Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-44039 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-13T15:33:54.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive information without any authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yashodhanvivek/CP-XR-DE21-S--4G-Router-Vulnerabilities/blob/main/input.md
CVE ID: CVE-2025-44040 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-10-13T19:12:50.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier because an adversary has no way to place the specific MD5 value into the credential store (unless they already have full privileges) and because the specific MD5 value would not realistically be present otherwise. Additional Analys
have full privileges) and because the specific MD5 value would not realistically be present otherwise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/orangehrm/orangehrm/releases/tag/v5.7 - https://github.com/hexomedin3/advisories/tree/main/CVE-2025-44040
CVE ID: CVE-2025-44043 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-17T19:18:10.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory value when making POST requests to the affected components. In doing so an attacker can get the SearchUnit server to read and write configuration and log files from/to the attackers server. Additional Analyst Notes: - CISA
Unit server to read and write configuration and log files from/to the attackers server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keyoti.com/products/search/dotNetWeb/HtmlHelp9/?topic=UserGuide/Release%20Notes.htm - https://www.sprocketsecurity.com/blog/cve-alert-cve-2025-44043-cve-2025-44044-the-search-bar-hacks-arent-dead-yet
CVE ID: CVE-2025-44044 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-10T19:40:32.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keyoti.com/products/search/dotNetWeb/HtmlHelp9/?topic=UserGuide/Release%20Notes.htm - https://www.sprocketsecurity.com/blog/cve-alert-cve-2025-44043-cve-2025-44044-the-search-bar-hacks-arent-dead-yet
CVE ID: CVE-2025-44071 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:02:52.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/202110420106/CVE/blob/master/seacms/seacms_rce.md
CVE ID: CVE-2025-44072 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:01:42.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/202110420106/CVE/blob/master/seacms/seacms_manage_sql.md
CVE ID: CVE-2025-44073 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-07T13:17:53.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/202110420106/CVE/blob/master/seacms/seacms_comment_news_sql.md
CVE ID: CVE-2025-44074 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:00:14.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/202110420106/CVE/blob/master/seacms/seacms_topic_sql.md
CVE ID: CVE-2025-44083 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-22T18:30:49.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-1.md
CVE ID: CVE-2025-44084 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-21T19:27:54.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/piposy/IOTsec/blob/main/Dlink/DI8100/DI8100-A1-2.md
CVE ID: CVE-2025-44091 State: PUBLISHED Published: 2025-06-12T00:00:00.000Z Last Updated: 2025-06-13T15:47:54.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HL4245/CVE/blob/main/%E7%AE%80%E7%BA%A6%E5%90%8E%E5%8F%B0%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F.md - https://gist.github.com/HL4245/f2e88b7afea9ee08cc4282f38b5ea1cf
CVE ID: CVE-2025-44108 State: PUBLISHED Published: 2025-05-19T00:00:00.000Z Last Updated: 2025-05-19T18:22:26.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress/releases/tag/1.3.1 - https://github.com/flatpressblog/flatpress/releases/tag/1.4.rc2 - https://github.com/flatpressblog/flatpress/commit/24a6
https://github.com/flatpressblog/flatpress/releases/tag/1.4.rc2 - https://github.com/flatpressblog/flatpress/commit/24a6feacf1747ec19725b52c097715c8ab9c4559 - https://harish0x.github.io/blog/CVE-2025-44108
CVE ID: CVE-2025-44109 State: PUBLISHED Published: 2025-07-23T00:00:00.000Z Last Updated: 2025-07-23T19:54:30.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Suuuuuzy/609c7b2e74a8cc16c8e0302a100b86e0 - https://drive.google.com/file/d/12XY2WFBvGJ104gUvyG6YDIEdy4y1gl8i/view - https://suuuuuzy.github.io/mostly-harmless/pinokio_poc/index.html
CVE ID: CVE-2025-44110 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-16T13:43:32.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/189672/
CVE ID: CVE-2025-44115 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-02T20:00:57.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cotonti/Cotonti/issues/1650 - https://github.com/Cotonti/Cotonti/issues/1834 - https://gist.github.com/yA0-Z/9666b1a333607381ab8dfcc137f2b65c
CVE ID: CVE-2025-44134 State: PUBLISHED Published: 2025-04-24T00:00:00.000Z Last Updated: 2025-04-24T15:47:31.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php. Manipulation of parameter class will lead to SQL injection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/secloverwang/-Vulnerability-recurrence/issues/3
CVE ID: CVE-2025-44135 State: PUBLISHED Published: 2025-04-24T00:00:00.000Z Last Updated: 2025-04-24T15:46:13.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php. Manipulating the parameter username will cause SQL injection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/secloverwang/-Vulnerability-recurrence/issues/4
CVE ID: CVE-2025-44136 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T17:34:31.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/maptiler/tileserver-php/issues/167 - https://github.com/mheranco/CVE-2025-44136
CVE ID: CVE-2025-44137 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T17:35:10.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format" Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/maptiler/tileserver-php/issues/167 - https://github.com/mhera
- CISA ADP Vulnrichment: References: - https://github.com/maptiler/tileserver-php/issues/167 - https://github.com/mheranco/CVE-2025-44137
CVE ID: CVE-2025-44139 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-04T16:55:16.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://emlog.com - https://gist.github.com/babapihai/b56121e0b2694e2be22571057d05298e
CVE ID: CVE-2025-44141 State: PUBLISHED Published: 2025-06-26T00:00:00.000Z Last Updated: 2025-06-26T17:50:16.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://backdrop.com - https://scandalous-author-611.notion.site/CVE-2025-44141-21d29577f39e802480a2efab13e66c61
CVE ID: CVE-2025-44148 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-03T15:50:57.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://mailenable.com - https://github.com/barisbaydur/CVE-2025-44148
CVE ID: CVE-2025-44163 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T20:01:03.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RaspAP/raspap-webgui/blob/125ae7a39ad7c9a71250d3b3e349fd767687ff8d/ajax/networking/get_wgkey.php#L9 - https://gist.git
m/RaspAP/raspap-webgui/blob/125ae7a39ad7c9a71250d3b3e349fd767687ff8d/ajax/networking/get_wgkey.php#L9 - https://gist.github.com/YichaoXu/3694f039a3d1b973efd068e4dc662a41
CVE ID: CVE-2025-44172 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-02T18:10:37.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hcxj/Tenda-Vul/blob/main/setSmartPowerManagement.md
CVE ID: CVE-2025-44175 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-13T17:31:15.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xubeining/Cve_report/blob/main/The%20router%20Tenda%20AC10%20v4%20V16.03.10.13%20of%20Shenzhen%20Jixiang%20Tenda%20Technology%20Co.%2C%20Ltd.%20has%20a%20heap%20overflow%20vulnerability.md
CVE ID: CVE-2025-44176 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-13T17:32:28.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xubeining/Cve_report/blob/main/Notification%20of%20Remote%20Code%20Execution%20Vulnerability%20in%20Tenda%20FH451%20Router%20%28Version%20V1.0.0.9%29%20by%20Shenzhen%20Jixiang%20Tenda%20Technology.md
CVE ID: CVE-2025-44177 State: PUBLISHED Published: 2025-07-09T00:00:00.000Z Last Updated: 2025-07-09T20:43:43.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/stSLAYER/4a2ecfbab1215a0be0dde59c4ac0122d - https://protop.com
CVE ID: CVE-2025-44178 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T19:04:28.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information and modify its configuration via the UPnP protocol WAN sides without any authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/stevenyu113228/a1fab78fa34a86f7416aa2aa33284fd1
CVE ID: CVE-2025-44179 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T15:52:28.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service. The issue arises due to improper input validation within the telnet command handling mechanism. An attacker can exploit this vulnerability by injecting arbitrary commands through the telnet interface when prompted for inputs or commands. Successful exploitation could lead to remote code execution (RCE) under the privileges of the telnet user, potentially allowing unauthorized access to system settings and sensitive informa
der the privileges of the telnet user, potentially allowing unauthorized access to system settings and sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/stevenyu113228/d4271c2d5243e515e8a35a8e224de103
CVE ID: CVE-2025-44180 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T16:12:38.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/ - https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44180-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE ID: CVE-2025-44181 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T14:17:05.006Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/ - https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44181-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE ID: CVE-2025-44182 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T14:09:12.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, enginenumber' in the /admin/edit-vehicle.php component. This allows attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/
CVE ID: CVE-2025-44183 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-15T19:25:22.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/vehicle-record-system-using-php-and-mysql/ - https://github.com/nscerol/Vehicle-Record-Management-System/blob/main/CVE-2025-44183-Vehicle-Record-Management-System-1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE ID: CVE-2025-44184 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T13:51:56.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the website_image, fname, lname, contact, username, and address parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17689/best-employee-management-system-php.html - https://github.com/cumakurt/CVE-SourceCodester-Best-Employee-Management-System-1.0/blob/main/CVE-2025-44184-SourceCodester-Best-Employee-Management-System-1.0-Stored%20XSS.md
CVE ID: CVE-2025-44185 State: PUBLISHED Published: 2025-05-15T00:00:00.000Z Last Updated: 2025-05-19T18:23:03.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17689/best-employee-management-system-php.html - https://www.sourcecodester.com/sites/default/files/download/mayuri_k/_hr_soft_updated.zip - https://github.com/cumakurt/CVE-SourceCodester-Best-Employee-Management-System-1.0/blob/main/CVE-2025-44185-SourceCodester-Best-
github.com/cumakurt/CVE-SourceCodester-Best-Employee-Management-System-1.0/blob/main/CVE-2025-44185-SourceCodester-Best-Employee-Management-System-1.0-CSRF-in-Password-Change.md
CVE ID: CVE-2025-44186 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-19T18:00:58.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/Operation/User.php page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17689/best-employee-management-system-php.html - https://github.com/cumakurt/CVE-SourceCodester-Best-Employee-Management-System-1.0/blob/main/CVE-2025-44186-SourceCodester-Best-Employee-Management-System-1.0-CSRF-in-User-Update.md
CVE ID: CVE-2025-44192 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-02T16:52:40.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-1.md
CVE ID: CVE-2025-44193 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-01T18:56:25.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-2.md
CVE ID: CVE-2025-44194 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-01T18:55:20.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/red-team00/bug_report/blob/main/simple-barangay-management-system/SQLi-3.md
CVE ID: CVE-2025-44201 State: REJECTED Published: N/A Last Updated: 2025-08-15T20:36:59.572Z Description: No description available.
CVE ID: CVE-2025-44203 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T15:30:45.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hoteldruid.com/ - https:/