Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1189 State: PUBLISHED Published: 2025-02-12T09:31:06.069Z Last Updated: 2025-02-12T15:56:35.484Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: 1000 Projects Products: Attendance Tracking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in 1000 Projects Attendance Tracking Management System 1.0. This affects an unknown part of the file /admin/chart1.php. The manipulation of the argument course_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295095 - https://vuldb.com/?ctiid.295095 - https://vuldb.com/?submit.496452 - https://github.com/takakie/CVE/blob/main/cve_2.md - https://1000projects.org/
CVE ID: CVE-2025-1190 State: PUBLISHED Published: 2025-02-12T10:00:10.092Z Last Updated: 2025-02-12T15:34:35.547Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/load_user-profile.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295096 - https://vuldb.com/?ctiid.295096 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295096 - https://vuldb.com/?ctiid.295096 - https://vuldb.com/?submit.496670 - https://github.com/1337g/CVE-2025-X/blob/main/job-recruitment-load_applicants-xss.pdf - https://code-projects.org/
CVE ID: CVE-2025-1191 State: PUBLISHED Published: 2025-02-12T10:31:04.951Z Last Updated: 2025-02-12T15:33:04.303Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Multi Restaurant Table Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/approve-reject.php. The manipulation of the argument breject_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295097 - https://vuldb.com/?ctiid.295097 - https://vuldb.com/?submit.496729 - https://github.com/Keyand/Multi-Restaurant-Table-Reservation-System-Search/blob/main/Multi%20Restaurant%20Table%20Reservation%20System%20approve-reject.php%20has%20Sqlinjection.pdf - https://www.sourcecodester.com/
CVE ID: CVE-2025-1192 State: PUBLISHED Published: 2025-02-12T11:00:10.181Z Last Updated: 2025-02-12T15:32:37.024Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Multi Restaurant Table Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0. It has been classified as critical. Affected is an unknown function of the file select-menu.php. The manipulation of the argument table leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295098 - https://vuldb.com/?ctiid.295098 - https://vuldb.com/?submit.496730 - https://github.com/Keyand/Multi-Restaurant-Table-Reservation-System-Search/blob/main/Multi%20Restaurant%20Table%20Reservation%20System%20select-menu.php%20has%20Sqlinjection.pdf - https://www.sourcecodester.com/
CVE ID: CVE-2025-1193 State: PUBLISHED Published: 2025-02-10T13:55:24.826Z Last Updated: 2025-02-10T17:12:19.712Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-295 Description: Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack by presenting a certificate for a different host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0001/
CVE ID: CVE-2025-1194 State: PUBLISHED Published: 2025-04-29T11:30:38.810Z Last Updated: 2025-04-29T13:21:13.446Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain condition
process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2 - https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815
CVE ID: CVE-2025-1195 State: PUBLISHED Published: 2025-02-12T11:31:03.890Z Last Updated: 2025-02-12T15:32:15.648Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in code-projects Real Estate Property Management System 1.0. This issue affects some unknown processing of the file /Admin/EditCategory. The manipulation of the argument CategoryId leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul
itiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295103 - https://vuldb.com/?ctiid.295103 - https://vuldb.com/?submit.496854 - https://github.com/YinshengLu/CVE/blob/main/cve1.pdf - https://code-projects.org/
CVE ID: CVE-2025-1196 State: PUBLISHED Published: 2025-02-12T12:00:21.742Z Last Updated: 2025-02-16T14:13:28.708Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /search.php. The manipulation of the argument PropertyName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional
ly. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295104 - https://vuldb.com/?ctiid.295104 - https://vuldb.com/?submit.496855 - https://github.com/YinshengLu/CVE/blob/main/cve2.pdf - https://code-projects.org/
CVE ID: CVE-2025-1197 State: PUBLISHED Published: 2025-02-12T12:31:04.232Z Last Updated: 2025-02-18T17:35:55.730Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Real Estate Property Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /_parse/load_user-profile.php. The manipulation of the argument userhash leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
an be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295105 - https://vuldb.com/?ctiid.295105 - https://vuldb.com/?submit.496856 - https://github.com/YinshengLu/CVE/blob/main/cve3.pdf - https://code-projects.org/
CVE ID: CVE-2025-1198 State: PUBLISHED Published: 2025-02-13T00:55:50.295Z Last Updated: 2025-02-13T14:57:28.962Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-613 Description: An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/511477
CVE ID: CVE-2025-1199 State: PUBLISHED Published: 2025-02-12T13:00:14.646Z Last Updated: 2025-02-12T14:23:31.059Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Church Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been classified as critical. This affects an unknown part of the file /admin/app/role_crud.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295107 - https://vuldb.com/?ctiid.295107 - https://vuldb.com/?submit.496946 - https://github.com/Yesec/Best-church-management-software/blob/main/role_crud.php_SQLi.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-1200 State: PUBLISHED Published: 2025-02-12T13:31:05.509Z Last Updated: 2025-02-12T14:04:38.989Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Church Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/app/slider_crud.php. The manipulation of the argument del_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295108 - https://vuldb.com/?ctiid.295108 - https://vuldb.com/?submit.496950 - https://github.com/Yesec/Best-church-management-software/blob/main/slider_crud.php_SQLi.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-1201 State: PUBLISHED Published: 2025-02-12T14:00:15.735Z Last Updated: 2025-02-12T15:21:54.140Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Church Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/app/profile_crud.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment
to the public and may be used. Multiple parameters might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295109 - https://vuldb.com/?ctiid.295109 - https://vuldb.com/?submit.496951 - https://github.com/Yesec/Best-church-management-software/blob/main/profile_crud.php_SQLi.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-1202 State: PUBLISHED Published: 2025-02-12T14:31:05.278Z Last Updated: 2025-02-12T15:18:38.911Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Church Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in SourceCodester Best Church Management Software 1.1. Affected is an unknown function of the file /admin/edit_slider.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295110 - https://vuldb.com/?ctiid.295110 - https://vuldb.com/?submit.496954 - https://github.com/Yesec/Best-church-management-software/blob/main/edit_slider.php.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-1203 State: PUBLISHED Published: 2025-03-24T06:00:11.039Z Last Updated: 2025-03-24T18:10:24.535Z Vendors: Unknown Products: Slider, Gallery, and Carousel by MetaSlider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fca0b129-3299-46d6-9231-ca5afd2fdb6
alyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fca0b129-3299-46d6-9231-ca5afd2fdb66/
CVE ID: CVE-2025-1204 State: PUBLISHED Published: 2025-02-25T17:00:16.133Z Last Updated: 2025-02-25T17:23:02.222Z Vendors: Contec Health Products: CMS8000 Patient Monitor Problem Types: CWE-912 Description: The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://claroty.com/team82/research/are
on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://claroty.com/team82/research/are-contec-cms8000-patient-monitors-infected-with-a-chinese-backdoor-the-reality-is-more-complicated?ref=vault33.org - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01
CVE ID: CVE-2025-1206 State: PUBLISHED Published: 2025-02-12T15:00:11.640Z Last Updated: 2025-02-12T15:15:05.152Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/viewdetailroutine.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.29
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295143 - https://vuldb.com/?ctiid.295143 - https://vuldb.com/?submit.496961 - https://github.com/sekaino-sakura/CVE/blob/main/CVE_1.md
CVE ID: CVE-2025-1207 State: PUBLISHED Published: 2025-02-12T15:31:04.670Z Last Updated: 2025-02-12T15:56:14.735Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: phjounin Products: TFTPD64 Problem Types: CWE-404 Description: A vulnerability was found in phjounin TFTPD64 4.64. It has been declared as problematic. This vulnerability affects unknown code of the component DNS Handler. The manipulation leads to denial of service. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
rs to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295144 - https://vuldb.com/?ctiid.295144 - https://vuldb.com/?submit.497249 - https://github.com/DMCERTCE/TFTPD64_DOS - https://github.com/DMCERTCE/TFTPD64_DOS/blob/main/poc.py
CVE ID: CVE-2025-1208 State: PUBLISHED Published: 2025-02-12T16:00:09.397Z Last Updated: 2025-02-12T19:25:49.663Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Wazifa System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /Profile.php. The manipulation of the argument postcontent leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295145 - https://v
d may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295145 - https://vuldb.com/?ctiid.295145 - https://vuldb.com/?submit.497355 - https://github.com/nanguawuming/CVE2/blob/main/cve1.pdf - https://code-projects.org/
CVE ID: CVE-2025-1209 State: PUBLISHED Published: 2025-02-12T16:31:04.360Z Last Updated: 2025-02-12T19:05:05.906Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Wazifa System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is the function searchuser of the file /search_resualts.php. The manipulation of the argument firstname/lastname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. There is a typo in the affected file name. Additional Analyst Notes: - CISA ADP Vulnrichment
the public and may be used. There is a typo in the affected file name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295146 - https://vuldb.com/?ctiid.295146 - https://vuldb.com/?submit.497356 - https://github.com/nanguawuming/CVE2/blob/main/cve2.pdf - https://code-projects.org/
CVE ID: CVE-2025-1210 State: PUBLISHED Published: 2025-02-12T17:00:13.265Z Last Updated: 2025-02-12T19:04:15.250Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Wazifa System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /controllers/control.php. The manipulation of the argument to leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295147 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295147 - https://vuldb.com/?ctiid.295147 - https://vuldb.com/?submit.497357 - https://github.com/nanguawuming/CVE2/blob/main/cve3.pdf - https://code-projects.org/
CVE ID: CVE-2025-1211 State: PUBLISHED Published: 2025-02-11T05:00:00.994Z Last Updated: 2025-03-16T12:48:56.614Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P) Vendors: n/a Products: hackney Problem Types: CWE-918 Description: Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI built-in module and hackey. Given the URL http://127.0.0.1?@127.2.2.2/, the URI function will parse and see the host as 127.0.0.1 (which is correct), and hackney will refer the host as 127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking. Additional Analy
127.2.2.2/. This vulnerability can be exploited when users rely on the URL function for host checking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-HEX-HACKNEY-6516131 - https://gist.github.com/snoopysecurity/996de09ec0cfd0ebdcfdda8ff515deb1 - https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf - https://github.com/benoitc/hackney/commit/9594ce58fabd32cd897fc28fae937694515a3d4a
CVE ID: CVE-2025-1212 State: PUBLISHED Published: 2025-02-12T15:02:07.113Z Last Updated: 2025-02-12T21:07:44.561Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-497 Description: An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/502196
CVE ID: CVE-2025-1213 State: PUBLISHED Published: 2025-02-12T17:31:10.932Z Last Updated: 2025-02-12T18:55:10.678Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: pihome-shc Products: PiHome Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295172 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295172 - https://vuldb.com/?ctiid.295172 - https://vuldb.com/?submit.497521 - https://github.com/janssensjelle/published-pocs/blob/main/pihome_xss_index.md
CVE ID: CVE-2025-1214 State: PUBLISHED Published: 2025-02-12T18:00:11.965Z Last Updated: 2025-02-12T19:41:53.328Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: pihome-shc Products: PiHome Problem Types: CWE-862, CWE-863 Description: A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295173 - https://v