Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-29088 State: PUBLISHED Published: 2025-04-10T00:00:00.000Z Last Updated: 2025-08-26T19:27:20.720Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: SQLite Products: SQLite Problem Types: CWE-190 Description: In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sqlite.org/cves.html - https://sqlite.org/forum/forumpost/48f365daec - https://github.com/sqlite
ferences: - https://www.sqlite.org/cves.html - https://sqlite.org/forum/forumpost/48f365daec - https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4 - https://gist.github.com/ylwango613/d3883fb9f6ba8a78086356779ce88248 - https://sqlite.org/releaselog/3_49_1.html
CVE ID: CVE-2025-29089 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T14:31:43.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/timothy-hoekstra-91b6951b2 - https://intrix.com.au/articles/exposing-insecure-http-basic-authentication-tp-link-archer-ax10-cwe-id-cwe-319/
CVE ID: CVE-2025-29093 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:34:10.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/francesco-marcuccio-0433b9218 - https://github.com/FraMarcuccio/CVE-2025-29093-Arbitrary-File-Upload/blob/main/README.md
CVE ID: CVE-2025-29094 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T18:29:31.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Marketing/Offers and Content/Pages components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FraMarcuccio/CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS
CVE ID: CVE-2025-29100 State: PUBLISHED Published: 2025-03-24T00:00:00.000Z Last Updated: 2025-03-26T14:36:13.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/Tenda%20a8%20V16.03.34.06%20fromSetRouteStatic_stack_overflow.md - https://gist.github.com/Raining-101/b2bd27d16cdca94d330150a8ead9caa8
CVE ID: CVE-2025-29101 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-24T13:21:10.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac8_get_parentControl_list_Info_overflow.md
CVE ID: CVE-2025-29118 State: PUBLISHED Published: 2025-03-19T00:00:00.000Z Last Updated: 2025-03-21T13:30:00.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8 V16.03.34.06 was discovered to contain a stack overflow via the src parameter in the function sub_47D878. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac8_sub_47D878.md
CVE ID: CVE-2025-29121 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T18:53:26.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality of the /goform/fast_setting_wifi_set file form_fast_setting_wifi_set. Using the timeZone parameter causes a stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/ac6_form_fast_setting_wifi_set%20_timeZone.md
CVE ID: CVE-2025-29135 State: PUBLISHED Published: 2025-03-24T00:00:00.000Z Last Updated: 2025-03-26T14:35:07.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack overflow attack using the security parameter of the formWifiBasicSet function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/a7_formWifiBasic_Setsecurity_stackoverflow.md - https://gist.github.com/Raining-101/1651dd3901efdbb38d94a156a54bbc62
CVE ID: CVE-2025-29137 State: PUBLISHED Published: 2025-03-19T00:00:00.000Z Last Updated: 2025-03-19T20:44:09.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which can cause RCE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/tenda-ac7form_fast_setting_wifi_set%20timeZone.md
CVE ID: CVE-2025-29149 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T18:50:10.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Raining-101/IOT_cve/blob/main/tenda%20i12formSetAutoPing_ping1.md
CVE ID: CVE-2025-29150 State: PUBLISHED Published: 2025-04-10T00:00:00.000Z Last Updated: 2025-04-10T14:55:59.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/electroN1chahaha/054a1af22157aa3010e89b3103ad7b9a
CVE ID: CVE-2025-29152 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-07T13:53:26.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical Level Registration, Decision Level Registration, Perspective Registration, Company Group Registration, Company Registration, News Registration, Employee Editing, Goal Team Registration, Learning Resource Type Registration, Learning Resource Family
ws Registration, Employee Editing, Goal Team Registration, Learning Resource Type Registration, Learning Resource Family Registration, Learning Resource Supplier Registration, and Cycle Maintenance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@worzyus/poc-2fd1d2ec1eb9 - https://wellington-almeida.medium.com/poc-2fd1d2ec1eb9
CVE ID: CVE-2025-29153 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-07T14:00:33.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the Data export, filters functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://worzyus.medium.com/391c437c3960 - https://wellington-almeida.medium.com/poc-sql-391c437c3960
CVE ID: CVE-2025-29154 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-08T18:32:12.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted/solicitacao_treinamento/, .galera.app/rh/metas/perspectiva_estrategica/edicao/, .galera.app/rh/cadastros/perspectivas/listagem/adc/, .galera.app/escolaridade/listagem/, .galera.app/estados_civis/cadastro/, .galera.app/nivel_hierarquico/listagem/, .galera.app/nivel_decisorio/cadastro/, .galera.app/escolaridade/cadastro/, .galera.app/nivel_decisorio/listagem/, .galera.app/rh/cadastros
decisorio/cadastro/, .galera.app/escolaridade/cadastro/, .galera.app/nivel_decisorio/listagem/, .galera.app/rh/cadastros/perspectivas/listagem/, .galera.app/empresas_grupo/cadastro/, .galera.app/empresas/edicao/, .galera.app/liais/listagem/, .galera.app/noticias/listagem/, .galera.app/gerenciamento-de-ciclo/abertura/cadastrar, .galera.app/colaborador/cadastro/cursos/adc/edicao/, .galera.app/colaborador/cadastro/adc/, .galera.app/cads_aux/escalact/, .galera.app/ncf/tec/cadastro/ct/ .galera.app/rh/metas/painel/, .galera.app/rh/metas/equipe/edicao/, .galera.app/rh/pdi/tipo_recursos/edicao/, .galera.app/rh/pdi/familia_recursos/cadastro/, .galera.app/rh/pdi/fornecedores/edicao/, and .galera.app/r
ursos/edicao/, .galera.app/rh/pdi/familia_recursos/cadastro/, .galera.app/rh/pdi/fornecedores/edicao/, and .galera.app/rh/pdi/recursos/cadastro/ components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://worzyus.medium.com/0f27e657c962 - https://wellington-almeida.medium.com/poc-html-injection-0f27e657c962
CVE ID: CVE-2025-29155 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:04:03.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/swagger-api/swagger-petstore - https://github.com/swagger-api/swagger-petstore/blob/master/src/main/resources/openapi.yaml - https://gist.github.com/HouqiyuA/4efd1aac7c7c7ab0cd5db48d62541a74
CVE ID: CVE-2025-29156 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:12:38.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/swagger-api/swagger-petstore/blob/master/src/main/resources/openapi.yaml - https://www.google.com/url?q=https%3A%2F%2Fgithub.com%2Fswagger-api%2Fswagger-petstore&sa=D&sntz=1&usg=AOvVaw0bPYxOZ-XKNAbTj4h0EOMD - https://gist.github.com/HouqiyuA/9d2c3f0ba075d01631aff879546e419c
CVE ID: CVE-2025-29157 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:11:14.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page exposing sensitive information including the Servlet name (default) and server version Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/swagger-api/swagger-petstore - https://petstore3.swagger.io/#/pet/updatePet - https://gist.github.com/HouqiyuA/3c36f78e8de9f6a3cfb0959477c07443
CVE ID: CVE-2025-29180 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:15:56.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/X1lyS/5075ba1e6bebff26fcd58609493fd5f2
CVE ID: CVE-2025-29181 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:13:55.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/X1lyS/2b3f936437fb7c04b4f1e4b07468fd05
CVE ID: CVE-2025-29189 State: PUBLISHED Published: 2025-04-09T00:00:00.000Z Last Updated: 2025-04-09T14:42:51.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp=sharing
CVE ID: CVE-2025-29192 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T13:54:31.753Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: FlowiseAI Products: Flowise Problem Types: CWE-79 Description: Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise/pull/4905 - https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5 - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7r4h-vmj9-wg42
CVE ID: CVE-2025-29208 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-14T17:29:40.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LLz-7/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-29209 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:49:20.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LZY0522/CVE/blob/main/X18-sub_41105c.md
CVE ID: CVE-2025-29213 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T18:34:29.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wy876/cve/issues/7
CVE ID: CVE-2025-29214 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T18:54:40.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/isstabber/my_VulnHub/blob/main/Tenda/AX12/tenda_ax12_setMacFilterCfg_stack_overflow_en.pdf - https://gist.github.com/isstabber/85fe01ed47ad7ef820f86bfbd64a022c
CVE ID: CVE-2025-29215 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T17:31:46.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/isstabber/my_VulnHub/blob/main/Tenda/AX12/tenda_ax12v1_setnetcontrollist_stack_overflow.pdf - https://gist.github.com/isstabber/a42b32a7dcd401d79c5866247329cddd
CVE ID: CVE-2025-29217 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T17:29:26.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenda.com.cn/ - http://w18e.com - https://gist.github.com/isstabber/d170f68bd85ed97e66ff316e57634b99
CVE ID: CVE-2025-29218 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-21T17:30:37.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/isstabber/my_VulnHub/blob/main/TendaW18eV2/poc_wifipwd_stack_overflow.md - https://gist.github.com/isstabber/a03c9dc3e89d5cf3b9e46dbef1ee5bf1
CVE ID: CVE-2025-29223 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-21T18:13:33.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_traceRoute/CI_traceRoute.md
CVE ID: CVE-2025-29226 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-25T12:53:41.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"] parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_pingTest_count/CI_pingTest_count.md
CVE ID: CVE-2025-29227 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-21T18:11:39.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize"] parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_pingTest_pkgsize/CI_pingTest_pkgsize.md
CVE ID: CVE-2025-29230 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-21T18:04:37.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_emailReg_email/CI_emailReg_email.md
CVE ID: CVE-2025-29266 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-03-31T13:03:44.987Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Unraid Products: Unraid Problem Types: CWE-289 Description: Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/unraid/webgui - https://docs.unraid.net/unraid-os/release-notes/7.0.1/ - https://edac.dev/security/CVE-2025-29266/
CVE ID: CVE-2025-29267 State: PUBLISHED Published: 2025-07-08T00:00:00.000Z Last Updated: 2025-07-08T20:45:41.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the cid parameter in the GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://abis.com - http://adjutant.com - https://github.com/cmoncrook/Security-Advisories/blob/main/CVE-2025-29267
CVE ID: CVE-2025-29270 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:20:26.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.byteray.co.uk/shadow-entry-discovery-of-authentication-bypass-vulnerability-in-dse855-communications-device-938e35d4b361
CVE ID: CVE-2025-29280 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T17:37:54.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cray0nLee/CVE/issues/1
CVE ID: CVE-2025-29281 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T14:56:12.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cray0nLee/CVE/issues/2
CVE ID: CVE-2025-29287 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T14:58:53.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cms.com - https://gitee.com/mingSoft/MCMS/issues/IBOOTX - https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
CVE ID: CVE-2025-29294 State: REJECTED Published: 2025-03-24T00:00:00.000Z Last Updated: 2025-03-24T16:13:44.003Z Description: No description available.
CVE ID: CVE-2025-29306 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-03-28T15:29:51.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/somatrasss/CVE-2025-29306
CVE ID: CVE-2025-29310 State: PUBLISHED Published: 2025-03-24T00:00:00.000Z Last Updated: 2025-03-26T14:38:01.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in onos v2.7.0 allows attackers to trigger a packet deserialization problem when supplying a crafted LLDP packet. This vulnerability allows attackers to execute arbitrary commands or access network information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Saber-Berserker/10c9d548b38fa988310d90b8314e3129.
CVE ID: CVE-2025-29311 State: PUBLISHED Published: 2025-03-24T00:00:00.000Z Last Updated: 2025-03-26T14:37:01.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Saber-Berserker/790f2a75ae482df3fd0fce569f30504a;