Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
de on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24786. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-880/
CVE ID: CVE-2025-8302 State: PUBLISHED Published: 2025-09-02T20:02:20.806Z Last Updated: 2025-09-03T15:29:59.332Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Realtek Products: rtl81xx SDK Problem Types: CWE-122 Description: Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY
rget system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26553. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-879/
CVE ID: CVE-2025-8309 State: PUBLISHED Published: 2025-08-20T16:53:29.010Z Last Updated: 2025-08-21T03:55:16.201Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: ManageEngine Products: Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus Problem Types: CWE-269 Description: There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before
rviceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/service-desk/cve-2025-8309.html
CVE ID: CVE-2025-8310 State: PUBLISHED Published: 2025-08-12T14:42:31.728Z Last Updated: 2025-08-13T15:03:55.289Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Ivanti Products: Virtual Application Delivery ControllerCWE-862 Problem Types: CWE-862 Description: Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Virtual-Application-Delivery-Controller-vADC-previously-vTM-CVE-2
s.ivanti.com/s/article/August-Security-Advisory-Ivanti-Virtual-Application-Delivery-Controller-vADC-previously-vTM-CVE-2025-8310?language=en_US
CVE ID: CVE-2025-8311 State: PUBLISHED Published: 2025-09-04T14:12:42.176Z Last Updated: 2025-09-11T14:43:50.767Z Vendors: dotCMS Products: dotCMS Cloud Services (dCS) Problem Types: CWE-89 Description: dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separated list of site identifiers or keys. The vulnerability was triggered via the sites parameter, which was directly concatenated into a SQL query without proper sanitization. Exploitation allowed an authenticated attacker with low privileges to extract data from database, perform privilege escalatio
itation allowed an authenticated attacker with low privileges to extract data from database, perform privilege escalation, or trigger denial-of-service conditions. The vulnerability was verified using tools such as SQLMap and confirmed to allow full database exfiltration and potential denial-of-service conditions via crafted payloads. The vulnerability is fixed in the following versions of dotCMS stack: 25.08.14 / 25.07.10-1v2 LTS / 24.12.27v10 LTS / 24.04.24v21 LTS Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-73
CVE ID: CVE-2025-8312 State: PUBLISHED Published: 2025-07-30T16:10:05.322Z Last Updated: 2025-08-19T12:18:26.409Z Vendors: Devolutions Products: Server Problem Types: CWE-833 Description: Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) : * Devolutions Server 2025.2.2.0 through 2025.2.5.0 * Devolutions Server 2025.1.12.0 and earlier Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0013/
CVE ID: CVE-2025-8313 State: PUBLISHED Published: 2025-08-05T06:39:49.155Z Last Updated: 2025-08-05T15:57:20.173Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emarket-design Products: Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Problem Types: CWE-79 Description: The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ee031b29-a334-4df4-8c03-4ffd306e38ea?source=cve - https://plugins.svn.wordpress.org/campus-directory/tags/1.9.1/includes/emd-form-builder-lite/emd-form-frontend.php - https://wordpress.org/plugins/campus-directory/#developers - https://plugins.trac.wordpress.org/changeset/3337642
CVE ID: CVE-2025-8314 State: PUBLISHED Published: 2025-08-12T04:25:41.252Z Last Updated: 2025-08-12T16:03:00.453Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emarket-design Products: Project Management, Bug and Issue Tracking Plugin – Software Issue Manager Problem Types: CWE-79 Description: The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that w
le for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ef87ab8-d56b-4d3a-b4fc-6c17c24143ec?source=cve - https://plugins.svn.wordpress.org/software-issue-manager/tags/5.0.0/includes/emd-form-builder-lite/emd-form-frontend.php - https://wordpress.org/plugins/software-issue-manager/#developers - https://plugins.trac.wordpress.org/changeset/3341018/
CVE ID: CVE-2025-8315 State: PUBLISHED Published: 2025-08-05T06:39:48.070Z Last Updated: 2025-08-05T13:23:20.107Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emarket-design Products: Simple Contact Form Plugin for WordPress – WP Easy Contact Problem Types: CWE-79 Description: The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
ttackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/229c88ea-c091-43b6-ac4d-31bccdd13a07?source=cve - https://plugins.svn.wordpress.org/wp-easy-contact/tags/4.0.1/includes/emd-form-builder-lite/emd-form-frontend.php - https://wordpress.org/plugins/wp-easy-contact/#developers - https://plugins.trac.wordpress.org/changeset/3337661
CVE ID: CVE-2025-8316 State: PUBLISHED Published: 2025-09-11T07:24:49.969Z Last Updated: 2025-09-11T14:41:31.899Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: moreirapontocom Products: Certifica WP Problem Types: CWE-79 Description: The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Note
ject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e7f5355-b87b-4720-8998-c081d005827b?source=cve - https://plugins.svn.wordpress.org/certifica-wp/tags/3.1/certificawp.php - https://wordpress.org/plugins/certifica-wp/#developers
CVE ID: CVE-2025-8317 State: PUBLISHED Published: 2025-08-02T07:24:22.861Z Last Updated: 2025-08-04T13:43:54.679Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bnielsen Products: Custom Word Cloud Problem Types: CWE-79 Description: The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst No
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f153a0ce-c967-43ed-97be-901ea7dcd12b?source=cve - https://plugins.svn.wordpress.org/custom-word-cloud/trunk/custom-word-cloud.php - https://wordpress.org/plugins/custom-word-cloud/#developers
CVE ID: CVE-2025-8318 State: PUBLISHED Published: 2025-09-11T07:24:54.673Z Last Updated: 2025-09-11T14:39:39.518Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bmarshall511 Products: Jobify Problem Types: CWE-79 Description: The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA AD
ry web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5e528d16-4a5d-4ef9-baac-e235fa3b4be3?source=cve - https://plugins.svn.wordpress.org/jobify/tags/1.4.4/src/Jobify/Shortcodes.php - https://wordpress.org/plugins/jobify/#developers
