Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-44954 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T17:43:44.355Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: RUCKUS Products: SmartZone Problem Types: CWE-1394 Description: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44954
CVE ID: CVE-2025-44955 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:12.954Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: RUCKUS Products: Network Director Problem Types: CWE-259 Description: RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://claroty.com/team82/disclosure-dashboard/cve-2025-44955 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE ID: CVE-2025-44957 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:14.322Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: RUCKUS Products: SmartZone Problem Types: CWE-288 Description: Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44957
CVE ID: CVE-2025-44958 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:15.677Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: RUCKUS Products: Network Director Problem Types: CWE-257 Description: RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44958
CVE ID: CVE-2025-44960 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:17.043Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: RUCKUS Products: SmartZone Problem Types: CWE-78 Description: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44960
CVE ID: CVE-2025-44961 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:18.408Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: RUCKUS Products: SmartZone Problem Types: CWE-78 Description: In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashbo
ets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44961
CVE ID: CVE-2025-44962 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:19.843Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: RUCKUS Products: SmartZone Problem Types: CWE-24 Description: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44962
CVE ID: CVE-2025-44963 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-11-03T20:04:21.203Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: RUCKUS Products: Network Director Problem Types: CWE-321 Description: RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/613753 - https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/discl
download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e - https://claroty.com/team82/disclosure-dashboard/cve-2025-44963
CVE ID: CVE-2025-44964 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T15:28:23.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bluestacks.com - https://claroty.com/team82/disclosure-dashboard/cve-2025-44964
CVE ID: CVE-2025-44998 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T18:56:35.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecting a crafted payload into the js-theme-3 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/prasathmani/tinyfilemanager - https://github.com/l8BL/CVE-2025-44998
CVE ID: CVE-2025-45001 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-09T19:47:56.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/ch3tanbug/44aedff79dd5d2d6beadbffcd01e0de5 - https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2025-45001
CVE ID: CVE-2025-45002 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-09T19:48:01.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2025-45002
CVE ID: CVE-2025-45006 State: PUBLISHED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-02T13:58:38.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling potential physical memory access attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chipsalliance/rocket-chip.git - https://lf-riscv.atlassian.net/wiki/spaces/HOME/pages/16154769/RISC-V+Technical+Specifications#ISA-Specifications - https://github.com/heyfenny/Vulnerability_disclosure/blob/main/RISCV/Rocket-chip/CVE-2025-45006/details.md
CVE ID: CVE-2025-45007 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-04-30T14:34:27.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. This vulnerability allows remote attackers to execute arbitrary JavaScript code via the adminname POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Time-Table-Generator-System/xss-injection.md
CVE ID: CVE-2025-45009 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-04-30T15:40:26.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the searchdata parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/normal-search-html-injection.md
CVE ID: CVE-2025-45010 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-04-30T15:41:18.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the fromdate and todate POST request parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/normal-bwdates-reports-details-html-injection.md
CVE ID: CVE-2025-45011 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-04-30T15:38:55.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the searchdata POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/foreigner-search-html-injection.md
CVE ID: CVE-2025-45015 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-06T15:27:36.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. The vulnerability allows remote attackers to inject arbitrary JavaScript code via the fromdate and todate parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/XSS/foreigner-bwdates-reports-details-XSS-injection.md
CVE ID: CVE-2025-45017 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-06T15:25:59.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the tprice POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQL_injection_in_edit_ticket.md
CVE ID: CVE-2025-45018 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-06T15:24:47.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the todate parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQl_Injection_in_was_foreigner-bwdates-reports-details.md
CVE ID: CVE-2025-45019 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-05-06T15:23:18.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the cprice POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQL_injection_add_foreigners_ticket.md
CVE ID: CVE-2025-45020 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-04-30T14:33:38.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the todate parameter in a POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Park-Ticketing-Management-System-Project/SQL/SQL_Injection_normal-bwdates-reports-details.md
CVE ID: CVE-2025-45021 State: PUBLISHED Published: 2025-04-30T00:00:00.000Z Last Updated: 2025-04-30T15:42:08.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. Attackers can exploit this vulnerability via the email parameter in a POST request to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Directory%20Management%20System/SQL/SQl_Injection_in_edit-directory.md
CVE ID: CVE-2025-45029 State: PUBLISHED Published: 2025-07-02T00:00:00.000Z Last Updated: 2025-07-02T20:18:12.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT_LENGTH variable at /cgi-bin/upload.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://winstar.com - http://wn572hp3.com - https://yiweibu.github.io/2025/03/19/WINSTAR_WN572HP3/
CVE ID: CVE-2025-45042 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-05T15:56:18.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 v15.03.05.14 was discovered to contain a command injection vulnerability via the Telnet function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Ghostsuzhijian/Iot-/blob/main/ac9_telnetd/rx3_telnetd.md
CVE ID: CVE-2025-45055 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-09T19:48:13.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privileges by creating a new administrator account. The vulnerability arises from insufficient sanitization of SVG files and weak CSRF protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
t sanitization of SVG files and weak CSRF protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Silverpeas/Silverpeas-Core/pull/1394 - https://medium.com/@mingihongkim/privilege-escalation-via-svg-injection-in-silverpeas-6-4-2-b5ab1d5b6955
CVE ID: CVE-2025-45065 State: PUBLISHED Published: 2025-07-07T00:00:00.000Z Last Updated: 2025-07-08T17:37:18.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/1Sq08I_eKCY-YOmVOQPIEj4Ui2pW0gIgXHcqD9fcvR7M/edit?usp=sharing - https://medium.com/@shrutukapoor25/cve-2025-45065-b58a33e65860
CVE ID: CVE-2025-45080 State: REJECTED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-10T20:39:28.080Z Description: No description available.
