Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ta/RHSA-2025:16524 - https://access.redhat.com/errata/RHSA-2025:17181 - https://access.redhat.com/errata/RHSA-2025:18219 - https://access.redhat.com/errata/RHSA-2025:21885 - https://access.redhat.com/security/cve/CVE-2025-8941 - https://bugzilla.redhat.com/show_bug.cgi?id=2388220
CVE ID: CVE-2025-8942 State: PUBLISHED Published: 2025-09-18T06:00:05.997Z Last Updated: 2025-09-22T17:27:30.847Z Vendors: Unknown Products: WP Hotel Booking Problem Types: CWE-284 Improper Access Control Description: The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d89bb3b2-40ad-4c4f-9f17-4ccacc0f6e1a/
CVE ID: CVE-2025-8943 State: PUBLISHED Published: 2025-08-14T09:54:22.531Z Last Updated: 2025-08-18T16:47:58.906Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Description: The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands. Additional Analyst No
red. This combination allows unauthenticated network attackers to execute unsandboxed OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578/
CVE ID: CVE-2025-8944 State: PUBLISHED Published: 2025-09-05T06:00:02.190Z Last Updated: 2025-09-05T16:09:21.888Z Vendors: Unknown Products: OceanWP Problem Types: CWE-863 Incorrect Authorization Description: The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cf77b7f2-525b-4fe8-b612-185a1c18c197/
CVE ID: CVE-2025-8946 State: PUBLISHED Published: 2025-08-14T06:02:05.468Z Last Updated: 2025-08-14T19:47:37.679Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Notes Sharing Platform Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Online Notes Sharing Platform 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument User leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319912 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319912 - https://vuldb.com/?ctiid.319912 - https://vuldb.com/?submit.631982 - https://github.com/guoma-book/CVE/issues/1
CVE ID: CVE-2025-8947 State: PUBLISHED Published: 2025-08-14T06:32:05.758Z Last Updated: 2025-08-14T19:44:59.498Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319913 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319913 - https://vuldb.com/?ctiid.319913 - https://vuldb.com/?submit.631995 - https://vuldb.com/?submit.631996 - https://github.com/guoma-book/CVE/issues/3 - https://github.com/guoma-book/CVE/issues/4
CVE ID: CVE-2025-8948 State: PUBLISHED Published: 2025-08-14T07:02:07.123Z Last Updated: 2025-08-14T19:42:28.460Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319914 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319914 - https://vuldb.com/?ctiid.319914 - https://vuldb.com/?submit.632003 - https://github.com/guoma-book/CVE/issues/5
CVE ID: CVE-2025-8949 State: PUBLISHED Published: 2025-08-14T07:02:09.338Z Last Updated: 2025-08-14T19:40:07.439Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-825 Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The manipulation of the argument ping_ipaddr leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the main
sclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319915 - https://vuldb.com/?ctiid.319915 - https://vuldb.com/?submit.627640 - https://github.com/i-Corner/cve/issues/16 - https://www.dlink.com/
CVE ID: CVE-2025-8950 State: PUBLISHED Published: 2025-08-14T07:32:06.063Z Last Updated: 2025-08-14T19:25:16.606Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /Recruitment/index.php?page=view_vacancy. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319919 - https://vuldb.com/?ctiid.319919 - https://vuldb.com/?submit.627710 - https://github.com/Noc14/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-8951 State: PUBLISHED Published: 2025-08-14T08:02:07.059Z Last Updated: 2025-08-14T19:23:02.522Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Teachers Record Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319920 - https://vuldb.com/?ctiid.319920 - https://vuldb.com/?submit.627738 - https://github.com/zzx-yyds/mycve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-8952 State: PUBLISHED Published: 2025-08-14T08:32:08.881Z Last Updated: 2025-08-14T19:16:31.730Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Flight Booking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CIS
can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319921 - https://vuldb.com/?ctiid.319921 - https://vuldb.com/?submit.627814 - https://www.yuque.com/yuqueyonghuvrsrwv/dhlxlu/mlyefhpcsdan2df3?singleDoc - https://www.yuque.com/yuqueyonghuvrsrwv/dhlxlu/mlyefhpcsdan2df3#vulnerability-details-and-poc - https://www.campcodes.com/
CVE ID: CVE-2025-8953 State: PUBLISHED Published: 2025-08-14T09:02:07.276Z Last Updated: 2025-08-14T14:49:36.052Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: COVID 19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /check_availability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319922 - https://vuldb.com/?ctiid.319922 - https://vuldb.com/?submit.627830 - https://github.com/zzb1388/cve/issues/29 - https://www.sourcecodester.com/
CVE ID: CVE-2025-8954 State: PUBLISHED Published: 2025-08-14T09:02:10.057Z Last Updated: 2025-08-14T14:49:29.725Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319923 - https://vuldb.com/?ctiid.319923 - https://vuldb.com/?submit.627831 - https://github.com/LitBot123/mycve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-8955 State: PUBLISHED Published: 2025-08-14T09:32:06.607Z Last Updated: 2025-08-14T14:49:17.774Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The manipulation of the argument docfees leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319924 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319924 - https://vuldb.com/?ctiid.319924 - https://vuldb.com/?submit.627832 - https://github.com/LitBot123/mycve/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-8956 State: PUBLISHED Published: 2025-08-14T10:02:06.669Z Last Updated: 2025-08-14T14:48:53.941Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR‑818L Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319925 - https://vuldb.com/?ctiid.319925 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319925 - https://vuldb.com/?ctiid.319925 - https://vuldb.com/?submit.627835 - https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91818L.md - https://www.dlink.com/
CVE ID: CVE-2025-8957 State: PUBLISHED Published: 2025-08-14T10:32:09.728Z Last Updated: 2025-08-14T14:48:46.786Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Flight Booking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Affected is an unknown function of the file /flights.php. The manipulation of the argument departure_airport_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319926 - https://vuldb.com/?ctiid.319926 - https://vuldb.com/?submit.627840 - https://www.yuque.com/yuqueyonghuvrsrwv/dhlxlu/xsngklzdixvub9si?singleDoc - https://www.yuque.com/yuqueyonghuvrsrwv/dhlxlu/xsngklzdixvub9si#vulnerability-details-and-poc - https://www.campcodes.com/
CVE ID: CVE-2025-8958 State: PUBLISHED Published: 2025-08-14T11:02:09.421Z Last Updated: 2025-08-14T13:35:11.636Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: TX3 Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in Tenda TX3 16.03.13.11_multi_TDE01. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319927 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319927 - https://vuldb.com/?ctiid.319927 - https://vuldb.com/?submit.627861 - https://vuldb.com/?submit.628117 - https://github.com/alc9700jmo/CVE/issues/16 - https://www.tenda.com.cn/
CVE ID: CVE-2025-8959 State: PUBLISHED Published: 2025-08-15T20:32:52.335Z Last Updated: 2025-08-15T20:46:06.131Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HashiCorp Products: Shared library Problem Types: CWE-59 Description: HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76
https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242
CVE ID: CVE-2025-8960 State: PUBLISHED Published: 2025-08-14T11:32:10.043Z Last Updated: 2025-08-14T13:29:46.819Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Flight Booking Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/save_airlines.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319952 - https://vuldb.com/?ctiid.319952 - https://vuldb.com/?submit.627900 - https://www.yuque.com/yuqueyonghuvrsrwv/dhlxlu/ykgg3tumuaefd0ft?singleDoc - https://www.yuque.com/yuqueyonghuvrsrwv/dhlxlu/ykgg3tumuaefd0ft#vulnerability-details-and-poc - https://www.campcodes.com/
CVE ID: CVE-2025-8961 State: PUBLISHED Published: 2025-08-14T12:02:08.516Z Last Updated: 2025-08-23T15:11:07.640Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: LibTIFF Problem Types: CWE-119 Description: A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319955 - https://vuldb.com/?ctiid.319955 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319955 - https://vuldb.com/?ctiid.319955 - https://vuldb.com/?submit.627957 - https://gitlab.com/libtiff/libtiff/-/issues/721 - https://gitlab.com/libtiff/libtiff/-/issues/721#note_2670686960 - https://drive.google.com/file/d/15L4q2eD8GX3Aj3z6SWC3_FbqaM1ChUx2/view?usp=sharing - http://www.libtiff.org/
CVE ID: CVE-2025-8962 State: PUBLISHED Published: 2025-08-14T14:32:09.995Z Last Updated: 2025-08-14T14:43:03.978Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: code-projects Products: Hostel Management System Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in code-projects Hostel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file hostel_manage.exe of the component Login Form. The manipulation of the argument uname leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analy
cess is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319957 - https://vuldb.com/?ctiid.319957 - https://vuldb.com/?submit.628027 - https://www.yuque.com/gongzi-jsnek/xb2q3a/cd8qfnuv9aeb1l78?singleDoc - https://www.yuque.com/gongzi-jsnek/xb2q3a/cd8qfnuv9aeb1l78#de033679 - https://code-projects.org/
CVE ID: CVE-2025-8963 State: PUBLISHED Published: 2025-08-14T13:02:11.017Z Last Updated: 2025-08-14T19:57:00.472Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C) Vendors: jeecgboot Products: JimuReport Problem Types: CWE-502, CWE-20 Description: A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated". Additional Analyst Notes: - CISA ADP Vulnrichment: R
se to the GitHub issue report is: "Modified, next version updated". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319958 - https://vuldb.com/?ctiid.319958 - https://vuldb.com/?submit.628028 - https://github.com/jeecgboot/jimureport/issues/4010 - https://github.com/jeecgboot/jimureport/issues/4010#issuecomment-3182053855
CVE ID: CVE-2025-8964 State: PUBLISHED Published: 2025-08-14T15:02:10.449Z Last Updated: 2025-08-14T19:43:03.974Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: code-projects Products: Hostel Management System Problem Types: CWE-287 Description: A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login. The manipulation leads to improper authentication. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319959 - https://vuldb.com/?ctiid.319959 - https://vuldb.com/?submit.628030 - https://www.yuque.com/gongzi-jsnek/xb2q3a/ip83oyxdztulfuzx?singleDoc - https://www.yuque.com/gongzi-jsnek/xb2q3a/ip83oyxdztulfuzx#vulnerability-details-and-poc - https://code-projects.org/
CVE ID: CVE-2025-8965 State: PUBLISHED Published: 2025-08-14T15:32:06.048Z Last Updated: 2025-08-14T17:38:41.755Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C) Vendors: linlinjava Products: litemall Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analys
d. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319960 - https://vuldb.com/?ctiid.319960 - https://vuldb.com/?submit.628098 - https://github.com/linlinjava/litemall/issues/565 - https://github.com/linlinjava/litemall/issues/565#issue-3267850415
CVE ID: CVE-2025-8966 State: PUBLISHED Published: 2025-08-14T15:32:08.404Z Last Updated: 2025-08-14T17:49:53.051Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Tour and Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/tax.php. The manipulation of the argument tname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319961 - https://vuldb.com/?ctiid.319961 - https://vuldb.com/?submit.628162 - https://github.com/zzb1388/cve/issues/37 - https://itsourcecode.com/