Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1961 State: PUBLISHED Published: 2025-03-04T23:00:10.136Z Last Updated: 2025-03-05T16:14:28.660Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Church Management Software Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester Best Church Management Software 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/web_crud.php. The manipulation of the argument encryption leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Addit
emotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298561 - https://vuldb.com/?ctiid.298561 - https://vuldb.com/?submit.510865 - https://github.com/Yesec/Best-church-management-software/blob/main/web_crud.php_SQLi.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-1962 State: PUBLISHED Published: 2025-03-04T23:31:04.999Z Last Updated: 2025-03-05T16:13:21.482Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Hotel Booking Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been classified as critical. This affects an unknown part of the file /admin/addroom.php. The manipulation of the argument roomname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298563 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298563 - https://vuldb.com/?ctiid.298563 - https://vuldb.com/?submit.511426 - https://github.com/ubfbuz3/cve/issues/1
CVE ID: CVE-2025-1963 State: PUBLISHED Published: 2025-03-05T00:00:09.677Z Last Updated: 2025-03-05T15:55:20.158Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Hotel Booking Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /reservation.php. The manipulation of the argument checkin leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298564 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298564 - https://vuldb.com/?ctiid.298564 - https://vuldb.com/?submit.511466 - https://github.com/ubfbuz3/cve/issues/2
CVE ID: CVE-2025-1964 State: PUBLISHED Published: 2025-03-05T00:31:04.503Z Last Updated: 2025-03-05T15:02:43.486Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Hotel Booking Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been rated as critical. This issue affects some unknown processing of the file /booknow.php?roomname=Duplex. The manipulation of the argument checkin leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnri
d to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298565 - https://vuldb.com/?ctiid.298565 - https://vuldb.com/?submit.511471 - https://github.com/ubfbuz3/cve/issues/3
CVE ID: CVE-2025-1965 State: PUBLISHED Published: 2025-03-05T01:00:07.715Z Last Updated: 2025-03-05T14:49:49.425Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: projectworlds Products: Online Hotel Booking Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in projectworlds Online Hotel Booking 1.0. Affected is an unknown function of the file /admin/login.php. The manipulation of the argument emailusername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298566 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298566 - https://vuldb.com/?ctiid.298566 - https://vuldb.com/?submit.511473 - https://github.com/ubfbuz3/cve/issues/4
CVE ID: CVE-2025-1966 State: PUBLISHED Published: 2025-03-05T01:31:05.285Z Last Updated: 2025-03-05T14:48:46.926Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Pre-School Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Pre-School Enrollment System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298567 - https://vuldb.com/?ctiid.298567 - https://vuldb.com/?submit.512039 - https://github.com/SECWG/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-1967 State: PUBLISHED Published: 2025-03-05T02:00:08.826Z Last Updated: 2025-03-05T14:45:43.175Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /user_dashboard/donor.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.298568 - https://vuldb.com/?ctiid.298568 - https://vuldb.com/?submit.512163 - https://github.com/intercpt/XSS1/blob/main/XSS.md - https://code-projects.org/
CVE ID: CVE-2025-1968 State: PUBLISHED Published: 2025-04-09T13:33:31.450Z Last Updated: 2025-05-02T15:35:28.201Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Progress Software Corporation Products: Sitefinity Problem Types: CWE-613 Description: Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
from 15.1 before 15.1.8332, from 15.2 before 15.2.8429. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025
CVE ID: CVE-2025-1969 State: PUBLISHED Published: 2025-03-04T18:49:01.823Z Last Updated: 2025-10-14T19:28:26.314Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AWS Products: Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center Problem Types: CWE-807 Description: Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM. Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aw
ocumentation for updating process Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aws-samples/iam-identity-center-team/security/advisories/GHSA-x9xv-r58p-qh86 - https://aws.amazon.com/security/security-bulletins/AWS-2025-004/ - https://github.com/aws-samples/iam-identity-center-team/releases/tag/v1.2.2
CVE ID: CVE-2025-1970 State: PUBLISHED Published: 2025-03-22T11:18:41.122Z Last Updated: 2025-03-24T20:01:18.331Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: webtoffee Products: Export and Import Users and Customers Problem Types: CWE-918 Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information fr
requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a4d7d40-8e0e-4251-8e25-3fd4ebd3a93e?source=cve - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/import/classes/class-import-ajax.php#L175 - https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3259688/
CVE ID: CVE-2025-1971 State: PUBLISHED Published: 2025-03-22T11:18:40.673Z Last Updated: 2025-03-24T20:01:38.318Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webtoffee Products: Export and Import Users and Customers Problem Types: CWE-502 Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vu
access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4b24b3d2-589f-47b2-bcdd-bebc87cafeda?source=cve - https://plugins.trac.wordpress.org/browser/users-customers
bilities/id/4b24b3d2-589f-47b2-bcdd-bebc87cafeda?source=cve - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/import/classes/class-import-ajax.php - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/export/classes/class-export-ajax.php - https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3259688/
CVE ID: CVE-2025-1972 State: PUBLISHED Published: 2025-03-22T11:18:40.240Z Last Updated: 2025-03-24T22:01:09.156Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: webtoffee Products: Export and Import Users and Customers Problem Types: CWE-73 Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment:
level access and above, to delete arbitrary log files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d443c70-6537-4c6d-a282-12d392f0f558?source=cve - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/history/history.php#L248 - https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3259688/
CVE ID: CVE-2025-1973 State: PUBLISHED Published: 2025-03-22T11:23:31.986Z Last Updated: 2025-03-24T17:36:21.624Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: webtoffee Products: Export and Import Users and Customers Problem Types: CWE-22 Description: The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnri
arbitrary log files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13b7a2e4-59f4-4d61-a165-a830ccfb696a?source=cve - https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/trunk/admin/modules/history/history.php#L751 - https://wordpress.org/plugins/users-customers-import-export-for-wp-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3259688/
CVE ID: CVE-2025-1974 State: PUBLISHED Published: 2025-03-24T23:28:48.985Z Last Updated: 2025-11-10T17:23:37.058Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kubernetes Products: ingress-nginx Problem Types: CWE-653 Description: A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) Additional Analyst Notes: - CISA ADP Vulnrichme
fault installation, the controller can access all Secrets cluster-wide.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://github.com/kubernetes/kubernetes/issues/131009
CVE ID: CVE-2025-1975 State: PUBLISHED Published: 2025-05-16T08:25:57.177Z Last Updated: 2025-05-16T15:50:11.815Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ollama Products: ollama/ollama Problem Types: CWE-129 Description: A vulnerability in the Ollama server version 0.5.11 allows a malicious user to cause a Denial of Service (DoS) attack by customizing the manifest content and spoofing a service. This is due to improper validation of array index access when downloading a model via the /api/pull endpoint, which can lead to a server crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/921ba5d4-f1d0-4c66-9764-4
h. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/921ba5d4-f1d0-4c66-9764-4f72dffe7acd
CVE ID: CVE-2025-1976 State: PUBLISHED Published: 2025-04-24T02:55:40.225Z Last Updated: 2025-10-21T22:55:18.170Z Vendors: Brocade Products: Fabric OS Problem Types: CWE-94 Description: Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602
CVE ID: CVE-2025-1979 State: PUBLISHED Published: 2025-03-06T05:00:02.068Z Last Updated: 2025-03-06T15:13:37.073Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: n/a Products: ray Problem Types: CWE-532 Description: Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password. This is only exploitable if: 1) Logging is enabled; 2) Redis is using password authentication; 3) Those logs are accessible to an attacker, who can reach that redis ins
ed; 2) Redis is using password authentication; 3) Those logs are accessible to an attacker, who can reach that redis instance. **Note:** It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212 - https://github.com/ray-project/ray/pull/50409 - https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d - https://github.com/ray-project/ray/issues/50266
CVE ID: CVE-2025-1980 State: PUBLISHED Published: 2025-04-16T12:35:22.847Z Last Updated: 2025-04-16T14:28:31.070Z Vendors: Symfonia Products: Ready_ Problem Types: CWE-434 Description: The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/04/CVE-2025-1980 - https://cert.pl/en/posts/2025/04/CVE-2025-1980 - https://ready-os.com/
: - https://cert.pl/posts/2025/04/CVE-2025-1980 - https://cert.pl/en/posts/2025/04/CVE-2025-1980 - https://ready-os.com/pl/
CVE ID: CVE-2025-1981 State: PUBLISHED Published: 2025-04-16T12:36:10.910Z Last Updated: 2025-04-16T14:16:02.050Z Vendors: Symfonia Products: Ready_ Problem Types: CWE-89 Description: Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/04/CVE-2025-1980 - https://cert.pl/en/posts/2025/04/CVE-2025-1980 - https://ready-os.com/pl/
CVE ID: CVE-2025-1982 State: PUBLISHED Published: 2025-04-16T12:36:36.532Z Last Updated: 2025-04-16T14:15:32.327Z Vendors: Symfonia Products: Ready_ Problem Types: CWE-552 Description: Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/04/CVE-2025-1980 - https://cert.pl/en/posts/2025/04/CVE-2025-1980 - https://ready-os.com/pl/
CVE ID: CVE-2025-1983 State: PUBLISHED Published: 2025-04-16T12:36:53.703Z Last Updated: 2025-04-16T14:07:01.432Z Vendors: Symfonia Products: Ready_ Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected content is stored on server and is executed every time a user interacts with the uploaded file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/04/CVE-2025-1980 - https://cert.pl/en/posts/2025/04/CVE-2025-1980 - https://ready-os.com/pl/
CVE ID: CVE-2025-1984 State: PUBLISHED Published: 2025-03-12T15:27:07.715Z Last Updated: 2025-05-12T15:37:02.156Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Xerox Products: Xerox® Desktop Print Experience Problem Types: CWE-428 Description: Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/03/Xerox-Security-Bulletin-XRX25-006-for-Xerox-Desktop-Print-Experience.pdf
CVE ID: CVE-2025-1985 State: PUBLISHED Published: 2025-05-26T08:21:34.217Z Last Updated: 2025-05-27T14:18:17.838Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Pepperl+Fuchs Products: Profinet Gateway FB8122A.1.EL, Profinet Gateway LB8122A.1.EL Problem Types: CWE-79 Description: Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2025-011
CVE ID: CVE-2025-1986 State: PUBLISHED Published: 2025-04-01T06:00:04.734Z Last Updated: 2025-04-01T15:06:41.276Z Vendors: Unknown Products: Gutentor Problem Types: CWE-89 SQL Injection Description: The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f1414750-19ee-4a5d-b255-a9c20168b716/
CVE ID: CVE-2025-1987 State: PUBLISHED Published: 2025-06-21T21:35:06.643Z Last Updated: 2025-06-23T14:56:45.902Z Vendors: Psono, Bitdefender Products: Psono-client, SecurePass Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will exe
vascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls
CVE ID: CVE-2025-1990 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:38.509Z Description: No description available.
CVE ID: CVE-2025-1991 State: PUBLISHED Published: 2025-06-28T13:02:21.000Z Last Updated: 2025-08-24T11:40:02.546Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Informix Dynamic Server Problem Types: CWE-191 Description: IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a remote attacker to cause a denial of service due to an integer underflow when processing packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238455