Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. The original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/06/tcc-bypass/ - https://www.postbox-inc.com/
CVE ID: CVE-2025-5964 State: PUBLISHED Published: 2025-06-15T19:42:24.617Z Last Updated: 2025-06-16T13:46:48.208Z Vendors: M-Files Corporation Products: M-Files Server Problem Types: CWE-22 Description: A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-5964
CVE ID: CVE-2025-5966 State: PUBLISHED Published: 2025-06-26T12:22:10.367Z Last Updated: 2025-06-26T12:54:07.728Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: ManageEngine Products: Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5966.html
CVE ID: CVE-2025-5967 State: PUBLISHED Published: 2025-07-01T02:56:34.579Z Last Updated: 2025-07-01T13:12:52.297Z Vendors: Trellix Products: Endpoint Security HX Problem Types: CWE-79 Description: A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000014606
CVE ID: CVE-2025-5969 State: PUBLISHED Published: 2025-06-10T16:31:04.946Z Last Updated: 2025-06-10T20:05:48.712Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-632 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in D-Link DIR-632 FW103B08 and classified as critical. Affected by this vulnerability is the function FUN_00425fd8 of the file /biurl_grou of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported b
as been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311845 - https://vuldb.com/?ctiid.311845 - https://vuldb.com/?submit.592336 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-FUN_00425fd8 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-FUN_00425fd8#poc - https://www.dlink.com/
CVE ID: CVE-2025-5970 State: PUBLISHED Published: 2025-06-10T17:00:10.161Z Last Updated: 2025-06-10T17:31:23.407Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Restaurant Table Booking System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php. The manipulation of the argument fullname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well
nched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311846 - https://vuldb.com/?ctiid.311846 - https://vuldb.com/?submit.592338 - https://github.com/kakalalaww/CVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-5971 State: PUBLISHED Published: 2025-06-10T18:00:16.398Z Last Updated: 2025-06-10T18:20:07.457Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: School Fees Payment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects School Fees Payment System 1.0. It has been classified as critical. This affects an unknown part of the file /ajx.php. The manipulation of the argument name_startsWith leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311847 - https://vuldb.com/?ctiid.311847 - https://vuldb.com/?submit.592339 - https://vuldb.com/?submit.592441 - https://github.com/qingchuana/q1ngchuan/issues/6 - https://code-projects.org/
CVE ID: CVE-2025-5972 State: PUBLISHED Published: 2025-06-10T18:31:09.988Z Last Updated: 2025-06-10T18:54:50.960Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Restaurant Table Booking System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/manage-subadmins.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Addit
emotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311850 - https://vuldb.com/?ctiid.311850 - https://vuldb.com/?submit.592340 - https://github.com/kakalalaww/CVE/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-5973 State: PUBLISHED Published: 2025-06-10T18:31:12.823Z Last Updated: 2025-06-10T19:04:15.558Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Restaurant Table Booking System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-table.php. The manipulation of the argument tableno leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric
hed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311851 - https://vuldb.com/?ctiid.311851 - https://vuldb.com/?submit.592343 - https://github.com/kakalalaww/CVE/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-5974 State: PUBLISHED Published: 2025-06-10T19:31:06.362Z Last Updated: 2025-06-10T20:09:49.559Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Restaurant Table Booking System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this issue is some unknown functionality of the file /check-status.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311852 - https://vuldb.com/?ctiid.311852 - https://vuldb.com/?submit.592357 - https://github.com/kakalalaww/CVE/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-5975 State: PUBLISHED Published: 2025-06-10T19:31:09.240Z Last Updated: 2025-06-10T20:11:36.260Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Rail Pass Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /rpms/download-pass.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311853 - https://vuldb.com/?ctiid.311853 - https://vuldb.com/?submit.592440 - https://github.com/kakalalaww/CVE/issues/9 - https://phpgurukul.com/
CVE ID: CVE-2025-5976 State: PUBLISHED Published: 2025-06-10T20:00:13.611Z Last Updated: 2025-06-10T20:19:25.768Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Rail Pass Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in PHPGurukul Rail Pass Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/add-pass.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst
xploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311854 - https://vuldb.com/?ctiid.311854 - https://vuldb.com/?submit.592442 - https://github.com/kakalalaww/CVE/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-5977 State: PUBLISHED Published: 2025-06-10T20:00:15.426Z Last Updated: 2025-06-10T20:17:11.680Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: School Fees Payment System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. This issue affects some unknown processing of the file /datatable.php. The manipulation of the argument sSortDir_0 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311855 - https://vuldb.com/?ctiid.311855 - https://vuldb.com/?submit.592458 - https://github.com/jiangffffd/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-5978 State: PUBLISHED Published: 2025-06-10T20:31:07.787Z Last Updated: 2025-06-11T13:48:26.258Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH1202 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda FH1202 1.2.0.14. It has been classified as critical. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311856 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311856 - https://vuldb.com/?ctiid.311856 - https://vuldb.com/?submit.592462 - https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-fromVirtualSer-20b53a41781f80b7a6c7e727f93d7d9f?source=copy_link - https://www.tenda.com.cn/
