Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-0393 State: PUBLISHED Published: 2025-01-14T08:23:13.840Z Last Updated: 2025-01-14T14:46:41.571Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-352 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing
tackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e34c05-7431-4acd-91f3-aab5e66f61ad?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1006/classes/modules/wpr-filter-grid-posts.php#L391 - https://wordpress.org/plugins/royal-elementor-addons/#developers - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1006/classes/modules/wpr-filter-grid-posts.php#L1260 - https://plugins.trac.wordpress.org/changes
mentor-addons/tags/1.7.1006/classes/modules/wpr-filter-grid-posts.php#L1260 - https://plugins.trac.wordpress.org/changeset/3220959/
CVE ID: CVE-2025-0394 State: PUBLISHED Published: 2025-01-14T08:23:14.407Z Last Updated: 2025-01-14T14:46:14.802Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: trainingbusinesspros Products: WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg Problem Types: CWE-434 Description: The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and a
rsions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2cf3b85-2e2d-43dc-9877-9a740d4fd2fb?source=cve - https://plugins.trac.wordpress.org/browser/groundhogg/tags/3.7.3.5/includes/big-file-uploader.php#L117 - https://wordpress.org/plugins/groundhogg/#developers - https://plugins.trac.wordpress.org/changeset/3221208/
CVE ID: CVE-2025-0395 State: PUBLISHED Published: 2025-01-22T13:11:30.406Z Last Updated: 2025-04-30T05:03:13.011Z Vendors: The GNU C Library Products: glibc Problem Types: CWE-131 Description: When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2025/01/22/4 - https://sourceware.org/bugzilla/show_bug.cgi?id=32582 - https://sourceware.org/git/?p=glibc.git;a=bl
rity/2025/01/22/4 - https://sourceware.org/bugzilla/show_bug.cgi?id=32582 - https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2025-0001 - https://sourceware.org/pipermail/libc-announce/2025/000044.html
CVE ID: CVE-2025-0396 State: PUBLISHED Published: 2025-01-12T12:00:15.952Z Last Updated: 2025-01-13T15:18:12.233Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: exelban Products: stats Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vul
ble to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291269 - https://vuldb.com/?ctiid.291269 - https://vuldb.com/?submit.473229 - https://winslow1984.com/books/cve-collection/page/stats-v21122-local-privilege-escalation - https://github.com/exelban/stats/releases/tag/v2.11.22
CVE ID: CVE-2025-0397 State: PUBLISHED Published: 2025-01-12T12:31:04.239Z Last Updated: 2025-01-13T15:16:51.177Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: reckcn Products: SPPanAdmin Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in reckcn SPPanAdmin 1.0. Affected is an unknown function of the file /;/admin/role/edit. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any w
parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291270 - https://vuldb.com/?ctiid.291270 - https://vuldb.com/?submit.473287 - https://github.com/LvZCh/SPPanAdmin/issues/3 - https://github.com/LvZCh/SPPanAdmin/issues/3#issue-2765450314
CVE ID: CVE-2025-0398 State: PUBLISHED Published: 2025-01-12T14:00:14.562Z Last Updated: 2025-01-13T15:15:14.434Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: longpi1 Products: warehouse Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in longpi1 warehouse 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /resources/..;/inport/updateInport of the component Backend. The manipulation of the argument remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291271 - https://vuldb.com/?ctiid.291271 - https://vuldb.com/?submit.473316 - https://github.com/longpi1/warehouse/issues/4 - https://github.com/longpi1/warehouse/issues/4#issue-2765524047
CVE ID: CVE-2025-0399 State: PUBLISHED Published: 2025-01-12T23:00:12.231Z Last Updated: 2025-01-13T14:57:56.599Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: StarSea99 Products: starsea-mall Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in StarSea99 starsea-mall 1.0. It has been declared as critical. This vulnerability affects the function UploadController of the file src/main/java/com/siro/mall/controller/common/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291274 - https://vuldb.com/?ctiid.291274 - https://vuldb.com/?submit.473319 - https://github.com/StarSea99/starsea-mall/issues/3 - https://github.com/StarSea99/starsea-mall/issues/3#issue-2765550309
