Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae076e4-ad15-4069-be10-f0f4aced4132?source=cve - https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.3.6/content_elements/bt_bb_content_slider/bt_bb_content_slider.php#L7 - https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.3.6/content_elements/bt_bb_content_slider/bt_bb_content_slider.php#L156 - https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.3.6/content_elements/bt_bb_content_slider/bt_bb_content_slid
plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.3.6/content_elements/bt_bb_content_slider/bt_bb_content_slider.php#L176 - https://wordpress.org/plugins/bold-page-builder/#developers - https://plugins.trac.wordpress.org/changeset/3302452 - https://plugins.trac.wordpress.org/browser/bold-page-builder/tags/5.3.7/content_elements/bt_bb_content_slider/bt_bb_content_slider.php#L156
CVE ID: CVE-2025-5287 State: PUBLISHED Published: 2025-05-28T08:22:17.666Z Last Updated: 2025-05-28T13:41:08.356Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: erumfaham Products: Likes and Dislikes Plugin Problem Types: CWE-89 Description: The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitiv
henticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ad19205d-d355-45d8-be5b-f8005459a8c7?source=cve - https://plugins.trac.wordpress.org/browser/inprosysmedia-likes-dislikes-post/trunk/inprosysmedia-likes-dislikes-post.php#L76
CVE ID: CVE-2025-5288 State: PUBLISHED Published: 2025-06-13T01:47:46.475Z Last Updated: 2025-06-13T15:43:36.251Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: weboccults Products: REST API | Custom API Generator For Cross Platform And Import Export In WP Problem Types: CWE-862 Description: The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby cre
ssible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2774fc-f028-436c-a8af-3c17378b9743?source=cve - https://plugins.trac.wordpress.org/browser/import-export-with-custom-rest-api/tags/2.0.3/backend/methods/wot-rapi-import-functions.php#L123 - https://wordpress.org/plugins/import-export-with-custom-rest-api/#developers
CVE ID: CVE-2025-5289 State: PUBLISHED Published: 2025-06-21T11:09:40.461Z Last Updated: 2025-06-23T15:03:51.152Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: iberezansky Products: 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery Problem Types: CWE-79 Description: The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abo
itization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72b76475-5215-47fd-badf-e2c542b25d4b?source=cve - https://plugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L134 - https://plugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L130 - https://w
ugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L130 - https://wordpress.org/plugins/interactive-3d-flipbook-powered-physics-engine/#developers - https://plugins.trac.wordpress.org/changeset/3315198/
CVE ID: CVE-2025-5290 State: PUBLISHED Published: 2025-05-31T07:22:11.704Z Last Updated: 2025-06-02T15:49:03.204Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: visualmodo Products: Borderless – Elementor Addons and Templates Problem Types: CWE-79 Description: The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4492aede-b68d-46b8-955f-81ebdc875921?source=cve - https://plugins.trac.wordpress.org/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L72 - https://plugins.trac.wordpress.org/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L230 - https://plugins.trac.wordpress.org/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L288 - https://plugins.trac.wordpress.org/browser/
g/browser/borderless/trunk/assets/scripts/borderless-elementor.min.js#L288 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/circular-progress-bar.php#L433 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/progress-bar.php#L417 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/semi-circular-progress-bar.php#L410 - https://plugins.trac.wordpress.org/changeset/3302155/
CVE ID: CVE-2025-5291 State: PUBLISHED Published: 2025-06-17T11:23:37.205Z Last Updated: 2025-06-17T13:59:29.382Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Master Slider – Responsive Touch Slider Problem Types: CWE-79 Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary
ibutes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce37fbd2-8d41-4feb-adf6-7ca0ca54e27a?source=cve - https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L28 - https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L633 - https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L763 - https://plugi
- https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L763 - https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L783 - https://wordpress.org/plugins/master-slider/#description - https://plugins.trac.wordpress.org/changeset/3309620/
CVE ID: CVE-2025-5292 State: PUBLISHED Published: 2025-05-31T06:40:57.037Z Last Updated: 2025-06-02T15:49:25.933Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder Problem Types: CWE-79 Description: The Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping.
ent’ parameter in all versions up to, and including, 5.11.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab8dfdd8-820c-4066-8014-2cb5b9f935a4?source=cve - https://plugins.trac.wordpress.org/changeset/3302152/
CVE ID: CVE-2025-5295 State: PUBLISHED Published: 2025-05-28T11:00:05.439Z Last Updated: 2025-05-28T13:23:04.843Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0. This vulnerability affects unknown code of the component PORT Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310420 - https://vuldb.com/?ctiid.310420 - https://vuldb.com
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310420 - https://vuldb.com/?ctiid.310420 - https://vuldb.com/?submit.582988 - https://fitoxs.com/exploit/exploit-4f6236b59b5119d64718e994b0f3d63a755e7cb5a496e3846b92dfb960f1a80a.txt
CVE ID: CVE-2025-5296 State: PUBLISHED Published: 2025-08-18T07:22:05.013Z Last Updated: 2025-08-18T12:22:22.123Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Schneider Electric Products: SESU Problem Types: CWE-59 Description: CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruption, exposure of application and system information or persistent denial of service when a low-privileged attacker tampers with the installation folder. Additional Analyst Notes: - CISA ADP Vulnrichment: R
hen a low-privileged attacker tampers with the installation folder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-03.pdf
CVE ID: CVE-2025-5297 State: PUBLISHED Published: 2025-05-28T11:31:05.140Z Last Updated: 2025-05-28T13:17:00.259Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Computer Store System Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Computer Store System 1.0. This issue affects the function Add of the file main.c. The manipulation of the argument laptopcompany/RAM/Processor leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric
ched locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310421 - https://vuldb.com/?ctiid.310421 - https://vuldb.com/?submit.585114 - https://github.com/byxs0x0/cve/issues/6 - https://www.sourcecodester.com/
CVE ID: CVE-2025-5298 State: PUBLISHED Published: 2025-05-28T11:31:07.494Z Last Updated: 2025-05-28T13:15:00.911Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310422 - https://vuldb.com/?ctiid.310422 - https://vuldb.com/?submit.585161 - https://github.com/RS7325/cve/issues/2 - https://www.campcodes.com/
CVE ID: CVE-2025-5299 State: PUBLISHED Published: 2025-05-28T12:00:08.743Z Last Updated: 2025-05-28T13:00:57.583Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Client Database Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /user_order_customer_update.php. The manipulation of the argument uploaded_file_cancelled leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
an be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310426 - https://vuldb.com/?ctiid.310426 - https://vuldb.com/?submit.585732 - https://github.com/RS7325/cve/issues/3 - https://www.sourcecodester.com/
CVE ID: CVE-2025-5301 State: PUBLISHED Published: 2025-06-12T07:59:05.650Z Last Updated: 2025-06-18T04:08:26.144Z Vendors: OnlyOffice Products: Docs (DocumentServer) Problem Types: CWE-79 Description: ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/onlyoffice - https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#8
rences: - https://r.sec-consult.com/onlyoffice - https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#832
CVE ID: CVE-2025-5302 State: PUBLISHED Published: 2025-08-25T15:03:18.097Z Last Updated: 2025-08-25T15:41:08.676Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-674 Description: A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.1
s results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/70041b81-de9e-4046-8c0e-6ccd557048a6 - https://github.com/run-llama/llama_index/commit/c032843a02ce38fd8f284b2aa5a37fd1c17ae635
CVE ID: CVE-2025-5303 State: PUBLISHED Published: 2025-06-07T08:22:28.265Z Last Updated: 2025-06-09T15:08:29.196Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Day & Ross Edition, LTL Freight Quotes – Daylight Edition Problem Types: CWE-79 Description: The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the expiry_date parameter in all versions up to, and including, 1.0.11, 2.2.6 and 2.1.10 respectively, due to insufficient
e expiry_date parameter in all versions up to, and including, 1.0.11, 2.2.6 and 2.1.10 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05fc4b17-7922-45a4-aac8-a47b3f50ce69?source=cve - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-freightview-edition/tags/1.0.11/en-hit-to-update-plan.php#L29 - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-freightview-edition/tag
11/en-hit-to-update-plan.php#L29 - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-freightview-edition/tags/1.0.11/common/en-plans.php#L110 - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-daylight-edition/tags/2.2.6/en-hit-to-update-plan.php#L29 - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-day-ross-edition/trunk/en-hit-to-update-plan.php#L29
CVE ID: CVE-2025-5304 State: PUBLISHED Published: 2025-06-28T05:29:51.306Z Last Updated: 2025-06-30T18:32:41.019Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: blafoley Products: PT Project Notebooks – Take Meeting minutes, create budgets, track task management, and more Problem Types: CWE-862 Description: The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
ckers to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/552ec9fc-5bff-4bee-be04-39892c89cd59?source=cve - https://wordpress.org/plugins/project-notebooks/#developers - https://plugins.trac.wordpress.org/browser/project-notebooks/tags/1.1.3/includes/structure/admin/pto_admin_settings.php#L233 - https://plugins.trac.wordpress.org/browser/project-notebooks/tags/1.1.3/includes/structure/admin/pto_admin_settings.php#L36
CVE ID: CVE-2025-5305 State: PUBLISHED Published: 2025-09-18T06:00:04.273Z Last Updated: 2025-09-22T17:27:38.830Z Vendors: Unknown Products: Password Reset with Code for WordPress REST API Problem Types: CWE-326 Inadequate Encryption Strength Description: The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dcf5c003-91b0-4e7d-89f3-7459d8f01153/
CVE ID: CVE-2025-5306 State: PUBLISHED Published: 2025-06-27T07:48:15.936Z Last Updated: 2025-06-27T13:37:26.075Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-77 Description: Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. This issue affects Pandora FMS 774 through 778 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2025-5307 State: PUBLISHED Published: 2025-05-29T22:11:12.769Z Last Updated: 2025-05-30T12:51:50.096Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Santesoft Products: Sante DICOM Viewer Pro Problem Types: CWE-125 Description: Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue to potentially disclose information and to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-148-01 - https://www.santesoft.com/win/sante-dicom-viewer-p
s://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-148-01 - https://www.santesoft.com/win/sante-dicom-viewer-pro/download.html
CVE ID: CVE-2025-5309 State: PUBLISHED Published: 2025-06-16T16:06:14.413Z Last Updated: 2025-06-19T03:55:06.361Z Vendors: BeyondTrust Products: Remote support & Privileged Remote Access, Remote Support(RS) & Privileged Remote Access(PRA) Problem Types: CWE-94 Description: The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.beyondtrust.com/trust-center/security-advisories/bt25-04
CVE ID: CVE-2025-5310 State: PUBLISHED Published: 2025-06-27T17:22:02.680Z Last Updated: 2025-06-27T17:41:45.800Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dover Fueling Solutions Products: ProGauge MagLink LX 4, ProGauge MagLink LX Plus, ProGauge MagLink LX Ultimate Problem Types: CWE-306 Description: Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics
te code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05 - https://ociocisa.sharepoint.com/teams/JCDC-ProductionOffice/Shared%20Documents/Forms/AllItems.aspx?OR=Teams%2DHL&CT=1736953471669&id=%2Fteams%2FJCDC%2DProductionOffice%2FShared%20Documents%2FPublications%2FICS%20Publishing%2F2025%20ICSAs%2FJUN%2017%2FVU%23285756%20%2D%20Dover%20Fueling%20Solutions%20ProGauge%20MAGLINK%20%2D%20Notice%20%28Draft%29%2Ehtml&viewid=243fd1ea%2Da122%2D4cc0%2Dbe91%2Dd0714ca46b87&parent=%2Fteams%2FJCDC%2DProductionOffice%2FShared%20Documents%2FPublications%2FICS%20Publishing%2F2025%20ICSAs%2FJUN%2017