Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3965 State: PUBLISHED Published: 2025-04-27T09:31:04.354Z Last Updated: 2025-04-28T15:31:38.936Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: itwanger Products: paicoding Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /article/app/post. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306301 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306301 - https://vuldb.com/?ctiid.306301 - https://vuldb.com/?submit.557249 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md - https://github.com/uglory-gll/javasec/blob/main/paicoding.md#1stored-cross-site-scripting
CVE ID: CVE-2025-3966 State: PUBLISHED Published: 2025-04-27T10:00:05.213Z Last Updated: 2025-04-28T14:54:41.230Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: itwanger Products: paicoding Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /user/home?userId=1&homeSelectType=read of the component Browsing History Handler. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306302 - https://vuldb.com/?ctiid.306302 - https://vuldb.com/?submit.557250 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md - https://github.com/uglory-gll/javasec/blob/main/paicoding.md#21userhomeuserid1homeselecttyperead-view-browsing-history-of-others
CVE ID: CVE-2025-3967 State: PUBLISHED Published: 2025-04-27T10:31:04.478Z Last Updated: 2025-04-28T14:53:31.357Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: itwanger Products: paicoding Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in itwanger paicoding 1.0.3. It has been classified as critical. This affects an unknown part of the file /article/api/post of the component Article Handler. The manipulation of the argument articleId leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306303 - https://vuldb.com/?ctiid.306303 - https://vuldb.com/?submit.557251 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md - https://github.com/uglory-gll/javasec/blob/main/paicoding.md#22articleapipost-horizontal-overstepping-of-authority
CVE ID: CVE-2025-3968 State: PUBLISHED Published: 2025-04-27T11:00:06.734Z Last Updated: 2025-04-28T14:52:40.886Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: codeprojects Products: News Publishing Site Dashboard Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /api.php. The manipulation of the argument cat_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306304 - https://vuldb.com/?ctiid.306304 - https://vuldb.com/?submit.557286 - https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A11.md
CVE ID: CVE-2025-3969 State: PUBLISHED Published: 2025-04-27T12:00:05.956Z Last Updated: 2025-04-28T22:00:29.031Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: codeprojects Products: News Publishing Site Dashboard Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been rated as critical. This issue affects some unknown processing of the file /edit-category.php of the component Edit Category Page. The manipulation of the argument category_image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: -
ck may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306305 - https://vuldb.com/?ctiid.306305 - https://vuldb.com/?submit.557287 - https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A12.md
CVE ID: CVE-2025-3970 State: PUBLISHED Published: 2025-04-27T12:31:04.411Z Last Updated: 2025-04-28T22:01:06.867Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: baseweb Products: JSite Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in baseweb JSite up to 1.0. Affected is an unknown function of the file /sys/office/save. The manipulation of the argument Remarks leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306306 - https://vuldb.com/?ctiid.306306 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306306 - https://vuldb.com/?ctiid.306306 - https://vuldb.com/?submit.557385 - https://github.com/caigo8/CVE-md/blob/main/JSite/XSS2.md
CVE ID: CVE-2025-3971 State: PUBLISHED Published: 2025-04-27T13:31:05.118Z Last Updated: 2025-04-28T22:01:26.900Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306307 - https://vuldb.com/?ctiid.306307 - https://vuldb.com/?submit.557391 - https://github.com/skyrainoh/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-3972 State: PUBLISHED Published: 2025-04-27T14:00:06.162Z Last Updated: 2025-04-28T22:01:43.565Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /bwdates-report-result.php. The manipulation of the argument todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Addition
tely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306308 - https://vuldb.com/?ctiid.306308 - https://vuldb.com/?submit.557392 - https://github.com/skyrainoh/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-3973 State: PUBLISHED Published: 2025-04-27T14:31:05.460Z Last Updated: 2025-04-28T14:22:13.244Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul COVID19 Testing Management System 1.0. This affects an unknown part of the file /check_availability.php. The manipulation of the argument mobnumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes:
has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306309 - https://vuldb.com/?ctiid.306309 - https://vuldb.com/?submit.557393 - https://github.com/skyrainoh/CVE/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-3974 State: PUBLISHED Published: 2025-04-27T15:00:08.188Z Last Updated: 2025-04-28T14:19:51.735Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit-phlebotomist.php?pid=11. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst
xploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306310 - https://vuldb.com/?ctiid.306310 - https://vuldb.com/?submit.557394 - https://github.com/skyrainoh/CVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-3975 State: PUBLISHED Published: 2025-04-27T15:31:05.052Z Last Updated: 2025-04-28T14:14:01.462Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ScriptAndTools Products: eCommerce-website-in-PHP Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file /admin/subscriber-csv.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306311 - https://vuldb.com/?ctiid.306311 - https://vuldb.com/?submit.557414 - https://www.websecurityinsights.my.id/2025/04/script-and-tools-ecommerce-30_53.html
CVE ID: CVE-2025-3976 State: PUBLISHED Published: 2025-04-27T16:00:08.548Z Last Updated: 2025-04-28T14:03:52.060Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /new-user-testing.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Note
it has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306312 - https://vuldb.com/?ctiid.306312 - https://vuldb.com/?submit.557472 - https://github.com/skyrainoh/CVE/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-3977 State: PUBLISHED Published: 2025-04-27T16:31:08.927Z Last Updated: 2025-04-28T13:48:20.226Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: iteachyou Products: Dreamer CMS Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in iteachyou Dreamer CMS up to 4.1.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/attachment/download of the component Attachment Handler. The manipulation of the argument ID leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacte
e attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306313 - https://vuldb.com/?ctiid.306313 - https://vuldb.com/?submit.557639 - https://gitee.com/iteachyou/dreamer_cms/issues/IC13O1
CVE ID: CVE-2025-3978 State: PUBLISHED Published: 2025-04-27T17:00:06.990Z Last Updated: 2025-04-28T13:47:10.343Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: dazhouda Products: lecms Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in dazhouda lecms 3.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/view/default/user_set.htm. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306314 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306314 - https://vuldb.com/?ctiid.306314 - https://vuldb.com/?submit.557748 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_2.md
CVE ID: CVE-2025-3979 State: PUBLISHED Published: 2025-04-27T17:31:04.107Z Last Updated: 2025-04-28T13:46:11.755Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: dazhouda Products: lecms Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-password-ajax-1 of the component Password Change Handler. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306315 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306315 - https://vuldb.com/?ctiid.306315 - https://vuldb.com/?submit.557787 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_3.md
CVE ID: CVE-2025-3980 State: PUBLISHED Published: 2025-04-27T18:00:05.551Z Last Updated: 2025-04-28T13:45:17.013Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wowjoy 浙江湖州华卓信息科技有限公司 Products: Internet Doctor Workstation System Problem Types: CWE-285, CWE-266 Description: A vulnerability classified as problematic was found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This vulnerability affects unknown code of the file /v1/prescription/list. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosu
motely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306316 - https://vuldb.com/?ctiid.306316 - https://vuldb.com/?submit.557930 - https://github.com/38279/3/issues/1
CVE ID: CVE-2025-3981 State: PUBLISHED Published: 2025-04-27T18:31:03.796Z Last Updated: 2025-04-28T13:44:41.175Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wowjoy 浙江湖州华卓信息科技有限公司 Products: Internet Doctor Workstation System Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some unknown processing of the file /v1/prescription/details/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted e
tack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306317 - https://vuldb.com/?ctiid.306317 - https://github.com/38279/3/issues/1
CVE ID: CVE-2025-3982 State: PUBLISHED Published: 2025-04-27T19:00:05.577Z Last Updated: 2025-04-28T18:09:29.666Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: nortikin Products: Sverchok Problem Types: CWE-1321, CWE-94 Description: A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The exploit has been disclosed to th
e attributes ('prototype pollution'). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306318 - https://vuldb.com/?ctiid.306318 - https://vuldb.com/?submit.557411 - https://gist.github.com/superboy-zjc/a31b8ea7466f91b437598297bf5cbce8
CVE ID: CVE-2025-3983 State: PUBLISHED Published: 2025-04-27T19:31:03.781Z Last Updated: 2025-05-02T04:37:09.714Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: AMTT Products: Hotel Broadband Operation System Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manager/system/nlog_down.php. The manipulation of the argument ProtocolType leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor
y. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306319 - https://vuldb.com/?ctiid.306319 - https://vuldb.com/?submit.556223 - https://github.com/MichaelZhuang521/cve/blob/main/rce.md
CVE ID: CVE-2025-3984 State: PUBLISHED Published: 2025-04-27T20:00:08.108Z Last Updated: 2025-04-28T18:09:12.760Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Apereo Products: CAS Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleFormController.java of the component Groovy Code Handler. The manipulation leads to code injection. The attack may be launched remotely. The complexity of an attack is rather high. Th
anipulation leads to code injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306320 - https://vuldb.com/?ctiid.306320 - https://vuldb.com/?submit.557100 - https://wx.mail.qq.com/s?k=ilW4ixcMaVgGU49Dij
CVE ID: CVE-2025-3985 State: PUBLISHED Published: 2025-04-27T20:31:06.556Z Last Updated: 2025-04-28T18:09:01.110Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:N/A:P) Vendors: Apereo Products: CAS Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The manipulation of the argument Query leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclose
inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306321 - https://vuldb.com/?ctiid.306321 - https://vuldb.com/?submit.557110 - https://wx.mail.qq.com/s?k=lzDuxVkSRXUZ0bwZEG
CVE ID: CVE-2025-3986 State: PUBLISHED Published: 2025-04-27T21:00:07.694Z Last Updated: 2025-04-28T17:38:45.562Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Apereo Products: CAS Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has be
gument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306322 - https://vuldb.com/?ctiid.306322 - https://vuldb.com/?submit.557473 - https://wx.mail.qq.com/s?k=rk-m8GwRMVMcOjBY1a
CVE ID: CVE-2025-3987 State: PUBLISHED Published: 2025-04-27T21:31:06.521Z Last Updated: 2025-04-28T17:28:10.520Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: N150RT Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306323 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306323 - https://vuldb.com/?ctiid.306323 - https://vuldb.com/?submit.557938 - https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc - https://www.totolink.net/