CVE ID: CVE-2025-0400 State: PUBLISHED Published: 2025-01-12T23:00:14.753Z Last Updated: 2025-01-13T15:10:33.218Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: StarSea99 Products: starsea-mall Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in StarSea99 starsea-mall 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/categories/update. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291275 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291275 - https://vuldb.com/?ctiid.291275 - https://vuldb.com/?submit.473321 - https://github.com/StarSea99/starsea-mall/issues/5 - https://github.com/StarSea99/starsea-mall/issues/5#issue-2765562635
CVE ID: CVE-2025-0401 State: PUBLISHED Published: 2025-01-12T23:31:05.284Z Last Updated: 2025-01-13T15:10:03.433Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: 1902756969 Products: reggie Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in 1902756969 reggie 1.0. Affected is the function download of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291276 - https://vuldb.com/?ctiid.291276 - https://vuldb.com/?submit.473322 - https://github.com/1902756969/reggie/issues/1 - https://github.com/1902756969/reggie/issues/1#issue-2765577260
CVE ID: CVE-2025-0402 State: PUBLISHED Published: 2025-01-12T23:31:06.957Z Last Updated: 2025-01-13T15:09:36.205Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 1902756969 Products: reggie Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in 1902756969 reggie 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/itheima/reggie/controller/CommonController.java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291277 - https://vuldb.com/?ctiid.291277 - https://vuldb.com/?submit.473324 - https://github.com/1902756969/reggie/issues/2 - https://github.com/1902756969/reggie/issues/2#issue-2765582342
CVE ID: CVE-2025-0403 State: PUBLISHED Published: 2025-01-13T00:00:15.276Z Last Updated: 2025-01-13T15:01:27.103Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: 1902756969 Products: reggie Problem Types: CWE-200, CWE-284 Description: A vulnerability, which was classified as problematic, has been found in 1902756969 reggie 1.0. Affected by this issue is some unknown functionality of the file /user/sendMsg of the component Phone Number Validation Handler. The manipulation of the argument code leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
e launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291278 - https://vuldb.com/?ctiid.291278 - https://vuldb.com/?submit.473325 - https://github.com/1902756969/reggie/issues/3 - https://github.com/1902756969/reggie/issues/3#issue-2765587336
CVE ID: CVE-2025-0404 State: PUBLISHED Published: 2025-01-13T00:31:04.945Z Last Updated: 2025-01-13T15:00:35.183Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in liujianview gymxmjpa 1.0 and classified as critical. This vulnerability affects the function CoachController of the file src/main/java/com/liujian/gymxmjpa/controller/CoachController.java. The manipulation of the argument coachName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291280 - https://vuldb.com/?ctiid.291280 - https://vuldb.com/?submit.473385 - https://github.com/liujianview/gymxmjpa/issues/2 - https://github.com/liujianview/gymxmjpa/issues/2#issue-2765760967
CVE ID: CVE-2025-0405 State: PUBLISHED Published: 2025-01-13T00:31:06.498Z Last Updated: 2025-01-13T18:33:50.951Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in liujianview gymxmjpa 1.0 and classified as critical. This issue affects the function GoodsDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/GoodsController.java. The manipulation of the argument goodsName leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291281 - https://vuldb.com/?ctiid.291281 - https://vuldb.com/?submit.473411 - https://github.com/liujianview/gymxmjpa/issues/3 - https://github.com/liujianview/gymxmjpa/issues/3#issue-2765770918
CVE ID: CVE-2025-0406 State: PUBLISHED Published: 2025-01-13T01:00:12.554Z Last Updated: 2025-01-13T18:06:57.254Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in liujianview gymxmjpa 1.0. It has been classified as critical. Affected is the function SubjectDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/SubjectController.java. The manipulation of the argument subname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291282 - https://vuldb.com/?ctiid.291282 - https://vuldb.com/?submit.473417 - https://github.com/liujianview/gymxmjpa/issues/5 - https://github.com/liujianview/gymxmjpa/issues/5#issue-2765786069
CVE ID: CVE-2025-0407 State: PUBLISHED Published: 2025-01-13T01:31:05.940Z Last Updated: 2025-01-13T18:02:10.592Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in liujianview gymxmjpa 1.0. It has been declared as critical. Affected by this vulnerability is the function EquipmentDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/EquipmentController.java. The manipulation of the argument hyname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291283 - https://vuldb.com/?ctiid.291283 - https://vuldb.com/?submit.473422 - https://github.com/liujianview/gymxmjpa/issues/7 - https://github.com/liujianview/gymxmjpa/issues/7#issue-2765800789
CVE ID: CVE-2025-0408 State: PUBLISHED Published: 2025-01-13T02:00:12.582Z Last Updated: 2025-01-13T13:50:47.311Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in liujianview gymxmjpa 1.0. It has been rated as critical. Affected by this issue is the function LoosDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/LoosController.java. The manipulation of the argument loosName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291284 - https://vuldb.com/?ctiid.291284 - https://vuldb.com/?submit.473423 - https://github.com/liujianview/gymxmjpa/issues/8 - https://github.com/liujianview/gymxmjpa/issues/8#issue-2765807702
CVE ID: CVE-2025-0409 State: PUBLISHED Published: 2025-01-13T02:31:05.066Z Last Updated: 2025-01-13T18:01:15.343Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in liujianview gymxmjpa 1.0. This affects the function MembertypeDaoImpl of the file src/main/java/com/liujian/gymxmjpa/controller/MembertypeController.java. The manipulation of the argument typeName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291285 - https://vuldb.com/?ctiid.291285 - https://vuldb.com/?submit.473425 - https://github.com/liujianview/gymxmjpa/issues/9 - https://github.com/liujianview/gymxmjpa/issues/9#issue-2765816110
CVE ID: CVE-2025-0410 State: PUBLISHED Published: 2025-01-13T02:31:06.610Z Last Updated: 2025-01-13T18:00:20.737Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: liujianview Products: gymxmjpa Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in liujianview gymxmjpa 1.0. This vulnerability affects the function MenberDaoInpl of the file src/main/java/com/liujian/gymxmjpa/controller/MenberConntroller.java. The manipulation of the argument hyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291286 - https://vuldb.com/?ctiid.291286 - https://vuldb.com/?submit.473426 - https://github.com/liujianview/gymxmjpa/issues/10 - https://github.com/liujianview/gymxmjpa/issues/10#issue-2765824571
CVE ID: CVE-2025-0411 State: PUBLISHED Published: 2025-01-25T04:28:24.270Z Last Updated: 2025-10-21T22:55:31.151Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: 7-Zip Products: 7-Zip Problem Types: CWE-693 Description: 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Z
within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-045/
CVE ID: CVE-2025-0412 State: PUBLISHED Published: 2025-01-13T03:20:44.774Z Last Updated: 2025-01-13T17:59:09.578Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Viewer Problem Types: CWE-119 Description: Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of KSP files. The issue results from the lac
ge or open a malicious file. The specific flaw exists within the processing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22139. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-23-1716/ - https://download.keyshot.com/cert/lsa-960930/lsa-960930.pdf?version=1.0
CVE ID: CVE-2025-0413 State: PUBLISHED Published: 2025-02-04T23:09:18.874Z Last Updated: 2025-02-05T15:36:54.696Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-59 Description: Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Technical Data Reporter component. By creating a symboli
exploit this vulnerability. The specific flaw exists within the Technical Data Reporter component. By creating a symbolic link, an attacker can abuse the service to change the permissions of arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-25014. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-082/ - https://kb.parallels.com/130212
CVE ID: CVE-2025-0415 State: PUBLISHED Published: 2025-04-02T06:22:11.432Z Last Updated: 2025-04-03T03:26:20.035Z Vendors: Moxa Products: EDF-G1002-BP Series, EDR-810 Series, EDR-8010 Series, EDR-G9004 Series, EDR-G9010 Series, OnCell G4302-LTE4 Series, TN-4900 Series, NAT-102 Series Problem Types: CWE-78 Description: A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for downstream systems that rely on its network services. Additional Analyst Notes: - CISA
artial denial of connectivity for downstream systems that rely on its network services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-259491-cve-2025-0415-command-injection-leading-to-denial-of-service-(dos)