CVE ID: CVE-2025-5979 State: PUBLISHED Published: 2025-06-10T20:31:09.803Z Last Updated: 2025-06-11T13:56:50.045Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: School Fees Payment System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /branch.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311859 - https://vuldb.com/?ctiid.311859 - https://vuldb.com/?submit.592463 - https://github.com/jiangffffd/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-5980 State: PUBLISHED Published: 2025-06-10T21:00:11.845Z Last Updated: 2025-06-11T13:56:04.037Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Restaurant Order System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Restaurant Order System 1.0. This vulnerability affects unknown code of the file /order.php. The manipulation of the argument tabidNoti leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311860 - https://vuldb.com/?ctiid.311860 - https://vuldb.com/?submit.592467 - https://github.com/jiangffffd/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-5981 State: PUBLISHED Published: 2025-06-18T08:28:02.899Z Last Updated: 2025-06-18T13:42:49.567Z Vendors: Google Products: osv-scalibr Problem Types: CWE-427 Description: Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/osv-scalibr/releases/tag/v0.1.8 - https://github.com/google/osv-scalibr/commit/2444419b1818c2d6917fc3394c947fb3276e9d59
CVE ID: CVE-2025-5982 State: PUBLISHED Published: 2025-06-12T16:27:56.700Z Last Updated: 2025-06-12T17:29:27.471Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1220 Description: An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/514456
CVE ID: CVE-2025-5983 State: PUBLISHED Published: 2025-10-22T06:00:06.022Z Last Updated: 2025-10-22T15:45:29.932Z Vendors: Unknown Products: Meta Tag Manager Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4a2d4dcf-bb34-4eec-b5de-31c6a4d823cf/
CVE ID: CVE-2025-5984 State: PUBLISHED Published: 2025-06-10T22:31:05.242Z Last Updated: 2025-06-11T13:37:59.598Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Student Clearance System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in SourceCodester Online Student Clearance System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Admin/add-fee.php. The manipulation of the argument txtamt leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311899 - https://vuldb.com/?ctiid.311899 - https://vuldb.com/?submit.592554 - https://www.sourcecodester.com/
CVE ID: CVE-2025-5985 State: PUBLISHED Published: 2025-06-10T22:31:07.011Z Last Updated: 2025-06-11T13:48:03.673Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: School Fees Payment System Problem Types: CWE-287 Description: A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311900 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311900 - https://vuldb.com/?ctiid.311900 - https://vuldb.com/?submit.592612 - https://github.com/tuooo/CVE/issues/13 - https://code-projects.org/
CVE ID: CVE-2025-5986 State: PUBLISHED Published: 2025-06-11T12:07:50.430Z Last Updated: 2025-11-03T20:06:43.375Z Vendors: Mozilla Products: Thunderbird Problem Types: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links Description: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download
Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012 - https://www.mozilla.org/security/advisories/mfsa2025-49/ - https://www.mozilla.org/security/advisories/mfsa2025-50/
CVE ID: CVE-2025-5987 State: PUBLISHED Published: 2025-07-07T14:24:12.576Z Last Updated: 2025-11-21T11:29:47.026Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-393 Description: A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code
detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-5987 - https://bugzilla.redhat.com/show_bug.cgi?id=2376219
CVE ID: CVE-2025-5988 State: PUBLISHED Published: 2025-08-04T15:16:43.526Z Last Updated: 2025-11-07T21:40:51.803Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 Problem Types: CWE-352 Description: A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:12772 - https://access.redhat.com/securit
ISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:12772 - https://access.redhat.com/security/cve/CVE-2025-5988 - https://bugzilla.redhat.com/show_bug.cgi?id=2371644
CVE ID: CVE-2025-5990 State: PUBLISHED Published: 2025-06-15T18:01:09.667Z Last Updated: 2025-06-16T13:48:53.025Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: Arcadia Technology, LLC Products: Crafty Controller Problem Types: CWE-79 Description: An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/crafty-controller/crafty-4/-/issues/567
CVE ID: CVE-2025-5991 State: PUBLISHED Published: 2025-06-11T07:33:41.071Z Last Updated: 2025-06-11T13:18:09.662Z Vendors: The Qt Company Products: Qt Problem Types: CWE-416 Description: There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP handling is not affected by this at all. This happens due to a race condition between how QHttp2Stream uploads the body of a POST request and the simultaneous handling of HTTP error responses. This issue only affects Qt 6.9.0 and has been fixed for Qt 6.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/c/qt/qtbase/+/6437
1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/c/qt/qtbase/+/643777
CVE ID: CVE-2025-5992 State: PUBLISHED Published: 2025-07-11T06:45:15.082Z Last Updated: 2025-07-11T13:21:43.156Z Vendors: The Qt Company Products: Qt Problem Types: CWE-20 Description: When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing a specifically crafted ICC profile to QColorSpace::fromICCProfile.This issue affects Qt from 6.6.0 through 6.8.3, from 6.9.0 through 6.9.1. This is fixed in 6.8.4 and 6.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/c/qt/qtbase/+/647919
CVE ID: CVE-2025-5993 State: PUBLISHED Published: 2025-09-08T10:18:47.856Z Last Updated: 2025-09-08T13:40:52.885Z Vendors: ITCube Software Products: ITCube CRM Problem Types: CWE-22 Description: ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/07/CVE-2025-5993 - https://itcube.pl/modul-crm