Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8692 State: PUBLISHED Published: 2025-09-11T07:24:53.990Z Last Updated: 2025-09-11T14:39:58.483Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: kamilkhan Products: Coupon API Problem Types: CWE-89 Description: The Coupon API plugin for WordPress is vulnerable to SQL Injection via the ‘log_duration’ parameter in all versions up to, and including, 6.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be us
with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5443aa7f-e290-4b7f-9be0-23daf1624935?source=cve - https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L530 - https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L559 - https://plugins.trac.wordpress.org/browser/couponapi/trunk/views.php#L577
CVE ID: CVE-2025-8693 State: PUBLISHED Published: 2025-11-18T01:25:05.406Z Last Updated: 2025-11-19T16:49:43.528Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: DX3300-T0 firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attacker to execute operating system (OS) commands on an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-uncontrolled-resource-consumption-and
://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-uncontrolled-resource-consumption-and-command-injection-vulnerabilities-in-certain-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-security-routers-and-wireless-extenders-11-18-2025
CVE ID: CVE-2025-8695 State: PUBLISHED Published: 2025-09-05T13:44:53.507Z Last Updated: 2025-09-05T15:36:14.201Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Netcad Products: NetGIS Server Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS.This issue affects NetGIS Server: from 5.2.4 through 22.08.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0209
CVE ID: CVE-2025-8696 State: PUBLISHED Published: 2025-09-10T17:59:52.878Z Last Updated: 2025-11-04T21:15:10.942Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: Stork Problem Types: CWE-789, CWE-779 Description: If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2025-8696
CVE ID: CVE-2025-8697 State: PUBLISHED Published: 2025-08-07T19:02:05.494Z Last Updated: 2025-08-07T19:23:03.703Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: agentUniverse Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPSessionManager/MCPTool/MCPToolkit. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319127 - https://vuldb.com/?ctiid.319127 - https://vuldb.com/?submit.621376 - https://github.com/bayuncao-bit/vul-37 - https://github.com/bayuncao-bit/vul-37#proof-of-concept
CVE ID: CVE-2025-8698 State: PUBLISHED Published: 2025-08-07T20:32:07.135Z Last Updated: 2025-08-08T16:51:41.832Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: Open5GS Problem Types: CWE-617 Description: A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context of the file src/amf/nsmf-handler.c of the component AMF Service. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The name of the patch is 66bc558e417e70ae216ec155e4e81c14ae0ecf30
loit has been disclosed to the public and may be used. The name of the patch is 66bc558e417e70ae216ec155e4e81c14ae0ecf30. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319128 - https://vuldb.com/?ctiid.319128 - https://vuldb.com/?submit.621282 - https://github.com/open5gs/open5gs/issues/4012 - https://github.com/user-attachments/files/21356631/amf_nsmf_pdusession_handle_release_sm_context.zip - https://github.com/open5gs/open5gs/commit/66bc558e417e70ae216ec155e4e81c14ae0ecf30
CVE ID: CVE-2025-8699 State: PUBLISHED Published: 2025-09-12T11:19:44.345Z Last Updated: 2025-11-03T18:14:08.379Z Vendors: KioSoft Products: Stored Value Unattended Payment Solution Problem Types: CWE-922 Description: Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance on the cards and generate money. The account balance is stored on an insecure MiFare Classic NFC card and can be read and written back. By carefully observing changes in card dumps, one can identify fields that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the ca
ds that store the cash value of the card. Additionally, a checksum can be identified, which is created by XOR-ing the cash and an unknown field with a certain value. By updating the fields accordingly, arbitrary amounts of money can be loaded onto the card (up to $655,35) to pay for goods. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/kiosoft
CVE ID: CVE-2025-8700 State: PUBLISHED Published: 2025-08-26T12:23:04.838Z Last Updated: 2025-08-26T13:48:30.975Z Vendors: Invoice Ninja Products: Invoice Ninja Problem Types: CWE-497 Description: Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access (e.g. via a malicious application) to attach a debugger, read or modify the process memory, inject code in the application's context despite being signed with Hardened Runtime and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources
trol (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission. According to Apple documentation, when a non-root user runs an app with the debugging tool entitlement, the system presents an authorization dialog asking for a system administrator's credentials. Since there is no prompt when the target process has "get-task-allow" entitlement, the presence of this entitlement was decided to be treated as a vulnerability because it removes one step needed to perform an attack. This issue was fixed in version 5.0.175 Additional Analyst Notes: -
use it removes one step needed to perform an attack. This issue was fixed in version 5.0.175 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/tcc-bypass/ - https://invoiceninja.com/
CVE ID: CVE-2025-8701 State: PUBLISHED Published: 2025-08-07T21:02:06.917Z Last Updated: 2025-08-08T15:00:18.353Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wanzhou Products: WOES Intelligent Optimization Energy Saving System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /OL_OprationLog/GetPageList. The manipulation of the argument optUser leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional An
ection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319130 - https://vuldb.com/?ctiid.319130 - https://vuldb.com/?submit.620639 - https://github.com/si12/xxx/issues/1
CVE ID: CVE-2025-8702 State: PUBLISHED Published: 2025-08-07T23:32:05.468Z Last Updated: 2025-08-08T17:33:30.461Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wanzhou Products: WOES Intelligent Optimization Energy Saving System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the file /CommonSolution/GetVariableByOneIDNew of the component Historical Data Query Module. The manipulation of the argument ObjectID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to
ment ObjectID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319131 - https://vuldb.com/?ctiid.319131 - https://vuldb.com/?submit.621217 - https://github.com/si12/xxx/issues/2
CVE ID: CVE-2025-8703 State: PUBLISHED Published: 2025-08-08T00:02:06.332Z Last Updated: 2025-08-08T17:14:03.198Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wanzhou Products: WOES Intelligent Optimization Energy Saving System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This vulnerability affects unknown code of the file /WEAS_HomePage/GetAreaTrendChartData of the component Environmental Real-Time Data Module. The manipulation of the argument energyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed t
of the argument energyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319132 - https://vuldb.com/?ctiid.319132 - https://vuldb.com/?submit.621278 - https://github.com/si12/xxx/issues/3
CVE ID: CVE-2025-8704 State: PUBLISHED Published: 2025-08-08T00:32:05.875Z Last Updated: 2025-08-08T16:39:19.193Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wanzhou Products: WOES Intelligent Optimization Energy Saving System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This issue affects some unknown processing of the file /WEAS_AlarmResult/GetAlarmResultProcessList of the component Analysis Conclusion Query Module. The manipulation of the argument resultId leads to sql injection. The attack may be initiated remotely. The expl
Module. The manipulation of the argument resultId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319133 - https://vuldb.com/?ctiid.319133 - https://vuldb.com/?submit.621279 - https://github.com/si12/xxx/issues/4
CVE ID: CVE-2025-8705 State: PUBLISHED Published: 2025-08-08T01:02:06.595Z Last Updated: 2025-08-08T16:37:38.129Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wanzhou Products: WOES Intelligent Optimization Energy Saving System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. Affected is an unknown function of the file /WEAS_HomePage/GetTargetConfig of the component Energy Overview Module. The manipulation of the argument BP_ProID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the p
t BP_ProID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319134 - https://vuldb.com/?ctiid.319134 - https://vuldb.com/?submit.621280 - https://github.com/si12/xxx/issues/5
CVE ID: CVE-2025-8706 State: PUBLISHED Published: 2025-08-08T01:32:05.040Z Last Updated: 2025-08-08T15:03:08.143Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wanzhou Products: WOES Intelligent Optimization Energy Saving System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /CommonSolution/CreateFunctionLog of the component Energy Overview Module. The manipulation of the argument MM_MenID leads to sql injection. The attack can be launched remotely. The exploit has been
manipulation of the argument MM_MenID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319135 - https://vuldb.com/?ctiid.319135 - https://vuldb.com/?submit.621281 - https://github.com/si12/xxx/issues/6
CVE ID: CVE-2025-8707 State: PUBLISHED Published: 2025-08-08T02:02:06.472Z Last Updated: 2025-08-08T18:56:15.754Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Huuge Products: Box App Problem Types: CWE-926 Description: A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xml of the component com.huuge.game.zjbox. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
ach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319137 - https://vuldb.com/?ctiid.319137 - https://vuldb.com/?submit.619858 - https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md - https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md#steps-to-reproduce
CVE ID: CVE-2025-8708 State: PUBLISHED Published: 2025-08-08T02:32:05.558Z Last Updated: 2025-08-08T14:55:01.174Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Antabot Products: White-Jotter Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of the file ShiroConfiguration.java of the component com.gm.wj.config.ShiroConfiguration. The manipulation with the input EVANNIGHTLY_WAOU leads to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation
s to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319138 - https://vuldb.com/?ctiid.319138 - https://vuldb.com/?submit.621105 - https://github.com/Antabot/White-Jotter/issues/161 - https://github.com/Antabot/White-Jotter/issues/161#issue-3254420874
CVE ID: CVE-2025-8709 State: PUBLISHED Published: 2025-10-26T05:38:55.335Z Last Updated: 2025-10-28T14:32:39.540Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: langchain-ai Products: langchain-ai/langchain Problem Types: CWE-89 Description: A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, le
e direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9793f4b3-76f8-44a4-989f-49a2177ee118
CVE ID: CVE-2025-8711 State: PUBLISHED Published: 2025-09-09T15:17:25.292Z Last Updated: 2025-09-09T17:32:23.793Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Ivanti Products: Connect Secure, Policy Secure, ZTA Gateway, Neurons for Secure Problem Types: CWE-352 Description: CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to execute limited actions on behalf of the victim user. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnric
limited actions on behalf of the victim user. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-8712 State: PUBLISHED Published: 2025-09-09T15:12:38.985Z Last Updated: 2025-09-10T17:25:48.443Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Ivanti Products: Connect Secure before, Policy Secure, ZTA Gateway, Neurons for Secure Access Problem Types: CWE-862 Description: Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings. Additional Analyst Notes: - CISA AD
enticated attacker with read-only admin privileges to configure restricted settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs
CVE ID: CVE-2025-8713 State: PUBLISHED Published: 2025-08-14T13:00:05.807Z Last Updated: 2025-08-14T19:51:04.708Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: PostgreSQL Problem Types: CWE-1230 Description: PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control l
e query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.postgresql.org/support/security/CVE-2025-8713/
CVE ID: CVE-2025-8714 State: PUBLISHED Published: 2025-08-14T13:00:07.046Z Last Updated: 2025-08-15T03:55:54.637Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: PostgreSQL Problem Types: CWE-829 Description: Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13
plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.postgresql.org/support/security/CVE-2025-8714/
CVE ID: CVE-2025-8715 State: PUBLISHED Published: 2025-08-14T13:00:07.753Z Last Updated: 2025-08-15T03:55:56.953Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: PostgreSQL Problem Types: CWE-93 Description: Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before Po
s a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.postgresql.org/support/security/CVE-2025-8715/
CVE ID: CVE-2025-8716 State: PUBLISHED Published: 2025-09-11T13:42:01.686Z Last Updated: 2025-09-11T14:16:18.491Z Vendors: OpenText Products: OpenText Content Management Problem Types: CWE-754 Description: In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0847046