Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311632 - https://vuldb.com/?ctiid.311632 - https://vuldb.com/?submit.585733 - https://github.com/YZS17/CVE/blob/main/Salia_PLCC/Salia_PLCC_Slave_v2.2.0_File_Upload.md
CVE ID: CVE-2025-5874 State: PUBLISHED Published: 2025-06-09T11:00:14.520Z Last Updated: 2025-07-16T14:51:03.137Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Redash Problem Types: CWE-265, CWE-264 Description: A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vuln
is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he Python data source is disabled by default and is clearly marked in our documentation as discouraged due to its security implications. Users who choose to enable it are doing so at their own risk, with full awareness that it bypasses standard safeguards." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311633 - https://vuldb.com/?ctiid.311633 - https://vuldb.com/?submit.580255 - https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894 - https://gist.
https://vuldb.com/?submit.580255 - https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894 - https://gist.github.com/superboy-zjc/1f89d375e2408ed843dc2cf0bb1bb894#proof-of-concept
CVE ID: CVE-2025-5875 State: PUBLISHED Published: 2025-06-09T11:31:05.450Z Last Updated: 2025-06-12T19:03:32.199Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TP-LINK Technologies Products: TL-IPC544EP-W4 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in TP-LINK Technologies TL-IPC544EP-W4 1.0.9 Build 240428 Rel 69493n. Affected is the function sub_69064 of the file /bin/main. The manipulation of the argument text leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not
ploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311634 - https://vuldb.com/?ctiid.311634 - https://vuldb.com/?submit.581366 - https://locrian-lightning-dc7.notion.site/TL-IPC544EP-W4-1f98e5e2b1a280ae9862d49391d95651 - https://www.tp-link.cn/
CVE ID: CVE-2025-5876 State: PUBLISHED Published: 2025-06-09T12:00:16.820Z Last Updated: 2025-06-09T13:04:08.070Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: Lucky Products: LM-520-SC, LM-520-FSC, LM-520-FSC-SAM Problem Types: CWE-306, CWE-287 Description: A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not
ploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311635 - https://vuldb.com/?ctiid.311635 - https://vuldb.com/?submit.585821 - https://github.com/zeke2997/cve_request_LuckyTechnologyLtd
CVE ID: CVE-2025-5877 State: PUBLISHED Published: 2025-06-09T12:31:04.643Z Last Updated: 2025-06-09T13:00:44.810Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Fengoffice Products: Feng Office Problem Types: CWE-611, CWE-610 Description: A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor
reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311636 - https://vuldb.com/?ctiid.311636 - https://vuldb.com/?submit.586971 - https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa - https://gist.github.com/mcdruid/e78694d754f44884830898be082fcbaa#steps-to-reproduce
CVE ID: CVE-2025-5878 State: PUBLISHED Published: 2025-06-29T11:11:47.327Z Last Updated: 2025-11-03T20:06:42.000Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: ESAPI Products: esapi-java-legacy Problem Types: CWE-138, CWE-20 Description: A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism.
he public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.314321 - https://vuldb.com/?ctiid.314321 - https://vuldb.com/?submit.590149 - https://vuldb.com/?submit.590150 - https://github.com/uglory
uldb.com/?ctiid.314321 - https://vuldb.com/?submit.590149 - https://vuldb.com/?submit.590150 - https://github.com/uglory-gll/javasec/blob/main/ESAPI.md - https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf - https://github.com/ESAPI/esapi-java-legacy/commit/f75ac2c2647a81d2cfbdc9c899f8719c240ed512 - https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.7.0.0 - https://github.com/ESAPI/esapi-java-legacy/commit/e2322914304d9b1c52523ff24be495b7832f6a56
CVE ID: CVE-2025-5879 State: PUBLISHED Published: 2025-06-09T13:00:16.359Z Last Updated: 2025-06-09T13:32:26.038Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: WuKongOpenSource Products: WukongCRM Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in WuKongOpenSource WukongCRM 9.0. This affects an unknown part of the file AdminSysConfigController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosu
motely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311637 - https://vuldb.com/?ctiid.311637 - https://vuldb.com/?submit.587201 - https://github.com/Aiyakami/CVE-1/issues/7
CVE ID: CVE-2025-5880 State: PUBLISHED Published: 2025-06-09T13:31:04.284Z Last Updated: 2025-06-09T14:43:09.638Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: Whistle Problem Types: CWE-22 Description: A vulnerability has been found in Whistle 2.9.98 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/sessions/get-temp-file. The manipulation of the argument filename leads to path traversal. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
acted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311638 - https://vuldb.com/?ctiid.311638 - https://vuldb.com/?submit.582867
CVE ID: CVE-2025-5881 State: PUBLISHED Published: 2025-06-09T14:00:18.343Z Last Updated: 2025-06-09T14:36:54.890Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Chat System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirm_password.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3116
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311639 - https://vuldb.com/?ctiid.311639 - https://vuldb.com/?submit.592112 - https://github.com/LamentXU123/cve/blob/main/sql4.md - https://code-projects.org/
CVE ID: CVE-2025-5884 State: PUBLISHED Published: 2025-06-09T14:31:06.495Z Last Updated: 2025-06-09T14:54:47.151Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: Konica Minolta Products: bizhub Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Konica Minolta bizhub up to 20250202. This affects an unknown part of the component Display MFP Information List. The manipulation of the argument Model Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311655 - https://vuldb.com/?ctiid.311655 - https://vuldb.com/?submit.493653 - https://drive.google.com/file/d/1A0JEnmnUGNjGsizRu99uz2ynqQ3v9ZKB/view
CVE ID: CVE-2025-5885 State: PUBLISHED Published: 2025-06-09T15:00:10.179Z Last Updated: 2025-06-09T15:13:26.939Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: Konica Minolta Products: bizhub Problem Types: CWE-352, CWE-862 Description: A vulnerability has been found in Konica Minolta bizhub up to 20250202 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311656 - https://vuldb.com/?ctiid.311656 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311656 - https://vuldb.com/?ctiid.311656 - https://vuldb.com/?submit.493666 - https://drive.google.com/file/d/1pECiiSWdB_ERzzGrc--WY63IzZxR6i6L/view
CVE ID: CVE-2025-5886 State: PUBLISHED Published: 2025-06-09T16:00:16.353Z Last Updated: 2025-06-10T13:28:23.445Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Emlog Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The manipulation of the argument active_post leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311657 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311657 - https://vuldb.com/?ctiid.311657 - https://vuldb.com/?submit.571804 - https://github.com/users/God-mellon/projects/3/views/1?pane=issue&itemId=109223682&issue=God-mellon%7Ctest2%7C2
CVE ID: CVE-2025-5887 State: PUBLISHED Published: 2025-06-09T17:00:10.531Z Last Updated: 2025-06-09T19:46:11.775Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: jsnjfz Products: WebStack-Guns Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been classified as problematic. Affected is an unknown function of the file UserMgrController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not re
it has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311658 - https://vuldb.com/?ctiid.311658 - https://vuldb.com/?submit.580744 - https://github.com/Aiyakami/CVE-1/issues/4
CVE ID: CVE-2025-5888 State: PUBLISHED Published: 2025-06-09T17:31:05.469Z Last Updated: 2025-06-09T18:34:35.601Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: jsnjfz Products: WebStack-Guns Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnri
or was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311659 - https://vuldb.com/?ctiid.311659 - https://vuldb.com/?submit.582062 - https://vuldb.com/?submit.582920 - https://github.com/Aiyakami/CVE-1/issues/5 - https://github.com/luokuang1/CVE/issues/1
CVE ID: CVE-2025-5889 State: PUBLISHED Published: 2025-06-09T18:16:01.889Z Last Updated: 2025-06-11T10:39:58.114Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: juliangruber Products: brace-expansion Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been di
remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311660 - https://vuldb.com/?ctiid.311660 - https://vuldb.com/?submit.585717 - https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466 - https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0
4858fe30814d9466 - https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5 - https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1
CVE ID: CVE-2025-5890 State: PUBLISHED Published: 2025-06-09T18:31:05.291Z Last Updated: 2025-06-09T18:44:14.680Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:T/RC:R) Vendors: actions Products: toolkit Problem Types: CWE-1333, CWE-400 Description: A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311661 - http
he attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311661 - https://vuldb.com/?ctiid.311661 - https://vuldb.com/?submit.585727 - https://github.com/actions/toolkit/pull/2057
CVE ID: CVE-2025-5891 State: PUBLISHED Published: 2025-06-09T19:00:16.482Z Last Updated: 2025-06-09T19:46:05.767Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:R) Vendors: Unitech Products: pm2 Problem Types: CWE-1333, CWE-400 Description: A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311662 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311662 - https://vuldb.com/?ctiid.311662 - https://vuldb.com/?submit.585750 - https://github.com/Unitech/pm2/pull/5971 - https://gist.github.com/mmmsssttt404/407e2ffe3e0eaa393ad923a86316a385
CVE ID: CVE-2025-5892 State: PUBLISHED Published: 2025-06-09T19:31:05.464Z Last Updated: 2025-06-09T20:01:00.258Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:R) Vendors: n/a Products: RocketChat Problem Types: CWE-1333, CWE-400 Description: A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Anal
ity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311663 - https://vuldb.com/?ctiid.311663 - https://vuldb.com/?submit.585751 - https://github.com/RocketChat/Rocket.Chat/pull/35711 - https://gist.github.com/mmmsssttt404/0fcda3b3e85edafc4eaa6816aa252deb
CVE ID: CVE-2025-5893 State: PUBLISHED Published: 2025-06-09T06:54:05.495Z Last Updated: 2025-06-09T13:18:12.744Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Honding Technology Products: Smart Parking Management System Problem Types: CWE-497, CWE-256 Description: Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10167-39c6d-1.html - https://www.twcert.org.tw/en/cp-139-10169-651d
t: References: - https://www.twcert.org.tw/tw/cp-132-10167-39c6d-1.html - https://www.twcert.org.tw/en/cp-139-10169-651d6-2.html
CVE ID: CVE-2025-5894 State: PUBLISHED Published: 2025-06-09T07:33:11.758Z Last Updated: 2025-06-09T18:06:30.320Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Honding Technology Products: Smart Parking Management System Problem Types: CWE-862 Description: Smart Parking Management System from Honding Technology has a Missing Authorization vulnerability, allowing remote attackers with regular privileges to access a specific functionality to create administrator accounts, and subsequently log into the system using those accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10170-e2435-1.html - https://ww
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10170-e2435-1.html - https://www.twcert.org.tw/en/cp-139-10171-44c0a-2.html
CVE ID: CVE-2025-5895 State: PUBLISHED Published: 2025-06-09T20:00:19.261Z Last Updated: 2025-06-10T15:30:32.919Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: Metabase Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recomm
been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311667 - https://vuldb.com/?ctiid.311667 - https://vuldb.com/?submit.585795 - https://github.com/metabase/metabase/pull/57011 - https://github.com/metabase/metabase/pull/57011#pullrequestreview-2792664135 - https://github.com/metabase/metabase/commit/4454ebbdc7719016bf80ca0f34859ce5cee9f6b0
CVE ID: CVE-2025-5896 State: PUBLISHED Published: 2025-06-09T20:31:07.141Z Last Updated: 2025-06-10T15:30:17.186Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C) Vendors: tarojs Products: taro Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf.
ading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311668 - https://vuldb.com/?ctiid.311668 - https://vuldb.com/?submit.585796 - https://github.com/NervJS/taro/pull/17619 - https://github.com/NervJS/taro/commit/c2e321a8b6fc873427c466c69f41ed0b5e8814bf - https://github.com/NervJS/taro/releases/tag/v4.1.2