Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25736 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-10-22T14:57:06.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/306.html - https://www.kapsch.net/en - https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf5009
/data/definitions/306.html - https://www.kapsch.net/en - https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - https://phrack.org/issues/72/16_md
CVE ID: CVE-2025-25737 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-10-22T14:56:53.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass authentication via a bruteforce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/521.html - https://www.kapsch.net/en - https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataS
ch.net/en - https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf - https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - https://phrack.org/issues/72/16_md
CVE ID: CVE-2025-25740 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-03-17T18:42:31.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-2-1812386a66448036a1cce259beb30b04
CVE ID: CVE-2025-25741 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-05T18:43:02.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-7-1812386a664480b7ac54d281afa629f5
CVE ID: CVE-2025-25742 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-05T18:46:07.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-3-1812386a664480feaf1ceab444b132b3
CVE ID: CVE-2025-25743 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-05T18:45:20.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-1812386a664480229910c137ded2d3f1
CVE ID: CVE-2025-25744 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-05T18:44:01.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-4-1812386a664480378626cc13b98e18f5
CVE ID: CVE-2025-25745 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T15:30:39.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-2-1812386a664480ea82a7f8321d967187
CVE ID: CVE-2025-25746 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-18T16:02:25.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-5-1812386a66448044b489f223b8c2e78a
CVE ID: CVE-2025-25747 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-12T15:25:04.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/79.html - https://www.huyvo.net/post/cve-2025-25747-reflected-xss-vulnerability-in-hoteldruid-3-0-7
CVE ID: CVE-2025-25748 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-21T20:40:50.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huyvo.net/post/cve-2025-25748-cross-site-request-forgery-csrf-vulnerability-in-hoteldruid-3-0-7
CVE ID: CVE-2025-25749 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-24T17:37:21.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.huyvo.net/post/cve-2025-25749-weak-password-policy-in-hoteldruid-3-0-7
CVE ID: CVE-2025-25758 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-03-24T15:12:36.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/0cb0KsGS
CVE ID: CVE-2025-25759 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-04T14:38:05.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/147536951/Qianyi-learn/blob/main/SUCMS.pdf
CVE ID: CVE-2025-25760 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-04T14:36:22.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/147536951/Qianyi-learn/blob/main/SUCMS2.pdf
CVE ID: CVE-2025-25761 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-27T14:42:31.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/147536951/Qianyi-learn/blob/main/Hkcms.pdf
CVE ID: CVE-2025-25763 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:43:35.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/J-0k3r/sql/blob/main/sql.pdf - https://github.com/J-0k3r/CVE-2025-25763
CVE ID: CVE-2025-25765 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-03T19:57:07.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/be03dd2c-b760-457a-a919-e388d7566ff2
CVE ID: CVE-2025-25766 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-03T19:52:39.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/7097c747-ae3e-4cef-a198-285863698607
CVE ID: CVE-2025-25767 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-03T19:49:31.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/a6170a19-032b-462d-8bf9-06ab139f78ba
CVE ID: CVE-2025-25768 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-03T19:44:09.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/8838861d-0b32-4314-a13d-edb22b72cebc
CVE ID: CVE-2025-25769 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-24T17:18:51.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/56c86622-1e4d-47ed-923c-9e37aff00079
CVE ID: CVE-2025-25770 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-24T17:16:38.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/dddbd17e-e459-46c7-b3f9-9c9a90cee804
CVE ID: CVE-2025-25772 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T21:09:45.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/u123456789-6sobi/cdgcbq/pkwoqmkamcm9854r?singleDoc#%E3%80%8AjspXcms_csrf%E3%80%8B
CVE ID: CVE-2025-25774 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-03-12T19:20:50.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/3671 - https://github.com/open5gs/open5gs/commit/2e68706f1eea029d5172ccad946e78b352c031d0 - https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Deni
s/commit/2e68706f1eea029d5172ccad946e78b352c031d0 - https://github.com/guoweifk/BugReport/blob/main/Open5GS%20AMF%20Denial%20of%20Service%20via%20GMM%20State%20Handling%20in%20Handover
CVE ID: CVE-2025-25775 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T17:49:44.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code/ - https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25775
CVE ID: CVE-2025-25776 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-28T17:36:45.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code/ - https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25776
CVE ID: CVE-2025-25777 State: PUBLISHED Published: 2025-04-24T00:00:00.000Z Last Updated: 2025-04-25T17:07:04.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeastro.com/bus-ticket-booking-system-in-php-codeigniter-with-source-code/ - https://github.com/arunmodi/Vulnerability-Research/tree/main/CVE-2025-25777
CVE ID: CVE-2025-25783 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-04T21:53:53.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.emlog.net/ - http://emlogpro.com - https://github.com/Ka7arotto/emlog/blob/main/emlog-3.md
CVE ID: CVE-2025-25784 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-05T14:49:38.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jizhicms.com - https://www.jizhicms.cn/ - https://github.com/Ka7arotto/JizhiCms/blob/main/jizhicms.md
CVE ID: CVE-2025-25785 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-05T14:48:07.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jizhicms.com - https://www.jizhicms.cn/
CVE ID: CVE-2025-25789 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-05T14:46:56.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foxcms.com - https://www.foxcms.cn/ - https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-rce3.md
CVE ID: CVE-2025-25790 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-05T14:47:23.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://foxcms.com - https://www.foxcms.cn/ - https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-upload-rce.md
CVE ID: CVE-2025-25791 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-03T17:21:33.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://yzncms.com - https://gitee.com/ken678/YZNCMS - https://github.com/Ka7arotto/YZNCMS/blob/main/yzncms-upload.md
CVE ID: CVE-2025-25792 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-03T20:36:03.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/seacmsv13.3-rce-1.md
CVE ID: CVE-2025-25793 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:47:27.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-3.md
CVE ID: CVE-2025-25794 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:48:54.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-4.md
CVE ID: CVE-2025-25796 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:55:27.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-6.md
CVE ID: CVE-2025-25797 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:54:20.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-7.md
CVE ID: CVE-2025-25799 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:53:17.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-lrf.md
CVE ID: CVE-2025-25800 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-02-26T15:18:03.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-lrf-2.md
CVE ID: CVE-2025-25802 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:51:34.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-2.md
CVE ID: CVE-2025-25813 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T17:50:38.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://www.seacms.com/ - https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-5.md
CVE ID: CVE-2025-25818 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-03T16:30:11.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.emlog.net/ - http://emlogpro.com - https://github.com/Ka7arotto/emlog/blob/main/xss.md
CVE ID: CVE-2025-25823 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T20:27:13.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.emlog.net/ - http://emlogpro.com - https://github.com/Ka7arotto/emlog/blob/main/xss-3.md
CVE ID: CVE-2025-25825 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-06T20:28:45.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.emlog.net/ - http://emlogpro.com - https://github.com/Ka7arotto/emlog/blob/main/xss-4.md