Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3277 State: PUBLISHED Published: 2025-04-14T16:50:48.902Z Last Updated: 2025-05-27T14:42:04.019Z Vendors: SQLite Products: sqlite Problem Types: CWE-122 Description: An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can result in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sqlite.org/src/info/498e3f1cf57f164f
CVE ID: CVE-2025-3278 State: PUBLISHED Published: 2025-04-19T02:22:33.746Z Last Updated: 2025-04-21T02:47:09.027Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Edge-Themes Products: UrbanGo Membership Problem Types: CWE-269 Description: The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_register_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role. Additional Analyst Notes: - C
attackers to gain elevated privileges by creating an account with the administrator role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/913ffe0c-c8f8-4cda-be9a-96c056d4c4a8?source=cve - https://themeforest.net/item/urbango-directory-and-listing-wordpress-theme/22712624
CVE ID: CVE-2025-3279 State: PUBLISHED Published: 2025-06-26T05:31:25.858Z Last Updated: 2025-06-26T13:22:27.886Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attackers to create a DoS condition by sending crafted GraphQL requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/534424 - https://hackerone.com/reports/3067111
CVE ID: CVE-2025-3280 State: PUBLISHED Published: 2025-04-24T08:23:51.816Z Last Updated: 2025-04-24T13:06:32.669Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: elextensions Products: ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Problem Types: CWE-89 Description: The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker
arameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e4b83a-34d5-4a8a-b694-a887a46fe6bf?source=cve - https://wordpress.org/plugins/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/
CVE ID: CVE-2025-3281 State: PUBLISHED Published: 2025-05-06T07:24:21.668Z Last Updated: 2025-05-06T13:25:25.517Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpeverest Products: User Registration & Membership – Custom Registration Form, Login Form, and User Profile Problem Types: CWE-639 Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticat
n() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30339ff6-b6bf-4c56-b6cd-db0b8a6ce8b6?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.1.3/modules/membership/includes/AJAX.php#L619 - https://plugins.trac.wordpress.org/changeset/3287698/user-registration/trunk/modules/membership/includes/AJAX.php
CVE ID: CVE-2025-3282 State: PUBLISHED Published: 2025-04-12T06:37:17.798Z Last Updated: 2025-04-14T16:23:01.145Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpeverest Products: User Registration & Membership – Custom Registration Form, Login Form, and User Profile Problem Types: CWE-639 Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for u
hip_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c525b41c-dca5-442a-927e-4583cb303ed1?source=cve - https://plugins.trac.wordpress.org/changeset/3268617/user-registration/trunk/modules/membership/includes/AJAX.php
CVE ID: CVE-2025-3283 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:39.653Z Description: No description available.
CVE ID: CVE-2025-3284 State: PUBLISHED Published: 2025-04-19T02:22:33.079Z Last Updated: 2025-04-21T14:16:11.881Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPEverest Products: User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin Problem Types: CWE-352 Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticate
rrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4616b609-e8dc-4004-a5b7-2de3e83719be?source=cve - https://wpuserregistration.com/changelog/
CVE ID: CVE-2025-3285 State: PUBLISHED Published: 2025-04-08T15:26:52.421Z Last Updated: 2025-04-08T18:23:17.092Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-125 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-u
cious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html
CVE ID: CVE-2025-3286 State: PUBLISHED Published: 2025-04-08T15:28:21.615Z Last Updated: 2025-04-08T18:16:28.722Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-125 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-u
CVE ID: CVE-2025-3287 State: PUBLISHED Published: 2025-04-08T15:29:45.559Z Last Updated: 2025-04-08T18:06:20.961Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-125 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/adv
es: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html
CVE ID: CVE-2025-3288 State: PUBLISHED Published: 2025-04-08T15:30:31.744Z Last Updated: 2025-04-08T18:02:20.870Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-125 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to read outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-u
CVE ID: CVE-2025-3289 State: PUBLISHED Published: 2025-04-08T15:34:20.927Z Last Updated: 2025-04-08T17:28:45.178Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE 121 – Stack-based Buffer Overflow Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a stack-based memory buffer overflow. The flaw is result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-
E file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1726.html
CVE ID: CVE-2025-3292 State: PUBLISHED Published: 2025-04-12T06:37:16.694Z Last Updated: 2025-04-14T16:26:16.498Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpeverest Products: User Registration & Membership – Custom Registration Form, Login Form, and User Profile Problem Types: CWE-639 Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthentic
profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59a63cd8-9d33-4a2c-a499-5b1ee38c07d6?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.1.3/includes/class-ur-ajax.php#L323 - https://plugins.trac.wordpress.org/changeset/3268617/user-registration/trunk/includes/class-ur-ajax.php
CVE ID: CVE-2025-3294 State: PUBLISHED Published: 2025-04-17T05:23:19.895Z Last Updated: 2025-04-17T17:10:06.019Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: benjaminprojas Products: WP Editor Problem Types: CWE-22 Description: The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server. Additional Analyst Note
may make remote code execution possible assuming the files can be written to by the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9298820e-3753-41b3-8ba6-9fb494e215a8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3295 State: PUBLISHED Published: 2025-04-17T05:23:19.325Z Last Updated: 2025-04-17T19:12:57.011Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: benjaminprojas Products: WP Editor Problem Types: CWE-22 Description: The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the affected site's server which may reveal sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/461
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4618c1f4-c0aa-47f5-8c0b-2cb4a021f2e0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3269832%40wp-editor%2Ftrunk&old=3151053%40wp-editor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3296 State: PUBLISHED Published: 2025-04-05T08:00:14.365Z Last Updated: 2025-04-07T16:30:22.010Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=delete_customer. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303491 - https://vuldb.com/?ctiid.303491 - https://vuldb.com/?submit.549932 - https://github.com/foreverfeifei/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3297 State: PUBLISHED Published: 2025-04-05T08:31:09.055Z Last Updated: 2025-04-07T16:28:43.237Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Master.php?f=save_product. The manipulation of the argument brand leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CI
been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303492 - https://vuldb.com/?ctiid.303492 - https://vuldb.com/?submit.549982 - https://github.com/foreverfeifei/cve/blob/main/xss.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3298 State: PUBLISHED Published: 2025-04-05T10:31:05.710Z Last Updated: 2025-04-07T16:27:54.580Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-284, CWE-266 Description: A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Registration Handler. The manipulation of the argument email leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and
eads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303493 - https://vuldb.com/?ctiid.303493 - https://vuldb.com/?submit.550010 - https://github.com/foreverfeifei/cve/blob/main/user.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3299 State: PUBLISHED Published: 2025-04-05T11:00:13.683Z Last Updated: 2025-04-07T16:26:57.056Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /appointment.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.30
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303494 - https://vuldb.com/?ctiid.303494 - https://vuldb.com/?submit.550185 - https://github.com/LaneyYu/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-3300 State: PUBLISHED Published: 2025-04-24T08:23:50.977Z Last Updated: 2025-04-24T13:52:18.543Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ludwigyou Products: WPMasterToolKit (WPMTK) – All in one plugin Problem Types: CWE-22 Description: The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c389ba1a-45c5-4fba-9b99-0713fe39da42?source=cve - https://wordpress.org/plugins/wpmastertoolkit/
CVE ID: CVE-2025-3301 State: PUBLISHED Published: 2025-04-29T13:47:42.717Z Last Updated: 2025-04-29T14:02:03.494Z Vendors: silabs.com Products: Series 2 SoCs and associated modules Problem Types: CWE-1255 Description: DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a lack of hardware and software support. A successful DPA attack may result in exposure of confidential information. The best practice is to use the impacted crypto curves and operations with ephemeral keys to reduce the number of DPA traces that can be collected. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
to reduce the number of DPA traces that can be collected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000O8qbY
CVE ID: CVE-2025-3302 State: PUBLISHED Published: 2025-06-11T11:18:37.031Z Last Updated: 2025-06-11T13:12:06.375Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: xagio Products: Xagio SEO – AI Powered SEO Problem Types: CWE-79 Description: The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patc
y web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e2afd66-c896-47c8-bf56-84a086087d55?source=cve - https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/models/xagio_log404.php#L263 - https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/models/xagio_log404.php#L335 - https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L554 - https://plugins.trac.wordpress.org/browser/xag
org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L554 - https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.34/modules/redirects/redirects.js#L662 - https://wordpress.org/plugins/xagio-seo - https://xagio.com/redirects/ - https://plugins.trac.wordpress.org/changeset/3281174/ - https://plugins.trac.wordpress.org/changeset/3305780/
CVE ID: CVE-2025-3303 State: PUBLISHED Published: 2025-04-05T21:00:15.758Z Last Updated: 2025-04-07T16:00:46.068Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Patient Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303500 - https://vuldb.com/?ctiid.303500 - https://vuldb.com/?submit.549644 - https://github.com/hyfhacker/cve/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-3304 State: PUBLISHED Published: 2025-04-05T22:00:13.185Z Last Updated: 2025-04-07T16:00:12.376Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Patient Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /dental_not.php. The manipulation of the argument itr_no leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld