Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-28171 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T18:27:11.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://grandstream.com - http://ucm65xx.com - https://gist.github.com/Exek1el/a1fe4288f0df0a47068d618579c6b647
CVE ID: CVE-2025-28172 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T18:25:44.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://grandstream.com - https://gist.github.com/Exek1el/6291185a87c98d4229181212b2bd5cdf
CVE ID: CVE-2025-28197 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T13:57:19.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0
CVE ID: CVE-2025-28198 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T19:41:34.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hitout/carsale/issues/24
CVE ID: CVE-2025-28200 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T22:11:33.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://victure.com - http://rx1800.com - https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE ID: CVE-2025-28201 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T15:56:25.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE ID: CVE-2025-28202 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T15:57:30.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE ID: CVE-2025-28203 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T16:00:02.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pwnit.io/2025/02/13/finding-vulnerabilities-in-wi-fi-router/
CVE ID: CVE-2025-28219 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-21T19:00:08.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear DC112A V1.0.0.64 has an OS command injection vulnerability in the usb_adv.cgi, which allows remote attackers to execute arbitrary commands via parameter "deviceName" passed to the binary through a POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IdaJea/IOT_vuln_1/blob/master/DC112A_V1.0.0.64/sub_69600.pdf
CVE ID: CVE-2025-28220 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-21T18:57:33.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/setcfm.pdf
CVE ID: CVE-2025-28221 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-21T18:58:32.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the set_local_time function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IdaJea/IOT_vuln_1/blob/master/w6_s_v1.0.0.4/time.pdf
CVE ID: CVE-2025-28228 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:52:55.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228
CVE ID: CVE-2025-28229 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T15:05:48.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28229
CVE ID: CVE-2025-28230 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T15:01:58.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28230
CVE ID: CVE-2025-28231 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:26:56.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Itel Electronics IP Stream v1.7.0.6 allows unauthorized attackers to execute arbitrary commands with Administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28231
CVE ID: CVE-2025-28232 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:51:17.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28232
CVE ID: CVE-2025-28233 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:14:35.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28233
CVE ID: CVE-2025-28235 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:15:53.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Model(s) Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x allows attackers to access Administrator credentials in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28235
CVE ID: CVE-2025-28236 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:13:22.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This vulnerability allows attackers to execute arbitrary code via supplying a crafted update package to the /#/software/upgrades endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28236
CVE ID: CVE-2025-28237 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:10:53.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28237
CVE ID: CVE-2025-28238 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:08:51.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28238
CVE ID: CVE-2025-28242 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:01:01.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28242
CVE ID: CVE-2025-28243 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-11T13:55:22.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alteryx.com - https://gist.github.com/DylanGrl/fbe4cc8eaf2b95147069c82b39be59b0
CVE ID: CVE-2025-28244 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-11T13:47:17.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alteryx.com - https://gist.github.com/DylanGrl/2771afe86bdd2665b83f28c1ff5c12eb
CVE ID: CVE-2025-28245 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-11T17:56:41.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alteryx.com - https://gist.github.com/DylanGrl/5e0ac3924f4d939e9c1ebb8632f2851b
CVE ID: CVE-2025-28253 State: REJECTED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-04-07T19:55:59.869Z Description: No description available.
