Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8206 State: PUBLISHED Published: 2025-07-26T19:02:05.590Z Last Updated: 2025-07-28T16:01:12.344Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: Comodo Products: Dragon Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Leakage Detector. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The ve
r high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317775 - https://vuldb.com/?ctiid.317775 - https://news.fmisec.com/comodo-dragon-vulnerability
CVE ID: CVE-2025-8207 State: PUBLISHED Published: 2025-07-26T20:02:05.807Z Last Updated: 2025-07-28T15:14:42.271Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Canara Products: ai1 Mobile Banking App Problem Types: CWE-926 Description: A vulnerability was found in Canara ai1 Mobile Banking App 3.6.23 on Android and classified as problematic. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.canarabank.mobility. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
onents. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317777 - https://vuldb.com/?ctiid.317777 - https://vuldb.com/?submit.615777 - https://github.com/KMov-g/androidapps/blob/main/com.canarabank.mobility.md
CVE ID: CVE-2025-8208 State: PUBLISHED Published: 2025-08-24T05:27:08.769Z Last Updated: 2025-08-25T11:30:43.254Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: templatescoderthemes Products: Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates Problem Types: CWE-79 Description: The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inje
upplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e6f7fa35-a5b4-4dfd-8be8-17b7b8703c6d?source=cve - https://wordpress.org/plugins/sastra-essential-addons-for-elementor/#developers - https://plugins.trac.wordpress.org/changeset/3348552/
CVE ID: CVE-2025-8210 State: PUBLISHED Published: 2025-07-26T20:32:05.177Z Last Updated: 2025-07-28T15:15:18.296Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Yeelink Products: Yeelight App Problem Types: CWE-926 Description: A vulnerability was found in Yeelink Yeelight App up to 3.5.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component com.yeelight.cherry. The manipulation leads to improper export of android application components. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early ab
ocally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317778 - https://vuldb.com/?ctiid.317778 - https://vuldb.com/?submit.615779 - https://github.com/KMov-g/androidapps/blob/main/com.yeelight.cherry.md
CVE ID: CVE-2025-8211 State: PUBLISHED Published: 2025-07-26T21:02:05.372Z Last Updated: 2025-07-28T16:46:22.870Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Roothub Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317779 - https://vuldb.com/?ctiid.317779 - https://vuldb.com/?submit.622227 - https://vuldb.com/?submit.622347 - https://github.com/wandeorfu/test
CVE ID: CVE-2025-8212 State: PUBLISHED Published: 2025-08-02T07:24:21.959Z Last Updated: 2025-08-04T15:17:30.443Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nicheaddons Products: Medical Addon for Elementor Problem Types: CWE-79 Description: The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wh
icated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9dc5452d-41e4-4b28-bb89-fe5ef9c10cb7?source=cve - https://wordpress.org/plugins/medical-addon-for-elementor/#developers
CVE ID: CVE-2025-8213 State: PUBLISHED Published: 2025-07-31T12:24:43.148Z Last Updated: 2025-07-31T13:10:56.349Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: nintechnet Products: NinjaScanner – Virus & Malware scan Problem Types: CWE-36 Description: The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions in all versions up to, and including, 3.2.5. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files out
cated attackers, with Administrator-level access and above, to delete arbitrary files on the server, including files outside the WordPress root directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b1da345-ddbb-48ad-b0c1-bb0cb3b0fc69?source=cve - https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/ajax_hooks.php#L331 - https://plugins.trac.wordpress.org/browser/ninjascanner/trunk/lib/tab_quarantine.php#L114 - https://plugins.trac.wordpress.org/changeset/3336569/
CVE ID: CVE-2025-8214 State: PUBLISHED Published: 2025-09-30T03:35:32.974Z Last Updated: 2025-09-30T13:17:22.695Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webangon Products: The Pack Elementor addon Problem Types: CWE-79 Description: The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e120698f-c076-4d8f-934c-b4c46f2381ec?source=cve - https://wordpress.org/plugins/the-pack-addon/#developers
CVE ID: CVE-2025-8215 State: PUBLISHED Published: 2025-09-11T07:24:58.353Z Last Updated: 2025-09-11T14:38:20.406Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cyberchimps Products: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates Problem Types: CWE-79 Description: The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject ar
ed attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd3dbc56-4833-4b5d-bd6c-facc3e1878ea?source=cve - https://wordpress.org/plugins/responsive-addons-for-elementor/#developers
CVE ID: CVE-2025-8216 State: PUBLISHED Published: 2025-07-29T09:23:44.652Z Last Updated: 2025-07-29T13:46:51.388Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wowdevs Products: Sky Addons – Elementor Addons with Widgets & Templates Problem Types: CWE-79 Description: The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17240221-01b2-4a21-9e9f-f940280c0fb7?source=cve - https://wordpress.org/plugins/sky-elementor-addons/#developers - https://plugins.trac.wordpress.org/changeset/3334452/
CVE ID: CVE-2025-8217 State: PUBLISHED Published: 2025-07-30T00:34:06.733Z Last Updated: 2025-10-14T17:54:42.871Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Amazon Products: Q Developer VS Code Extension Problem Types: CWE-506 Description: The Amazon Q Developer Visual Studio Code (VS Code) extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making a successful API call to the Q Developer CLI. To mitigate this issue, users should upgrade to version v1.85.0. All installat
ccessful API call to the Q Developer CLI. To mitigate this issue, users should upgrade to version v1.85.0. All installations of v1.84.0 should be removed from use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ - https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw - https://github.com/aws/aws-toolkit-vscode/releases/tag/amazonq%2Fv1.85.0
CVE ID: CVE-2025-8218 State: PUBLISHED Published: 2025-08-19T06:45:26.792Z Last Updated: 2025-08-19T13:23:30.150Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: imithemes Products: Real Spaces - WordPress Properties Directory Theme Problem Types: CWE-269 Description: The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile u
ble for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d07880b-9af1-4b1e-aa70-b95ef10a6e33?source=cve - https://themeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779
CVE ID: CVE-2025-8219 State: PUBLISHED Published: 2025-07-27T02:02:04.860Z Last Updated: 2025-07-28T15:02:02.129Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C) Vendors: Shanghai Lingdang Information Technology Products: Lingdang CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php of the component HTTP POST Request Handler. The manipulation of the argument getvaluestring leads to sql injection. The attack may be initiated remotely. Upgrading to versi
pulation of the argument getvaluestring leads to sql injection. The attack may be initiated remotely. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+. We strongly advise all customers to upgrade to the current version (v8.6.5.2), which includes this fix and additional security enhancements." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317807 - https://vuldb.com/?ctiid.317807 - https://vuldb.com/?submit.616140 - https://www.notion.so/SQL-Injection-Vulnerability-in-Lin
://vuldb.com/?ctiid.317807 - https://vuldb.com/?submit.616140 - https://www.notion.so/SQL-Injection-Vulnerability-in-Lingdang-CRM-231ac9e8711e8017ab4ee3bb5f4aab0b?source=copy_link
CVE ID: CVE-2025-8220 State: PUBLISHED Published: 2025-07-27T03:02:05.624Z Last Updated: 2025-10-11T21:13:14.253Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Engeman Products: Web Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.0.3 is sufficient to fix this iss
he exploit has been disclosed to the public and may be used. Upgrading to version 12.0.0.3 is sufficient to fix this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317808 - https://vuldb.com/?ctiid.317808 - https://vuldb.com/?submit.616747 - https://github.com/m3m0o/engeman-web-language-combobox-sqli
CVE ID: CVE-2025-8221 State: PUBLISHED Published: 2025-07-27T04:02:04.985Z Last Updated: 2025-07-28T14:59:07.284Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: jerryshensjf Products: JPACookieShop 蛋糕商城JPA版 Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product
ipting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317809 - https://vuldb.com/?ctiid.317809 - https://vuldb.com/?submit.621784 - https://github.com/Bemcliu/cve-reports/blob/main/cve-04-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Reflected%20XSS/readme.md
CVE ID: CVE-2025-8222 State: PUBLISHED Published: 2025-07-27T04:32:05.698Z Last Updated: 2025-07-28T16:45:36.587Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: jerryshensjf Products: JPACookieShop 蛋糕商城JPA版 Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolli
k may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Multiple endpoints are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317810 - https://vuldb.com/?ctiid.317810 - https://vuldb.com/?submit.621785 - https://github.com/Bemcliu/cve-reports/blob/main/cve-05-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Stored%20XSS/readme.md
CVE ID: CVE-2025-8223 State: PUBLISHED Published: 2025-07-27T05:02:05.371Z Last Updated: 2025-07-28T17:26:17.418Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: jerryshensjf Products: JPACookieShop 蛋糕商城JPA版 Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This affects an unknown part of the file AdminTypeCustController.java. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versio
iate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317811 - https://vuldb.com/?ctiid.317811 - https://vuldb.com/?submit.621787 - https://github.com/Bemcliu/cve-reports/blob/main/cve-06-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-CSRF/readme.md
CVE ID: CVE-2025-8224 State: PUBLISHED Published: 2025-07-27T05:32:06.926Z Last Updated: 2025-07-28T16:59:22.821Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: GNU Products: Binutils Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91
exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317812 - https://vuldb.com/?ctiid.317812 - https://vuldb.com/?submit.621878 - https://sourceware.org/bugzilla/show_bug.cgi?id=32109 - https://sourceware.org/bugzilla/show_bug.cgi?id=32109#c2 - https://sourceware.org/bugzilla/attachment.cgi?id=15680 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=db856d41004301b3a56438efd957ef5cabb91530 - https://www.gnu.org/
CVE ID: CVE-2025-8225 State: PUBLISHED Published: 2025-07-27T08:02:06.568Z Last Updated: 2025-07-28T17:25:22.500Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: GNU Products: Binutils Problem Types: CWE-401, CWE-404 Description: A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue. Additional Analyst Notes:
51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317813 - https://vuldb.com/?ctiid.317813 - https://vuldb.com/?submit.621883 - https://gitlab.com/gnutools/binutils-gdb/-/commit/e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4 - https://www.gnu.org/
CVE ID: CVE-2025-8226 State: PUBLISHED Published: 2025-07-27T08:32:11.711Z Last Updated: 2025-07-28T17:24:57.509Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-200, CWE-284 Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been classified as problematic. Affected is an unknown function of the file /sysApp/find. The manipulation of the argument accessKey/secretKey leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It
e exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317814 - https://vuldb.com/?ctiid.317814 - https://vuldb.com/?submit.622167 - https://gitee.com/yanyutao0402/ChanCMS/issues/ICLP9V
CVE ID: CVE-2025-8227 State: PUBLISHED Published: 2025-07-27T09:02:18.139Z Last Updated: 2025-07-28T14:57:17.110Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /collect/getArticle. The manipulation of the argument taskUrl leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.3 is able to address this issue. The patch is named 3