CVE ID: CVE-2025-8319 State: PUBLISHED Published: 2025-07-29T23:31:31.305Z Last Updated: 2025-07-30T15:06:34.396Z Vendors: Barracuda Products: Barracuda Message Archiver Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation Description: the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugcrowd.com/disclosures/30a330ef-0885-458c-a64f-2ad63d196b4d/dom-based-cross-site-scripting-xss-with-keylogger-injection-via-the-error-parameter-in-barracuda-mail-archiver
CVE ID: CVE-2025-8320 State: PUBLISHED Published: 2025-07-30T00:50:08.861Z Last Updated: 2025-07-30T13:45:54.178Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tesla Products: Wall Connector Problem Types: CWE-1284 Description: Tesla Wall Connector Content-Length Header Improper Input Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the HTTP Content-Length header. The issue results from the lack of proper validation
flaw exists within the parsing of the HTTP Content-Length header. The issue results from the lack of proper validation of user-supplied data, which can result in memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26300. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-711/
CVE ID: CVE-2025-8321 State: PUBLISHED Published: 2025-07-30T00:50:04.326Z Last Updated: 2025-07-30T13:48:29.568Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Tesla Products: Wall Connector Problem Types: CWE-1328 Description: Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware upgrade feature. The issue results from the lack of an anti-downgrade mechanism. An attacker can leverage this in conjunction with oth
e. The issue results from the lack of an anti-downgrade mechanism. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the device. Was ZDI-CAN-26299. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-712/
CVE ID: CVE-2025-8322 State: PUBLISHED Published: 2025-07-30T02:49:22.021Z Last Updated: 2025-07-30T13:43:59.436Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ventem Products: e-School Problem Types: CWE-862 Description: The e-School from Ventem has a Missing Authorization vulnerability, allowing remote attackers with regular privilege to access administrator functions, including creating, modifying, and deleting accounts. They can even escalate any account to system administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10304-6b375-1.html - https://www.twcert.org.tw/en/cp-139-10305-2eca
t: References: - https://www.twcert.org.tw/tw/cp-132-10304-6b375-1.html - https://www.twcert.org.tw/en/cp-139-10305-2eca0-2.html
CVE ID: CVE-2025-8323 State: PUBLISHED Published: 2025-07-30T02:54:07.404Z Last Updated: 2025-07-30T13:42:27.687Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ventem Products: e-School Problem Types: CWE-434 Description: The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10306-ccea7-1.html - https://www.twcert.org.tw/en/cp-139-10307-25cdf-2.html
CVE ID: CVE-2025-8324 State: PUBLISHED Published: 2025-11-11T13:04:00.573Z Last Updated: 2025-11-13T04:55:23.701Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zohocorp Products: ManageEngine Analytics Plus Problem Types: CWE-89 Description: Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/analytics-plus/CVE-2025-8324.html
CVE ID: CVE-2025-8326 State: PUBLISHED Published: 2025-07-30T13:02:05.212Z Last Updated: 2025-07-30T14:48:12.966Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Exam Form Submission Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/delete_s7.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318276 - https://vuldb.com/?ctiid.318276 - https://vuldb.com/?submit.623703 - https://github.com/vullis0/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8327 State: PUBLISHED Published: 2025-07-30T17:32:05.052Z Last Updated: 2025-07-30T17:42:25.165Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Exam Form Submission Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s8.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318277 - https://vuldb.com/?ctiid.318277 - https://vuldb.com/?submit.623721 - https://github.com/18672919390/CVE/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8328 State: PUBLISHED Published: 2025-07-30T18:02:05.852Z Last Updated: 2025-07-30T18:19:24.997Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Exam Form Submission Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument USN leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes:
has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318278 - https://vuldb.com/?ctiid.318278 - https://vuldb.com/?submit.623731 - https://github.com/1lusanbao9/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8329 State: PUBLISHED Published: 2025-07-30T19:02:05.922Z Last Updated: 2025-07-30T19:19:35.407Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /filter3.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrich
to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318279 - https://vuldb.com/?ctiid.318279 - https://vuldb.com/?submit.623860 - https://github.com/zgqsdx/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8330 State: PUBLISHED Published: 2025-07-30T19:32:05.677Z Last Updated: 2025-07-30T19:45:06.698Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Vehicle Management Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit1.php. The manipulation of the argument sno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318280 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318280 - https://vuldb.com/?ctiid.318280 - https://vuldb.com/?submit.623861 - https://github.com/zgqsdx/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8331 State: PUBLISHED Published: 2025-07-30T20:02:05.589Z Last Updated: 2025-07-30T20:16:06.045Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Farm System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Farm System 1.0 and classified as critical. This issue affects some unknown processing of the file /forgot_pass.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3182
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318281 - https://vuldb.com/?ctiid.318281 - https://vuldb.com/?submit.624002 - https://github.com/wllovemy/cve/issues/10 - https://code-projects.org/
CVE ID: CVE-2025-8332 State: PUBLISHED Published: 2025-07-30T20:32:06.315Z Last Updated: 2025-07-31T14:34:43.203Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Farm System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /register.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318282 - https://vuldb.com/?ctiid.318282 - https://vuldb.com/?submit.624003 - https://github.com/wllovemy/cve/issues/9 - https://code-projects.org/