Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-55780 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-25T14:47:03.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708720 - https://github.com/ISH2YU/CV
CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=708720 - https://github.com/ISH2YU/CVE-2025-55780/tree/main - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=bdd5d241748807378a78a622388e0312332513c5
CVE ID: CVE-2025-55795 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-09-29T17:44:43.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial
cker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openml - https://github.com/openml/openml.org - https://github.com/openml/openml.org/security/advisories/GHSA-87c5-mc8v-xf7r
CVE ID: CVE-2025-55796 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-18T17:11:57.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted as "%d %H:%M:%S" without incorporating any user-specific data or cryptographic randomness. This predictability allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirma
y allows remote attackers to brute-force valid tokens within a small time window, enabling unauthorized account confirmation, password resets, and email change approvals, potentially leading to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openml - https://github.com/openml/openml.org - https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6
CVE ID: CVE-2025-55797 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T19:57:56.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FormCms - https://github.com/FormCms/FormCms - https://github.com/KKC73/me/tree/main/CVE-2025-55797
CVE ID: CVE-2025-55810 State: PUBLISHED Published: 2025-11-13T00:00:00.000Z Last Updated: 2025-11-14T18:04:05.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, which allows physical attackers to execute commands as root via script file with a specific name on a SD card. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.alagaai.com/ - https://www.mgm-sp.com/privilege-escalation-vulnerability-in-alaga-home-security-wifi-camera
CVE ID: CVE-2025-55824 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-03T19:52:04.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitive data on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/CTRLCCT/8f314998f30a95262e512b5417151ea1
CVE ID: CVE-2025-55834 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T13:22:00.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RrEeSeEeTt/CVEs/blob/main/JeeWMS-xss.md
CVE ID: CVE-2025-55835 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T15:42:18.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://sueamcms.com - http://www.sueamcms.com - https://github.com/Utainlab/Vulns/blob/main/CVE-2025-55835.txt
CVE ID: CVE-2025-55847 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-29T15:25:37.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service (DoS) on the system Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/meigui637/iot_zone/blob/main/%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E.md
CVE ID: CVE-2025-55848 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-29T15:27:54.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_casswd parameter is not filtered by '&'to allow injection of reverse connection commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/meigui637/iot_zone/blob/main/%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
CVE ID: CVE-2025-55849 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T19:35:55.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplatee Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://shenzhen.com - https://gitee.com/zyun4/wei-php5.0/issues/ICWO0Y
CVE ID: CVE-2025-55852 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T19:57:56.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security_5g. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CyberJ3ff/IOT/blob/main/tenda/tenda%20AC8%20v4%20V16.03.34.06/detail.md
CVE ID: CVE-2025-55885 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T17:56:41.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://alpes.com - http://ard.com - https://services.ard.fr/index.php - https://github.com/0xZeroSec/CVE-2025-55885
CVE ID: CVE-2025-55886 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-11-17T18:33:50.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint. An authenticated attacker can manipulate this parameter to access the payment history of other users without authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://services.ard.fr - https://github.com/0xZeroSec/CVE-2025-55886
CVE ID: CVE-2025-55887 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-24T19:13:11.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ther malicious actions performed on behalf of the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://alpes.com - http://ard.com - https://services.ard.fr/index.php - https://github.com/0xZeroSec/CVE-2025-55887
CVE ID: CVE-2025-55888 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T18:03:05.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution in the context of users browsers. This flaw could lead to session hijacking, cookie theft, and other malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://alpes.com - http://ard.com - https:/
us actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://alpes.com - http://ard.com - https://services.ard.fr/?eID=tx_afereload_ajax_transactionmanager - https://github.com/0xZeroSec/CVE-2025-55888
CVE ID: CVE-2025-55903 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T19:56:00.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codecanyon.net/item/perfex-powerful-open-source-crm/14013737 - https://github.com/ajansha/CVE-2025-55903
CVE ID: CVE-2025-55904 State: PUBLISHED Published: 2025-09-17T00:00:00.000Z Last Updated: 2025-09-17T14:28:46.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/related HTTP POST request with an empty HTTP body is sent to the SBI of either AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, or UDR, resulting in a denial of service. This occurs in the parse_multipart function in lib/sbi/message.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/commit/67ba7f92bbd7a378954895d96d9d7b05d5b64615 - https://gith
ichment: References: - https://github.com/open5gs/open5gs/commit/67ba7f92bbd7a378954895d96d9d7b05d5b64615 - https://github.com/open5gs/open5gs/issues/3942 - https://github.com/tsiamoulis/vuln-research/tree/main/CVE-2025-55904
CVE ID: CVE-2025-55910 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T16:00:09.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Y4y17/CVE/blob/main/CMSEasy/Arbitrary%20file%20deletion%20vulnerability.md
CVE ID: CVE-2025-55911 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-18T20:39:20.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@mukund.s1337/cve-2025-55911-clipbucket-5-5-2-build-90-ssrf-via-upload-actions-file-downloader-php-eb49dc02bd6f
CVE ID: CVE-2025-55912 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-18T20:40:45.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MacWarrior/clipbucket-v5/blob/5.5.0/upload/actions/photo_uploader.php - https://github.com/MacWarrior/clipbucket-v5/tree/5.5.0 - https://github.com/MacWarrior/clipbucket-v5/releases?page=2 - https
s://github.com/MacWarrior/clipbucket-v5/tree/5.5.0 - https://github.com/MacWarrior/clipbucket-v5/releases?page=2 - https://medium.com/@mukund.s1337/cve-2025-55912-clipbucket-5-5-0-unauthenticated-arbitrary-file-upload-rce-720c0c0fbc58
CVE ID: CVE-2025-55944 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T20:00:43.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. The issue affects both authenticated and unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/G3XAR/Vulnerability-Research/tree/main/Slink%20%28up%20to%201.6.3%29/PoC - https://github.com/G3XAR/Vulnerability-Research/tree/main/CVE-2025-55944
CVE ID: CVE-2025-55971 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T19:11:06.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other
lled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=FeNLGR_xFIA - https://github.com/Szym0n13k/CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport
CVE ID: CVE-2025-55972 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T19:00:51.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) condition. By sending a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, an attacker can cause the device to become unresponsive. This denial persists as long as the attack continues and affects all forms of TV operation. Manual user control and even reboots do not restore functionality unless the flood stops. Additional Analyst Notes: - C
Manual user control and even reboots do not restore functionality unless the flood stops. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=CRik5mp4SW4 - https://github.com/Szym0n13k/CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport
CVE ID: CVE-2025-55976 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T19:04:19.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intelbras.com/pt-br/produto/roteador-wireless-n-300mbps-iwr-3000n - https://medium.com/@windsormoreira/intelbras-iwr-3000n-unauthenticated-wi-fi-password-disclosure-cve-2025-55976-7cdac7770413
CVE ID: CVE-2025-55996 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-12T15:48:01.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thawkhant/viber-desktop-html-injection
CVE ID: CVE-2025-55998 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-29T17:22:16.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into several filter parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mezereon.com/shopify/#intro - https://github.com/Ocmenog/CVE-2025-55998
CVE ID: CVE-2025-56007 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T16:30:30.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keenetic.com/ - https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
CVE ID: CVE-2025-56008 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T16:31:35.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near to the router to takeover the device via adding additional users with full permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keenetic.com/ - https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
CVE ID: CVE-2025-56009 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T16:32:41.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://keenetic.com/ - https://keenetic.com/global/security#october-2025-web-api-vulnerabilities
CVE ID: CVE-2025-56018 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:48:16.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Category Management via the category name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@sourabhthakur2109/stored-cross-site-scripting-xss-in-sourcecodester-web-based-pharmacy-product-management-system-1e85d144079b
CVE ID: CVE-2025-56019 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T19:38:25.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to connect via Bluetooth Low Energy (BLE) without authentication. Once an unauthorized connection is established, legitimate applications are unable to connect, causing a denial of service. The attack requires proximity to the device, making it exploitable from an adjacent network location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yashodhanvivek/
nt network location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yashodhanvivek/Agatsa-EasyTouch-Plus---CVE-2025-56019/blob/main/input.md
CVE ID: CVE-2025-56074 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T17:27:07.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baixiaobi/Park/blob/main/foreigner-bwdates-reports-details.php%20SQL%20Injection.md
CVE ID: CVE-2025-56075 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T14:57:46.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baixiaobi/Park/blob/main/normal-bwdates-reports-details.php%20SQL%20%20Injection.md
CVE ID: CVE-2025-56132 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T20:16:22.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The application returns distinguishable responses for valid and invalid email addresses, allowing unauthenticated attackers to determine the existence of user accounts. Version 4.2 introduces user-based lockout mechanisms to mitigate brute-force attacks, user enumeration remains possible by default. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced