Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11599 State: PUBLISHED Published: 2025-10-11T12:02:05.841Z Last Updated: 2025-10-14T14:06:50.483Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Apartment Visitor Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php. This manipulation of the argument email causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327920 - https://vuldb.com/?ctiid.327920 - https://vuldb.com/?submit.671910 - https://github.com/feiyang85/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-11600 State: PUBLISHED Published: 2025-10-11T12:32:05.817Z Last Updated: 2025-10-14T14:06:44.036Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Food Ordering System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such manipulation of the argument cname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
osed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327921 - https://vuldb.com/?ctiid.327921 - https://vuldb.com/?submit.671913 - https://github.com/zzonce/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-11601 State: PUBLISHED Published: 2025-10-11T13:02:06.208Z Last Updated: 2025-10-14T14:06:37.433Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Student Result System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327922 - https://vuldb.com/?ctiid.327922 - https://vuldb.com/?submit.671918 - https://github.com/Cloverhyl/CVE/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-11602 State: PUBLISHED Published: 2025-10-31T10:20:17.254Z Last Updated: 2025-10-31T11:37:44.777Z Vendors: neo4j Products: Enterprise Edition, Community Edition Problem Types: CWE-226 Description: Potential information leak in bolt protocol handshake in Neo4j Enterprise and Community editions allows attacker to obtain one byte of information from previous connections. The attacker has no control over the information leaked in server responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://neo4j.com/security/cve-2025-11602
CVE ID: CVE-2025-11603 State: PUBLISHED Published: 2025-10-11T13:32:06.994Z Last Updated: 2025-10-17T14:39:04.596Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Food Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulation of the argument Category results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327925 - https://vuld
ld be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327925 - https://vuldb.com/?ctiid.327925 - https://vuldb.com/?submit.671957 - https://github.com/xmqaq/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-11604 State: PUBLISHED Published: 2025-10-11T14:02:05.580Z Last Updated: 2025-10-17T14:38:05.577Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Ordering Food System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
y disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327926 - https://vuldb.com/?ctiid.327926 - https://vuldb.com/?submit.671979 - https://github.com/Duo-zhen/CVE/issues/4
CVE ID: CVE-2025-11605 State: PUBLISHED Published: 2025-10-11T14:32:06.238Z Last Updated: 2025-10-14T14:06:31.122Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Client Details System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipulation of the argument uid leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327927 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327927 - https://vuldb.com/?ctiid.327927 - https://vuldb.com/?submit.672049 - https://vuldb.com/?submit.672057 - https://github.com/hellonewbie/tutorial/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-11606 State: PUBLISHED Published: 2025-10-11T15:02:05.512Z Last Updated: 2025-10-14T14:06:25.915Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: iPynch Products: Social Network Website Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in iPynch Social Network Website up to b6933b6d7f82c84819abe458ccf0e59d61119541. The affected element is an unknown function of the component Search. Performing manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. This product adopts a rolling release strategy to maintain continuous
been released to the public and may be exploited. This product adopts a rolling release strategy to maintain continuous delivery Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327928 - https://vuldb.com/?ctiid.327928 - https://vuldb.com/?submit.672465 - https://github.com/Lianhaorui/Report/blob/main/sql.docx
CVE ID: CVE-2025-11607 State: PUBLISHED Published: 2025-10-11T16:32:05.833Z Last Updated: 2025-10-14T14:54:37.776Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: harry0703 Products: MoneyPrinterTurbo Problem Types: CWE-22 Description: A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing manipulation of the argument File can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment:
exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327929 - https://vuldb.com/?ctiid.327929 - https://vuldb.com/?submit.672550 - https://www.notion.so/Arbitrary-File-Write-Vulnerability-in-MoneyPrinterTurbo-1-2-6-288014c4d9ca809bb411e4fe875d1e22
CVE ID: CVE-2025-11608 State: PUBLISHED Published: 2025-10-11T17:02:05.989Z Last Updated: 2025-10-14T14:54:33.242Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: E-Banking System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component POST Parameter Handler. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
y. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327930 - https://vuldb.com/?ctiid.327930 - https://vuldb.com/?submit.672559 - https://github.com/lakshayyverma/CVE-Discovery/blob/main/E-Banking%20System%20SQLi.md - https://code-projects.org/
CVE ID: CVE-2025-11609 State: PUBLISHED Published: 2025-10-11T17:32:05.833Z Last Updated: 2025-10-14T14:54:28.114Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: code-projects Products: Hospital Management System Problem Types: CWE-321, CWE-320 Description: A flaw has been found in code-projects Hospital Management System 1.0. Affected is the function session of the component express-session. This manipulation of the argument secret with the input secret causes use of hard-coded cryptographic key . The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has be
motely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327932 - https://vuldb.com/?ctiid.327932 - https://vuldb.com/?submit.672589 - https://github.com/lakshayyverma/CVE-Discovery/blob/main/Hospital%20Management%20System.md - https://code-projects.org/
CVE ID: CVE-2025-11610 State: PUBLISHED Published: 2025-10-11T18:02:06.123Z Last Updated: 2025-10-14T14:54:23.584Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manipulation of the argument editBrandName results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
he public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327937 - https://vuldb.com/?ctiid.327937 - https://vuldb.com/?submit.672659 - https://github.com/yihaofuweng/cve/issues/52 - https://www.sourcecodester.com/