CVE ID: CVE-2025-28254 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T20:08:41.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensitive information via the first name field in processMentions(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Leantime/leantime/blob/0e7ddbbe3d582f657a1dddfef7b3419ae588cbf7/app/Domain/Notifications/Services/Notifications.php#L128 - https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 - https://github.com/Leantime/
28 - https://github.com/Leantime/leantime/commit/ce1d2073e4601183e1bdd90f4b433d16aee46a50 - https://github.com/Leantime/leantime/security/advisories/GHSA-95j3-435g-vjcp
CVE ID: CVE-2025-28256 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T21:18:00.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wireless.so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/A3100R/1.md
CVE ID: CVE-2025-28354 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T16:57:07.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Printer Manager Systm of Entrust Corp Printer Manager D3.18.4-3 and below allows attackers to execute a directory traversal via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.entrust.com/sites/default/files/documentation/productsupport/entrust-security-bulletin-e25-002.pdf - https://gist.github.com/VAMorales/ef13d4edc14750f689e16c9e4922becb
CVE ID: CVE-2025-28355 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T18:38:55.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Volmarg Personal Management System 1.4.65 is vulnerable to Cross Site Request Forgery (CSRF) allowing attackers to execute arbitrary code and obtain sensitive information via the SameSite cookie attribute defaults value set to none Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Volmarg/personal-management-system - https://github.com/abbisQQ/CVE-2025-28355/tree/main - https://github.com/Volmarg/personal-management-system/issues/149
CVE ID: CVE-2025-28357 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T18:25:14.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://neto.com - https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-28357.md
CVE ID: CVE-2025-28361 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T13:38:30.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthorized stack overflow vulnerability in Telesquare TLR-2005KSH v.1.1.4 allows a remote attacker to obtain sensitive information via the systemutil.cgi component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wyq-zzu/excavate/blob/main/2/1.md
CVE ID: CVE-2025-28367 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T15:58:19.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/i7MEDIA/mojoportal - https://www.0xlanks.me/blog/cve-2025-28367-advisory/
CVE ID: CVE-2025-28371 State: PUBLISHED Published: 2025-05-19T00:00:00.000Z Last Updated: 2025-05-19T16:00:16.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1kQFOyFQYycKynIBjbU8bMx2gYTG3Bxi2/view?usp=sharing - https://pastebin.com/raw/hziq1nGH - https://pastebin.com/raw/EnL1XT2n
CVE ID: CVE-2025-28380 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-10-27T15:04:51.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ - https://github.com/OpenC3/cosmos/releases/tag/v6.0.2 - https://github.com/OpenC3/cosmos/pull/1816 - https://github.com/OpenC3/cosmos/commit/12e3e12307af
/releases/tag/v6.0.2 - https://github.com/OpenC3/cosmos/pull/1816 - https://github.com/OpenC3/cosmos/commit/12e3e12307afd3dbfc306f20d60400989db89883
CVE ID: CVE-2025-28381 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-10-27T15:19:38.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ - https://github.com/OpenC3/cosmos/releases/tag/v6.0.2 - https://github.com/OpenC3/cosmos/pull/1816 - https://github.com/OpenC3/cosmos/pull/1816/commits/cce64c213fd2e6a70e2ccbf3622949fe8f9dcaef
CVE ID: CVE-2025-28382 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-10-27T15:34:02.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ - https://github.com/OpenC3/cosmos/releases/tag/v6.1.0 - https://github.com/OpenC3/cosmos/pull/1828 - https://github.com/OpenC3/cosmos/commit/fc7e11310a7cdf9f1939886e1b29009db4d4b718
CVE ID: CVE-2025-28384 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-10-27T15:25:57.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ - https://github.com/OpenC3/cosmos/releases/tag/v6.1.0 - https://github.com/OpenC3/cosmos/pull/1828 - https://github.com/OpenC3/cosmos/pull/1828/commits/fc7e11310a7cdf9f1939886e1b29009db4d4b718
CVE ID: CVE-2025-28386 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-17T18:17:06.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/
CVE ID: CVE-2025-28388 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-10-27T15:14:05.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/ - https://github.com/OpenC3/cosmos/releases/tag/v6.0.2 - https://github.com/OpenC3/cosmos/pull/1816 - https://github.com/OpenC3/cosmos/pull/1816/commits/195974a019f375f7c5a35f48e4151babb40649ac
CVE ID: CVE-2025-28389 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T15:46:51.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openc3.com/ - https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/
CVE ID: CVE-2025-28395 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-14T17:14:30.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fizz-L/Vulnerability-report/blob/main/DI-8100Buffer%20overflow.md
CVE ID: CVE-2025-28398 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-14T17:21:31.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fizz-L/Vulnerability-report/blob/main/DI-8100Buffer%20overflow2.md
CVE ID: CVE-2025-28399 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T14:17:36.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/20210607/cve_public/blob/main/CVE-2025-28399.md
CVE ID: CVE-2025-28400 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-07T18:26:16.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28400.md
CVE ID: CVE-2025-28401 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-07T18:25:23.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi