Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp - https://github.com/redis/redis/commit/45eac0262028c771b6f5307372814b75f49f7a9e - https://github.com/redis/redis/releases/tag/8.2.2
CVE ID: CVE-2025-46819 State: PUBLISHED Published: 2025-10-03T19:12:10.999Z Last Updated: 2025-10-31T14:53:41.010Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: redis Products: redis Problem Types: CWE-190 Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing
version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f - https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba - https://github.com/redis/redis/releases/tag/8.2.2
CVE ID: CVE-2025-46820 State: PUBLISHED Published: 2025-05-06T18:48:52.176Z Last Updated: 2025-05-06T19:02:09.024Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: phpgt Products: Dom Problem Types: CWE-200, CWE-312, CWE-522, CWE-538 Description: phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the automatically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to
tically generated .git/config file containing the run's GITHUB_TOKEN. Seeing as the artifact can be downloaded prior to the end of the workflow, there is a few seconds where an attacker can extract the token from the artifact and use it with the GitHub API to push malicious code or rewrite release commits in your repository. Any downstream user of the repository may be affected, but the token should only be valid for the duration of the workflow run, limiting the time during which exploitation could occur. Version 4.1.8 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phpgt/Dom/security/advisories/GHSA-cwj7-6v67-2cm4 - https://github.com/ph
Vulnrichment: References: - https://github.com/phpgt/Dom/security/advisories/GHSA-cwj7-6v67-2cm4 - https://github.com/phpgt/Dom/commit/205cddcc82c002dfa48e874494efbf4c49497394
CVE ID: CVE-2025-46821 State: PUBLISHED Published: 2025-05-07T21:24:07.891Z Last Updated: 2025-05-08T14:11:13.676Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: envoyproxy Products: envoy Problem Types: CWE-186 Description: Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a set of valid characters in the URI path. As a result URI path containing the `*` character will not match a URI template expressions. This can result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in E
an result in bypass of RBAC rules when configured using the `uri_template` permissions. This vulnerability is fixed in Envoy versions v1.34.1, v1.33.3, v1.32.6, v1.31.8. As a workaround, configure additional RBAC permissions using `url_path` with `safe_regex` expression. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/envoyproxy/envoy/security/advisories/GHSA-c7cm-838g-6g67
CVE ID: CVE-2025-46822 State: PUBLISHED Published: 2025-05-21T17:23:37.087Z Last Updated: 2025-05-21T19:25:00.790Z Vendors: OsamaTaher Products: Java-springboot-codebase Problem Types: CWE-36 Description: OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/O
d2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OsamaTaher/Java-springboot-codebase/security/advisories/GHSA-q6mm-cm37-w637 - https://github.com/OsamaTaher/Java-springboot-codebase/commit/c835c6f7799eacada4c0fc77e0816f250af01ad2
CVE ID: CVE-2025-46823 State: PUBLISHED Published: 2025-05-29T17:56:23.199Z Last Updated: 2025-05-29T18:32:00.222Z Vendors: openmrs Products: openmrs-module-fhir2 Problem Types: CWE-862 Description: openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been able to add or edit data they were not supposed to be able to. All implementers should update to FHIR2 2.5.0 or newer as soon as is feasible to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.co
on as is feasible to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openmrs/openmrs-module-fhir2/security/advisories/GHSA-g5vq-w8v2-4x9j - https://github.com/openmrs/openmrs-module-fhir2/releases/tag/2.5.0
CVE ID: CVE-2025-46824 State: PUBLISHED Published: 2025-05-07T17:37:56.214Z Last Updated: 2025-08-20T19:46:09.955Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse-code-review Problem Types: CWE-79 Description: The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
round, one may disable the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/discourse/discourse-code-review/security/advisories/GHSA-358v-cwvc-gxh5 - https://github.com/discourse/discourse-code-review/commit/eed3a801f8fee217fe782212d8950eb1bd236e43
CVE ID: CVE-2025-46825 State: PUBLISHED Published: 2025-05-12T22:53:42.294Z Last Updated: 2025-05-13T14:11:07.793Z Vendors: kanboard Products: kanboard Problem Types: CWE-79 Description: Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly conf
ault content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v - https://github.com/kanboard/kanboard/commit/6ebf22eeaae9f8b4abab72e3c18e45a2c4a2a808 - https://github.com/kanboard/kanboard/commit/ac94004ea9fc455dcc5edc8a242d67d1ccd85564 - https://github.com/kanboard/kanboard/blame/v1.2.44/app/Template/project_view/importTasks.php#L11
CVE ID: CVE-2025-46826 State: PUBLISHED Published: 2025-05-07T21:32:30.865Z Last Updated: 2025-05-08T13:42:58.179Z Vendors: INSAgenda Products: insa-auth Problem Types: CWE-601 Description: insa-auth is an authentication server for INSA Rouen. A minor issue allowed third-party websites to access the server's secondary authentication bridge, potentially revealing basic student information (name and number). However, the issue posed minimal risk, was never exploited, and had limited impact. A fix was implemented promptly on May 3, 2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/INSAgenda/insa-auth/security/advisories/GHSA-63xr-gvjv-r6xv - https://githu
lnrichment: References: - https://github.com/INSAgenda/insa-auth/security/advisories/GHSA-63xr-gvjv-r6xv - https://github.com/INSAgenda/insa-auth/commit/8c1e68b2fb55aa952f522ead55a6587526982a2c - https://github.com/INSAgenda/insa-auth/commit/b0e7508e6ca4360e39fb1fd931f8d47b1f992ced - https://github.com/INSAgenda/insa-auth/commit/c77cf2e25778f83ebf5c4fdb4ded3ffcc8cfd74d
CVE ID: CVE-2025-46827 State: PUBLISHED Published: 2025-05-07T15:29:31.420Z Last Updated: 2025-05-07T15:50:18.084Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Graylog2 Products: graylog2-server Problem Types: CWE-79 Description: Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with permissions to create event definitions, while the user must have permissions to view alerts. Additionally, an active Input must be present on th
nt definitions, while the user must have permissions to view alerts. Additionally, an active Input must be present on the Graylog server that is capable of receiving form data (e.g. a HTTP input, TCP raw or syslog etc). Versions 6.0.14, 6.1.10, and 6.2.0 fix the issue. No known workarounds are available, as long as the relatively rare prerequisites are met. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-76vf-mpmx-777j
CVE ID: CVE-2025-46828 State: PUBLISHED Published: 2025-05-07T17:34:52.766Z Last Updated: 2025-05-07T20:03:17.564Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in versions up to and including 3.3.0 in the endpoint `/html/socio/sistema/get_socios.php`, specifically in the query parameter. This issue allows attackers to inject and execute arbitrary SQL statements against the application's underlying database. As a result, it may lead to data exfiltration, authentication bypass, or complete database compromise. Version 3.3.1 fixes the issue. Additional
to data exfiltration, authentication bypass, or complete database compromise. Version 3.3.1 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5qw5-q55h-6qg7 - https://github.com/LabRedesCefetRJ/WeGIA/commit/214dab59509bd3637f94adf381298c12da4ff80f
CVE ID: CVE-2025-46833 State: PUBLISHED Published: 2025-05-08T19:27:33.330Z Last Updated: 2025-05-08T19:49:41.318Z Vendors: ShashikantSingh09 Products: python-progrrames Problem Types: CWE-326 Description: Programs/P73_SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker may be able to decrypt the data using brute force attacks and because of this the whole application can be impacted. This issue has been patched in commit 6ce60b1. A workaround involves increasing the key size, for RSA or DSA this is at least 2048 bits, for ECC this is at least 256 bits. Additional Analyst Notes: - CISA ADP Vulnrich
RSA or DSA this is at least 2048 bits, for ECC this is at least 256 bits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ShashikantSingh09/python-progrrames/security/advisories/GHSA-5h26-2c6g-4ch4 - https://github.com/ShashikantSingh09/python-progrrames/commit/6ce60b1b2116a579a2e89de96d738a98f6ad4f27
CVE ID: CVE-2025-46834 State: PUBLISHED Published: 2025-05-15T19:37:07.090Z Last Updated: 2025-05-19T14:42:13.688Z Vendors: alchemyplatform Products: modular-account Problem Types: CWE-863 Description: Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys (scoped external keys) to external parties and would use the allowlist module to restrict which external contracts can be accessed by the session key. There is a bug in the allowlist module in that we don't check for the `executeUserOp` -> `execute` or `execu
ession key. There is a bug in the allowlist module in that we don't check for the `executeUserOp` -> `execute` or `executeBatch` path, effectively allowing any session key to bypass any access control restrictions set on the session key. Session keys are able to access ERC20 and ERC721 token contracts amongst others, transferring all tokens from the account out andonfigure the permissions on external modules on session keys. They would be able to remove all restrictions set on themselves this way, or rotate the keys of other keys with higher privileges into keys that they control. Commit 5e6f540d249afcaeaf76ab95517d0359fde883b0 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichm
ontrol. Commit 5e6f540d249afcaeaf76ab95517d0359fde883b0 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/alchemyplatform/modular-account/security/advisories/GHSA-jhp7-7cq9-m4pv - https://github.com/alchemyplatform/modular-account/commit/5e6f540d249afcaeaf76ab95517d0359fde883b0
CVE ID: CVE-2025-46835 State: PUBLISHED Published: 2025-07-10T15:09:42.735Z Last Updated: 2025-11-04T21:10:52.169Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: j6t Products: git-gui Problem Types: CWE-88 Description: Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment
in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg - https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da
CVE ID: CVE-2025-46836 State: PUBLISHED Published: 2025-05-14T22:59:19.997Z Last Updated: 2025-05-31T23:03:06.548Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: ecki Products: net-tools Problem Types: CWE-20, CWE-121 Description: net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer withou
ces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf - https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d
CVE ID: CVE-2025-46837 State: PUBLISHED Published: 2025-06-10T22:17:39.487Z Last Updated: 2025-06-11T14:58:27.065Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing th
he page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE ID: CVE-2025-46838 State: PUBLISHED Published: 2025-06-10T22:20:13.260Z Last Updated: 2025-06-11T14:37:50.911Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
e page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE ID: CVE-2025-46840 State: PUBLISHED Published: 2025-06-10T22:18:33.290Z Last Updated: 2025-06-12T03:55:09.562Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-285 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and int
er interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE ID: CVE-2025-46841 State: PUBLISHED Published: 2025-06-10T22:19:23.185Z Last Updated: 2025-06-11T14:43:35.649Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2025-46842 State: PUBLISHED Published: 2025-06-10T22:18:24.178Z Last Updated: 2025-06-11T14:52:14.197Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2025-46843 State: PUBLISHED Published: 2025-06-10T22:18:00.398Z Last Updated: 2025-06-11T14:57:24.147Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2025-46844 State: PUBLISHED Published: 2025-06-10T22:17:51.719Z Last Updated: 2025-06-11T14:20:06.692Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2025-46845 State: PUBLISHED Published: 2025-06-10T22:19:58.018Z Last Updated: 2025-06-11T18:06:45.652Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a
CVE ID: CVE-2025-46846 State: PUBLISHED Published: 2025-06-10T22:18:26.482Z Last Updated: 2025-06-11T14:51:51.197Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Adobe Products: Adobe Experience Manager Problem Types: CWE-79 Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpx.a