000Z Last Updated: 2025-10-08T13:32:44.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform unauthorized log injection. Exploitation may lead to false log entries, log poisoning, alert obfuscation, and potential performance degradation of the observability pipeline. The issue is present in the core CubeAPM platform an
nd potential performance degradation of the observability pipeline. The issue is present in the core CubeAPM platform and is not limited to specific deployment configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/prassan10/CubeAPM/blob/main/Unauthenticated-Log_Injection - https://github.com/prassan10/CubeAPM/blob/main/CVE-2025-57564%3A%20Unauthenticated%20Log%20Injection%20in%20CubeAPM
CVE ID: CVE-2025-57567 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-17T15:45:59.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pluxml.com - https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-57567.pdf
CVE ID: CVE-2025-57569 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T20:10:00.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the portList parameter in /goform/setNAT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57569/C.V.E-2025-57569.md
CVE ID: CVE-2025-57570 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T20:26:43.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the QosList parameter in goform/setQoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57570/C.V.E-2025-57570.md
CVE ID: CVE-2025-57571 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T19:55:50.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow. via the macFilterList parameter in goform/setNAT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57571/C.V.E-2025-57571.md
CVE ID: CVE-2025-57572 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T20:29:38.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the onlineList parameter in goform/setParentControl. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57572/C.V.E-2025-57572.md
CVE ID: CVE-2025-57573 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T20:18:50.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda F3 V12.01.01.48_multi and after is vulnerable to Buffer Overflow via the wifiTimeClose parameter in goform/setWifi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/arashiclustar/PingX-md/blob/main/F3/2025-57573/C.V.E-2025-57573.md
CVE ID: CVE-2025-57576 State: PUBLISHED Published: 2025-09-04T00:00:00.000Z Last Updated: 2025-09-04T20:05:43.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) in /admin/updateorder.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/p0et08/DWrwq/blob/main/README.md
CVE ID: CVE-2025-57577 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T12:42:54.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the default password. NOTE: the Supplier's position is that their "product lines enforce or clearly prompt users to change any initial credentials upon first use. At most, this would be a case of misconfiguration if an administrator deliberately ignored the prompts, which is outside the scope of CVE definitions." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.h3c.com/cn/ - https://github.com/XXRicardo/
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.h3c.com/cn/ - https://github.com/XXRicardo/iot-cve/blob/main/H3C/R365V300R004.md - https://h3c.com
CVE ID: CVE-2025-57578 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T15:56:16.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default password Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/XXRicardo/iot-cve/blob/main/H3C/M2V100R006.md
CVE ID: CVE-2025-57579 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T16:02:11.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/259/ids/36.html - https://github.com/XXRicardo/iot-cve/blob/main/TOLOLINK/X2000R-Gh-V2.0.0.md
CVE ID: CVE-2025-57601 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-23T18:13:57.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target device. The device then uses it to establish a reverse SSH tunnel to a remote access server, enabling browser-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all custom
er-based SSH access for the administrator. Because the same `proxyuser` account and SSH key are reused across all customer environments: - An attacker who obtains the key (e.g., by intercepting it in transit, extracting it from the remote access server, or from a compromised admin account) can impersonate any managed device. - They can establish unauthorized reverse SSH tunnels and interact with devices without the owner's consent. This is a design flaw in the authentication model: compromise of a single key compromises the trust boundary between the controller and devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shubhangborkar/aikaan-vulnerabiliti
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve1-shared-ssh-key.md
CVE ID: CVE-2025-57602 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-23T18:13:51.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the cloud controller, gain interactive shell access, and pivot into other connected IoT devices. This can lead to remote code execution, information disclosure, and privilege escalation across customer environments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shubhangborkar/aikaan-vulnerabilit
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve2-proxyuser-shell.md
CVE ID: CVE-2025-57605 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-23T18:13:46.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their privileges by assigning themselves as admins of other departments. This results in unauthorized privilege escalation across the department Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve5-department-switch.md
CVE ID: CVE-2025-57611 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:40:48.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the dump() method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check the return value of avfilter_graph_dump() for NULL, leading to a crash if the underlying memory allocation fails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issues/192
CVE ID: CVE-2025-57612 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:42:29.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check for a NULL return value from the av_get_sample_fmt_name() C function, which can be triggered by providing an unrecognized sample format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issues/192
CVE ID: CVE-2025-57613 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:36:51.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor function allows an attacker to cause a denial of service. The vulnerability is triggered when the avio_alloc_context() call fails and returns NULL, which is then stored and later dereferenced by the Io struct's Drop implementation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issues/192
CVE ID: CVE-2025-57614 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:44:19.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Integer overflow and invalid input vulnerability in the cached method allows an attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability occurs when dimension parameters are zero or exceed i32::MAX, leading to an unchecked cast that violates the underlying C function's preconditions and triggers undefined behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issu
fined behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issues/192
CVE ID: CVE-2025-57615 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:46:40.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor function allows an attacker to cause a denial of service via a null pointer dereference. The vulnerability stems from an unchecked cast of a usize parameter to c_int, which can result in a negative value being passed to the underlying C function sws_allocVec(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issues/192
CVE ID: CVE-2025-57616 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:47:58.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write_interleaved method allows an attacker to cause a denial of service or memory corruption. The method violates Rust's aliasing rules by modifying a data structure through a mutable pointer while only holding an immutable reference, which can lead to undefined behavior when the data is accessed later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meh/rust-ffmpeg/issues/192
CVE ID: CVE-2025-57618 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T18:26:10.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the application's configuration files, which contain the secret key used to sign JSON Web Tokens as well as existing JTIs. With this information, an attacker can forge valid JWTs, impersonate the root user, and achieve remote code execution in privileged context via authenticated endpoints. Additional Analyst Notes: - CISA ADP Vulnrichmen
emote code execution in privileged context via authenticated endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.starnet.com/fastx/ - https://www.starnet.com/help/fastx3-3-server-release-notes/ - https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md?ref_type=heads
CVE ID: CVE-2025-57623 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:02:31.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/z472421519/BinaryAudit/blob/main/PoC/NPD/TOTOLink/CONTENT_LENGTH.md - https://gist.github.com/z472421519/d17061ea79a72d39fe69c000fa1a6280
CVE ID: CVE-2025-57624 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T15:15:38.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple DLLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msry1.gitbook.io/thegoldenrecord/blog/vulnerability-and-bug-disclosures/cyrsma-sensor-version-less-than-2.5 - https://youtu.be/lZAdbrWt-34