Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-43983 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T12:58:59.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/tree/main/KuWfi - https://drive.proton.me/urls/CN629YJ3F4#N
Vulnrichment: References: - https://github.com/actuator/cve/tree/main/KuWfi - https://drive.proton.me/urls/CN629YJ3F4#NUgX6IB4clos - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43983.txt
CVE ID: CVE-2025-43984 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T12:59:07.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unauthenticated /goform/goform_set_cmd_process requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary OS commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kuwfi.com/products/300mbps-industrial-router-cat4-4g-cpe-router-extender-strong-wifi-signal-suport-32wifi-use
ttps://www.kuwfi.com/products/300mbps-industrial-router-cat4-4g-cpe-router-extender-strong-wifi-signal-suport-32wifi-users-with-sim-card-slot-95 - https://github.com/actuator/cve/tree/main/kuwfi - https://drive.proton.me/urls/1NRPNBE678#lFyUYIRIBZO5 - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43984.txt
CVE ID: CVE-2025-43986 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-14T14:07:42.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kuwfi.com/products/300mbps-industrial-router-cat4-4g-cpe-router-extender-strong-wifi-signal-suport-32wifi-users-with-sim-card-slot-95 - https://github.com/actuator/cve/tree/main/kuwfi - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43986.txt
CVE ID: CVE-2025-43988 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-14T14:11:41.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/tree/main/Kuwfi - https://kuwfi.com/products/nsa-sa-25gbps-kuwfi-6000mah-wifi-router-5g-dual-band-128users-portable-5g-wifi-router-with-sim-card-slot - https://drive.proton.me/urls/9EB08033PW#2b7dTc2x705W - https://github.com/actuator/cve/
wifi-router-with-sim-card-slot - https://drive.proton.me/urls/9EB08033PW#2b7dTc2x705W - https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43988.txt
CVE ID: CVE-2025-43989 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-13T20:30:40.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/cve/tree/main/Tuoshi - https://drive.proton.me/urls/H7J1DPNA00
P Vulnrichment: References: - https://github.com/actuator/cve/tree/main/Tuoshi - https://drive.proton.me/urls/H7J1DPNA00#XrmRLENzyZAp - https://drive.proton.me/urls/QDVK6E2SBR#8LlpbHWzHdmr - https://github.com/actuator/cve/blob/main/Tuoshi/CVE-2025-43989.txt
CVE ID: CVE-2025-43990 State: PUBLISHED Published: 2025-11-05T17:01:23.986Z Last Updated: 2025-11-06T04:55:47.809Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Command Monitor (DCM) Problem Types: CWE-250 Description: Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000384947/dsa-2025-414
CVE ID: CVE-2025-43991 State: PUBLISHED Published: 2025-10-13T14:30:55.576Z Last Updated: 2025-10-14T14:34:23.324Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: SupportAssist for Home PCs, SupportAssist for Business PCs Problem Types: CWE-61 Description: SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system could potentially exploit this vulnerability to delete arbitrary files only in that affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
bility to delete arbitrary files only in that affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000378367/dsa-2025-362-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE ID: CVE-2025-43993 State: PUBLISHED Published: 2025-09-25T19:38:00.845Z Last Updated: 2025-09-26T17:39:48.405Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Wireless 5932e Problem Types: CWE-428 Description: Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000372605/dsa-2025-363
CVE ID: CVE-2025-43994 State: PUBLISHED Published: 2025-10-24T14:14:41.021Z Last Updated: 2025-10-24T14:44:14.598Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Dell Products: Dell Storage Manager Problem Types: CWE-306 Description: Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-
hment: References: - https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities
CVE ID: CVE-2025-43995 State: PUBLISHED Published: 2025-10-24T14:09:55.238Z Last Updated: 2025-10-25T03:56:07.748Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Storage Manager Problem Types: CWE-287 Description: Dell Storage Center - Dell Storage Manager, version(s) 20.1.21, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector. An unauthenticated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and U
ated remote attacker can access APIs exposed by ApiProxy.war in DataCollectorEar.ear by using a special SessionKey and UserId. These userid are special users created in compellentservicesapi for special purposes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000382899/dsa-2025-393-security-update-for-storage-center-dell-storage-manager-vulnerabilities
CVE ID: CVE-2025-44001 State: PUBLISHED Published: 2025-08-11T18:56:57.280Z Last Updated: 2025-08-11T19:34:12.187Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-44002 State: PUBLISHED Published: 2025-08-26T11:05:22.270Z Last Updated: 2025-08-26T14:39:04.138Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: TeamViewer Products: Full Client, Host Problem Types: CWE-367 Description: Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-ce
ation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1003/
CVE ID: CVE-2025-44003 State: PUBLISHED Published: 2025-07-10T03:09:43.640Z Last Updated: 2025-07-10T13:11:13.511Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Gallagher Products: T-Series Readers Problem Types: CWE-772 Description: Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled. This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distr
in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in vEL9.00.3371 (MR7)), all versions of 8.90 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-44003
CVE ID: CVE-2025-44004 State: PUBLISHED Published: 2025-08-11T18:56:58.269Z Last Updated: 2025-08-11T19:34:49.595Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-306 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-44006 State: PUBLISHED Published: 2025-10-03T18:08:57.826Z Last Updated: 2025-10-03T18:39:44.328Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/secur
CVE ID: CVE-2025-44007 State: PUBLISHED Published: 2025-10-03T18:09:05.407Z Last Updated: 2025-10-03T18:40:35.142Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/secur
CVE ID: CVE-2025-44008 State: PUBLISHED Published: 2025-10-03T18:09:12.168Z Last Updated: 2025-10-03T18:41:25.382Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-44009 State: PUBLISHED Published: 2025-10-03T18:09:19.789Z Last Updated: 2025-10-03T18:42:16.739Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-44010 State: PUBLISHED Published: 2025-10-03T18:09:26.964Z Last Updated: 2025-10-03T18:43:01.411Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-44011 State: PUBLISHED Published: 2025-10-03T18:09:38.293Z Last Updated: 2025-10-03T18:49:35.826Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-44012 State: PUBLISHED Published: 2025-10-03T18:09:44.519Z Last Updated: 2025-10-03T18:50:13.990Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-770 Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/secur
( 2025/07/31 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-35
CVE ID: CVE-2025-44014 State: PUBLISHED Published: 2025-10-03T18:09:51.496Z Last Updated: 2025-10-03T18:51:29.451Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-787 Description: An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.1 ( 2025/07/09 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-34
CVE ID: CVE-2025-44015 State: PUBLISHED Published: 2025-08-29T17:17:15.478Z Last Updated: 2025-08-29T18:21:41.548Z Vendors: QNAP Systems Inc. Products: HybridDesk Station Problem Types: CWE-77, CWE-78 Description: A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.18 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-20
CVE ID: CVE-2025-44017 State: PUBLISHED Published: 2025-09-02T07:41:47.056Z Last Updated: 2025-09-02T13:49:26.120Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Gunosy Inc. Products: "Gunosy" App for Android, "Gunosy" App for iOS Problem Types: CWE-201 Description: "Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT (JSON Web Token). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/jp/JVN47404248/
CVE ID: CVE-2025-44018 State: PUBLISHED Published: 2025-11-24T15:11:02.641Z Last Updated: 2025-11-24T17:03:28.621Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: GL-Inet Products: GL-AXT1800 Problem Types: CWE-295 Description: A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2230
CVE ID: CVE-2025-44019 State: PUBLISHED Published: 2025-06-12T19:51:56.663Z Last Updated: 2025-06-12T20:06:50.361Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: AVEVA Products: PI Data Archive, PI Server Problem Types: CWE-248 Description: AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service. Depending on the timing of the crash, data present in snapshots/write cache may be lost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-2
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07 - https://www.aveva.com/en/support-and-success/cyber-security-updates/ - https://my.osisoft.com/
CVE ID: CVE-2025-44021 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T21:02:53.418Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: OpenStack Products: Ironic Problem Types: CWE-22 Description: OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still r
icult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.launchpad.net/ironic/+bug/2107847 - https://security.openstack.org/ossa/OSSA-2025-001.html
CVE ID: CVE-2025-44022 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:07.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/givanz/Vvveb/issues/289 - https://github.com/givanz/Vvveb/commit/dd74abcae88f658779f61338b9f4c123884eef0d - https://github.com/chimmeee/vulnerability-research/blob/main/CVE-2025-44022
CVE ID: CVE-2025-44023 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:24:22.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_admin_pw components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/nirvana-chkbf/kb/cakchpet9vxgqm0h?singleDoc
CVE ID: CVE-2025-44024 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T13:53:29.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zyx0814/Pichome/issues/50
CVE ID: CVE-2025-44033 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-08-29T17:39:36.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/qkdjksfkeg/Security-Collections/blob/main/sqlinjection.md
CVE ID: CVE-2025-44034 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T19:23:53.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/qkdjksfkeg/Security-Collections/blob/main/sqlinjection2.md