Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10923 State: PUBLISHED Published: 2025-10-29T19:29:46.493Z Last Updated: 2025-10-31T03:55:14.539Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GIMP Products: GIMP Problem Types: CWE-190 Description: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WBMP files. The issue results from the lack of proper validation of user-supplied data, w
w exists within the parsing of WBMP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27878. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-912/ - https://gitlab.gnome.org/GNOME/gimp/-/commit/2d2d39f3da1d0b01ca7d71ad2b7a8725ee92ed96
CVE ID: CVE-2025-10924 State: PUBLISHED Published: 2025-10-29T19:29:50.398Z Last Updated: 2025-10-31T03:55:15.889Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GIMP Products: GIMP Problem Types: CWE-190 Description: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FF files. The issue results from the lack of proper validation of user-supplied data, which
exists within the parsing of FF files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27836. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-913/ - https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2448
CVE ID: CVE-2025-10925 State: PUBLISHED Published: 2025-10-29T19:29:54.680Z Last Updated: 2025-10-31T03:55:16.818Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GIMP Products: GIMP Problem Types: CWE-121 Description: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length
pecific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27793. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-914/ - https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/2450
CVE ID: CVE-2025-10926 State: PUBLISHED Published: 2025-10-29T23:12:56.914Z Last Updated: 2025-10-30T14:43:55.094Z Vendors: Drupal Products: JSON Field Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-106
CVE ID: CVE-2025-10927 State: PUBLISHED Published: 2025-10-29T23:13:12.338Z Last Updated: 2025-10-30T14:42:43.207Z Vendors: Drupal Products: Plausible tracking Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-107
CVE ID: CVE-2025-10928 State: PUBLISHED Published: 2025-10-29T23:13:25.064Z Last Updated: 2025-10-30T13:07:25.555Z Vendors: Drupal Products: Access code Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-108
CVE ID: CVE-2025-10929 State: PUBLISHED Published: 2025-10-29T23:14:07.047Z Last Updated: 2025-10-30T13:31:48.665Z Vendors: Drupal Products: Reverse Proxy Header Problem Types: CWE-1288 Description: Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-111
CVE ID: CVE-2025-10930 State: PUBLISHED Published: 2025-10-29T23:13:54.547Z Last Updated: 2025-10-30T13:27:10.721Z Vendors: Drupal Products: Currency Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-110
CVE ID: CVE-2025-10931 State: PUBLISHED Published: 2025-10-29T23:13:40.417Z Last Updated: 2025-10-30T14:15:53.377Z Vendors: Drupal Products: Umami Analytics Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-109
CVE ID: CVE-2025-10932 State: PUBLISHED Published: 2025-10-29T14:12:33.439Z Last Updated: 2025-10-29T14:33:14.601Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Progress Products: MOVEit Transfer Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-CVE-2025-10932-October-29-2025
CVE ID: CVE-2025-10934 State: PUBLISHED Published: 2025-10-29T19:58:55.670Z Last Updated: 2025-11-04T00:12:05.168Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GIMP Products: GIMP Problem Types: CWE-122 Description: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of the length of
cific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27823. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-978/ - https://gitlab.gnome.org/GNOME/gimp/-/commit/5c3e2122d53869599d77ef0f1bdece117b24fd7c
CVE ID: CVE-2025-10937 State: PUBLISHED Published: 2025-10-23T18:24:39.764Z Last Updated: 2025-10-23T19:11:36.103Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Oxford Nano Technologies Products: MinKNOW Problem Types: CWE-754 Description: Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system cal
user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-294-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json - https://nanoporetech.com/software/ - https://nanoporetech.com/about/contact
CVE ID: CVE-2025-10938 State: PUBLISHED Published: 2025-11-21T07:31:55.890Z Last Updated: 2025-11-21T14:56:39.398Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: admintwentytwenty Products: UiPress lite | Effortless custom dashboards, admin themes and pages Problem Types: CWE-862 Description: The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user data including password hashes,
henticated attackers, with subscriber-level access and above, to extract sensitive user data including password hashes, emails, and other user information that could be used for account takeover attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8aa06eb-774a-4cd9-bd35-2d6409475696?source=cve - https://wordpress.org/plugins/uipress-lite/
CVE ID: CVE-2025-10939 State: PUBLISHED Published: 2025-10-28T03:08:30.103Z Last Updated: 2025-11-13T22:33:58.213Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.4 Problem Types: CWE-427 Description: A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed. Additional Analyst Notes: - CISA ADP Vulnrichment: R
plication path relative to /realms which is expected to be exposed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:21370 - https://access.redhat.com/errata/RHSA-2025:21371 - https://access.redhat.com/security/cve/CVE-2025-10939 - https://bugzilla.redhat.com/show_bug.cgi?id=2398025
CVE ID: CVE-2025-10940 State: PUBLISHED Published: 2025-09-25T10:32:05.445Z Last Updated: 2025-09-25T13:20:14.602Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Total.js Products: CMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page. Performing manipulation of the argument HTML results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
d could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325810 - https://vuldb.com/?ctiid.325810 - https://vuldb.com/?submit.651867
CVE ID: CVE-2025-10941 State: PUBLISHED Published: 2025-09-25T11:02:05.879Z Last Updated: 2025-09-30T07:50:25.350Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C) Vendors: Topaz Products: SERVCore Teller Problem Types: CWE-275, CWE-266 Description: A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0.40D.msi of the component Installer. Executing manipulation can lead to permission issues. The attack needs to be launched locally. You should upgrade the affected component. The vendor explains, that "this vulnerability was detected at the beginning of 20
should upgrade the affected component. The vendor explains, that "this vulnerability was detected at the beginning of 2025, it was remediated because the latest published version of the installer no longer uses "nssm," which is responsible for this vulnerability". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325811 - https://vuldb.com/?ctiid.325811 - https://vuldb.com/?submit.651434 - https://raw.githubusercontent.com/securityadvisories/Security-Advisories/refs/heads/main/Advisories/Blaze%20Information%20Security%20-%20Local%20Privilege%20Escalation%20via%20Insecure%20Directory%20Permissions%20in%20SERVCore%20Teller%20Installer.txt
CVE ID: CVE-2025-10942 State: PUBLISHED Published: 2025-09-25T11:02:08.595Z Last Updated: 2025-11-14T10:06:59.240Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: H3C Products: Magic B3 Problem Types: CWE-120, CWE-119 Description: A vulnerability was identified in H3C Magic B3 up to 100R002. This affects the function AddMacList/EditMacList of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325812 - https://vuldb.com/?ctiid.325812 - https://vuldb.com/?submit.651813 - https://vuldb.com/?submit.684667 - https://github.com/lin-3-start/lin-cve/blob/main/H3C%2BMagic%2BB3/H3C%20routers%20Buffer%20overflow.md - https://github.com/lin-3-start/lin-cve/blob/main/H3C%2BMagic%2BB3/H3C%20routers%20Buffer%20overflow.md#poc
CVE ID: CVE-2025-10943 State: PUBLISHED Published: 2025-09-25T12:02:05.463Z Last Updated: 2025-09-25T13:09:31.056Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: MikeCen Products: WeChat-Face-Recognition Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. This vulnerability affects the function valid of the file wx.php. The manipulation of the argument echostr results in cross site scripting. The attack can be launched remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor
duct does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325813 - https://vuldb.com/?ctiid.325813 - https://vuldb.com/?submit.651882 - https://github.com/MikeCen/WeChat-Face-Recognition/blob/master/wx.php#L25
CVE ID: CVE-2025-10944 State: PUBLISHED Published: 2025-09-25T12:32:06.378Z Last Updated: 2025-09-25T13:07:01.730Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: yi-ge Products: get-header-ip Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The