CVE ID: CVE-2025-45081 State: PUBLISHED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-01T18:58:34.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/WH9GiMCQ
CVE ID: CVE-2025-45083 State: PUBLISHED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-01T19:49:31.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/mFM1a3CP
CVE ID: CVE-2025-45091 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T20:09:23.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://plus.seafile.com/wiki/publish/seafile-wiki/txzO/
CVE ID: CVE-2025-45095 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T15:49:03.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lavasoft Web Companion (also known as Ad-Aware WebCompanion) versions 8.9.0.1091 through 12.1.3.1037 installs the DCIService.exe service with an unquoted service path vulnerability. An attacker with write access to the file system could potentially execute arbitrary code with elevated privileges by placing a malicious executable in the unquoted path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/T4rantell/cd73592950c4ac700b40cc8e8e36494d
CVE ID: CVE-2025-45143 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-06-30T18:50:15.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.npmjs.com/package/string-math%2C - https://github.com/devrafalko/string-math/blob/master/string-math.js - https://gist.github.com/6en6ar/361608bccedb808061359481fe2f1b39
CVE ID: CVE-2025-45146 State: PUBLISHED Published: 2025-08-11T00:00:00.000Z Last Updated: 2025-08-11T16:10:03.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability allows attackers to execute arbitrary code via supplying crafted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcache/manager/data_manager.py#L84C1-L84C43 - https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcac
nager.py#L84C1-L84C43 - https://github.com/codefuse-ai/ModelCache/blob/e053e0d57b532d4ad9378d2f31bb85a009b77d64/modelcache/manager/factory.py#L18C1-L18C71 - https://pytorch.org/docs/stable/generated/torch.load.html - https://github.com/EDMPL/Vulnerability-Research/blob/main/CVE-2025-45146/README.md
CVE ID: CVE-2025-45150 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T17:24:38.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://langchain-chatglm-webui.com - https://github.com/X-D-Lab/LangChain-ChatGLM-Webui - https://gist.github.com/ycshao12/69a48551cc6c9cc69153d137afe9ecef
CVE ID: CVE-2025-45156 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:32:01.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://splashin.com - https://carterlasalle.github.io/splashin-cve-2025/splashin-1.pdf
CVE ID: CVE-2025-45157 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:33:24.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://splashin.com - https://carterlasalle.github.io/splashin-cve-2025/splashin-1.pdf
CVE ID: CVE-2025-45236 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:15:26.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Nickname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dbsyncer.com - https://github.com/86dbs/dbsyncer - https://gist.github.com/chao112122/504e224e63c9a966ba233df1d523ce4f
CVE ID: CVE-2025-45237 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:13:33.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /config/download of DBSyncer v2.0.6 allows attackers to access the JSON file containing sensitive account information, including the encrypted password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/86dbs/dbsyncer - https://gist.github.com/chao112122/11cd0cc46f0c806856f375f9f3f410c6
CVE ID: CVE-2025-45238 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T14:06:59.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: foxcms v1.2.5 was discovered to contain an arbitrary file deletion vulnerability via the delRestoreSerie method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/qianfox/foxcms - https://gist.github.com/chao112122/27010786774f2bb584cc715fb027b95c
CVE ID: CVE-2025-45239 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-13T19:12:52.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the restores method (DataBackup.php) of foxcms v2.0.6 allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/qianfox/foxcms/tree/V1.2.5/ - https://gist.github.com/chao112122/350e1af42ccea185206f8a8b9e4906e1