CVE ID: CVE-2025-11611 State: PUBLISHED Published: 2025-10-11T18:32:06.552Z Last Updated: 2025-10-14T14:54:18.957Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Simple Inventory System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327938
ic and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327938 - https://vuldb.com/?ctiid.327938 - https://vuldb.com/?submit.672660 - https://github.com/yihaofuweng/cve/issues/53 - https://www.sourcecodester.com/
CVE ID: CVE-2025-11612 State: PUBLISHED Published: 2025-10-11T19:02:05.363Z Last Updated: 2025-10-14T14:54:14.244Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Food Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327942 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327942 - https://vuldb.com/?ctiid.327942 - https://vuldb.com/?submit.672775 - https://github.com/xmqaq/cve/issues/6 - https://code-projects.org/
CVE ID: CVE-2025-11613 State: PUBLISHED Published: 2025-10-11T19:32:06.311Z Last Updated: 2025-10-14T14:54:09.364Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Food Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of the argument cname results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327943 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327943 - https://vuldb.com/?ctiid.327943 - https://vuldb.com/?submit.672774 - https://github.com/xmqaq/cve/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-11614 State: PUBLISHED Published: 2025-10-11T20:32:05.814Z Last Updated: 2025-10-14T14:54:04.235Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit-appointment.php. Such manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
t is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327945 - https://vuldb.com/?ctiid.327945 - https://vuldb.com/?submit.672819 - https://github.com/Rowantu/CVE/issues/5 - https://www.sourcecodester.com/
CVE ID: CVE-2025-11615 State: PUBLISHED Published: 2025-10-11T21:32:06.052Z Last Updated: 2025-10-14T14:53:58.073Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best Salon Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
as been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327946 - https://vuldb.com/?ctiid.327946 - https://vuldb.com/?submit.672822 - https://github.com/Blowingwinds/cve-report/blob/main/cve7/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-11616 State: PUBLISHED Published: 2025-10-10T17:10:27.015Z Last Updated: 2025-10-10T20:32:25.552Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: AWS Products: FreeRTOS-Plus_TCP Problem Types: CWE-126 Description: A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6. Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment
any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4 - https://aws.amazon.com/security/security-bulletins/AWS-2025-023/ - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-8j9h-xjm9-8j6j
CVE ID: CVE-2025-11617 State: PUBLISHED Published: 2025-10-10T17:10:30.901Z Last Updated: 2025-10-10T19:13:58.741Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: AWS Products: FreeRTOS-Plus-TCP Problem Types: CWE-126 Description: A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6. We recommend users upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References
r derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4 - https://aws.amazon.com/security/security-bulletins/AWS-2025-023/ - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-wmjr-wm93-cvv2
CVE ID: CVE-2025-11618 State: PUBLISHED Published: 2025-10-10T17:10:34.267Z Last Updated: 2025-10-10T20:31:12.979Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: AWS Products: FreeRTOS-Plus-TCP Problem Types: CWE-476 Description: A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. This issue only affects applications using IPv6. We recommend upgrading to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnric
sure any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4 - https://aws.amazon.com/security/security-bulletins/AWS-2025-023/ - https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-6fh9-mqxj-hmwj
CVE ID: CVE-2025-11619 State: PUBLISHED Published: 2025-10-15T19:45:10.912Z Last Updated: 2025-10-15T20:01:15.384Z Vendors: Devolutions Products: Devolutions Server Problem Types: CWE-295 Description: Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0014/
CVE ID: CVE-2025-11620 State: PUBLISHED Published: 2025-11-18T08:27:30.802Z Last Updated: 2025-11-18T16:14:35.718Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: jemoreto Products: Multiple Roles per User Problem Types: CWE-862 Description: The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple_roles_ui' and 'mrpu_save_multiple_user_roles' functions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, granted the 'edit_users' capability, to edit any user's role, including promoting users to Administrator and demoti
ers, granted the 'edit_users' capability, to edit any user's role, including promoting users to Administrator and demoting Administrators to lower-privileged roles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30741601-50b9-4799-a340-11f6ffa59553?source=cve - https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L54 - https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L121
CVE ID: CVE-2025-11621 State: PUBLISHED Published: 2025-10-23T19:08:54.989Z Last Updated: 2025-10-24T03:55:22.629Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-288 Description: Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashi
1.0, 1.20.5, 1.19.11, and 1.16.27 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709
CVE ID: CVE-2025-11622 State: PUBLISHED Published: 2025-10-13T21:07:50.065Z Last Updated: 2025-11-11T15:04:37.871Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-502 Description: Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025
CVE ID: CVE-2025-11623 State: PUBLISHED Published: 2025-10-13T21:09:07.731Z Last Updated: 2025-10-13T23:09:19.977Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti Endpoint Manager allows a remote authenticated attacker to read arbitrary data from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-EPM-October-2025
CVE ID: CVE-2025-11624 State: PUBLISHED Published: 2025-10-21T13:14:19.625Z Last Updated: 2025-10-21T14:08:16.924Z Vendors: wolfSSH Products: wolfSSH Problem Types: CWE-787 Description: Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptor size, but smaller than max handle size allowed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssh/pull/834
CVE ID: CVE-2025-11625 State: PUBLISHED Published: 2025-10-21T13:25:18.120Z Last Updated: 2025-10-21T14:04:15.921Z Vendors: wolfSSH Products: wolfSSH Problem Types: CWE-287 Description: Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssh/pull/840