ver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325814 - https://vuldb.com/?ctiid.325814 - https://vuldb.com/?submit.651884 - https://github.com/yi-ge/get-header-ip/blob/master/ip.php#L32
CVE ID: CVE-2025-10945 State: PUBLISHED Published: 2025-09-25T12:32:08.793Z Last Updated: 2025-09-25T13:06:03.245Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: nuz007 Products: smsboom Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. Impacted is an unknown function of the file d.php. Such manipulation of the argument hm leads to cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Additional A
ng continuous delivery. Consequently, there are no version details for either affected or updated releases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325815 - https://vuldb.com/?ctiid.325815 - https://vuldb.com/?submit.651886 - https://github.com/nuz007/smsboom/blob/main/d.php#L25
CVE ID: CVE-2025-10946 State: PUBLISHED Published: 2025-09-25T13:02:05.968Z Last Updated: 2025-09-25T13:38:21.237Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: nuz007 Products: smsboom Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php. Performing manipulation of the argument hm results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. Additional Analy
approach for continuous delivery, so version details for affected or updated releases are not provided. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325816 - https://vuldb.com/?ctiid.325816 - https://vuldb.com/?submit.651887 - https://github.com/nuz007/smsboom/blob/main/dy.php#L20
CVE ID: CVE-2025-10947 State: PUBLISHED Published: 2025-09-25T13:02:09.244Z Last Updated: 2025-09-25T13:14:33.199Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: Sistemas Pleno Products: Gestão de Locação Problem Types: CWE-639, CWE-285 Description: A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/validarCpf of the component CPF Handler. Executing manipulation of the argument pes_cpf can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 2025.8.0 is suffici
ttack can be executed remotely. The exploit has been published and may be used. Upgrading to version 2025.8.0 is sufficient to resolve this issue. It is advisable to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325817 - https://vuldb.com/?ctiid.325817 - https://vuldb.com/?submit.652282 - https://github.com/lfparizzi/CVE-Sistemas_Pleno/tree/main - https://github.com/lfparizzi/CVE-Sistemas_Pleno/tree/main?tab=readme-ov-file#-proofs
CVE ID: CVE-2025-10948 State: PUBLISHED Published: 2025-09-25T14:02:07.376Z Last Updated: 2025-10-13T16:58:49.425Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C) Vendors: MikroTik Products: RouterOS Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in MikroTik RouterOS 7. This affects the function parse_json_element of the file /rest/ip/address/print of the component libjson.so. The manipulation leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.20.1 and 7.21beta2 mitigates this issue. You should upgrade the affected component. The vendo
ed. Upgrading to version 7.20.1 and 7.21beta2 mitigates this issue. You should upgrade the affected component. The vendor replied: "Our bug tracker reports that your issue has been fixed. This means that we plan to release a RouterOS update with this fix. Make sure to upgrade to the next release when it comes out." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325818 - https://vuldb.com/?ctiid.325818 - https://vuldb.com/?submit.652387 - https://github.com/a2ure123/libjson-unicode-buffer-overflow-poc - https://github.com/a2ure123/libjson-unicode-buffer-overflow-poc#technical-proof-of-concept
CVE ID: CVE-2025-10949 State: PUBLISHED Published: 2025-09-25T14:32:06.324Z Last Updated: 2025-09-25T15:48:50.191Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Changsha Developer Technology Products: iView Editor Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - C
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325819 - https://vuldb.com/?ctiid.325819 - https://vuldb.com/?submit.652402 - https://github.com/duckpigdog/CVE/blob/main/iView%20Editor%20XSS.docx
CVE ID: CVE-2025-10950 State: PUBLISHED Published: 2025-09-25T14:32:09.236Z Last Updated: 2025-09-25T15:48:44.772Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: geyang Products: ml-logger Problem Types: CWE-502, CWE-20 Description: A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious de