Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-50978 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T16:22:57.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled. By injecting a specially crafted path payload an attacker can cause arbitrary JavaScript to execute when a victim views the manipulated URL. This flaw stems from insufficient input sanitization of filename elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/gitblit-v1.7.1-reflected-XSS-via-filenames.md
CVE ID: CVE-2025-50979 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T18:24:03.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-based payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/NodeBB-v4.3.0.-SQL-Injection-via-search-parameter.md
CVE ID: CVE-2025-50983 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T15:41:01.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. The endpoint fails to properly sanitize user-supplied input, allowing attackers to inject and execute arbitrary SQL commands against the backend SQLite database. Sqlmap confirmed exploitation via stacked queries, demonstrating that the parameter can be abused to run arbitrary SQL statements. A heavy query was executed using SQLite's RANDOMBLOB() and HEX() functions to simulate a time-based pay
SQL statements. A heavy query was executed using SQLite's RANDOMBLOB() and HEX() functions to simulate a time-based payload, indicating deep control over database interactions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/readarr-0.4.15.2787-sql-injection-via-sortkey-parameter.md
CVE ID: CVE-2025-50984 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T19:41:05.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration form. Unsanitized user input in POST parameters such as ES_PASS, ES_MAXSIZE, ES_TRANSLOGSIZE, ES_TIMEOUT, ES_USER, ES_HOST, ES_PORT, ES_SCROLLSIZE, ES_CHUNKSIZE and others can be crafted to inject arbitrary SQLite expressions wrapped in JSON functions. By exploiting these injection points, an attacker can infer or extract sensitive information from the underlying database without auth
these injection points, an attacker can infer or extract sensitive information from the underlying database without authentication. This issue stems from improper input validation and parameterization in the application's JSON-based query construction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/diskover-web-v2.3.0-community-edition-sqli.md
CVE ID: CVE-2025-50985 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T15:12:25.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. Unsanitized GET parameters including maxage, maxindex, index, path, q (query), and doctype are directly echoed into the HTML response, allowing attackers to inject and execute arbitrary JavaScript when a victim visits a maliciously crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/diskover-web-v2.3.0-community-edition-ref
ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/diskover-web-v2.3.0-community-edition-reflected-xss.md
CVE ID: CVE-2025-50986 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T15:03:20.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings interface. Various configuration fields such as ES_HOST, ES_INDEXREFRESH, ES_PORT, ES_SCROLLSIZE, ES_TRANSLOGSIZE, ES_TRANSLOGSYNCINT, EXCLUDES_FILES, FILE_TYPES[], INCLUDES_DIRS, INCLUDES_FILES, and TIMEZONE do not properly sanitize user-supplied input. Malicious payloads submitted via these parameters are persisted in the application and executed whenever an administrator views or
payloads submitted via these parameters are persisted in the application and executed whenever an administrator views or edits the settings page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/diskover-web-v2.3.0-community-edition-stored-xss.md
CVE ID: CVE-2025-50989 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-09-12T13:49:13.889Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: OPNsense Products: OPNsense Problem Types: CWE-78 Description: OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typical
s and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/OPNsense-25.1-Command-Injection-via-span-parameter.md - https://github.com/opnsense/changelog/blob/640e96ed6a783254283aead0d0b744fc9143ce6d/community/25.1/25.1.8#L34
CVE ID: CVE-2025-51005 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:40:33.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. When a crafted pcap file is processed, the program incorrectly handles memory in the checksum calculation logic at do_checksum_math_liveplay in tcpliveplay.c, leading to a possible denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/appneta/tcpreplay/issues/925 - https://github.com/sy460129/CVE-2025-51005
CVE ID: CVE-2025-51006 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-22T15:53:57.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. This vulnerability is triggered when tcpedit_dlt_cleanup() indirectly invokes the cleanup routine multiple times on the same memory region. By supplying a specifically crafted pcap file to the tcprewrite binary, a local attacker can exploit this flaw to cause a Denial of Service (DoS) via memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
w to cause a Denial of Service (DoS) via memory corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/appneta/tcpreplay/issues/926 - https://github.com/sy460129/CVE-2025-51006
CVE ID: CVE-2025-51040 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T19:16:07.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/p0et08/Electrolink-FM-DAB-TV
CVE ID: CVE-2025-51044 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T19:39:08.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of user input for the " govtissuedid" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bluechips-zhao/myCVE/issues/1
CVE ID: CVE-2025-51045 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T19:36:07.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bluechips-zhao/myCVE/issues/4
CVE ID: CVE-2025-51052 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T20:48:40.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'file_get_contents()' function call in '/api_vedo/template'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vedo.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51053 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T20:42:00.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bottinelli.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51054 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T20:49:33.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentication via sending an empty HTTP POST request to the /autologin/ API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bottinelli.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51055 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-07T13:37:47.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text credentials, secret keys, and database information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bottinelli.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51056 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-07T13:30:47.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploiting the insecure 'uploadPreviews()' custom function in '/api_vedo/colorways_preview', ultimately resulting in remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bottinelli.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51057 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-07T13:36:47.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bottinelli.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51058 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-07T13:37:57.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bottinelli.com - https://github.com/jacopoaugelli/vedo-suite-exploits
CVE ID: CVE-2025-51060 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T20:07:46.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CPUID cpuz.sys 1.0.5.4. An attacker can use DeviceIoControl with the unvalidated parameters 0x9C402440 and 0x9C402444 as IoControlCodes to perform RDMSR and WRMSR, respectively. Through this process, the attacker can modify MSR_LSTAR and hook KiSystemCall64. Afterward, using Return-Oriented Programming (ROP), the attacker can manipulate the stack with pre-prepared gadgets, disable the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been c
able the SMAP flag in the CR4 register, and execute a user-mode syscall handler in the kernel context. It has not been confirmed whether this works on 32-bit Windows, but it functions on 64-bit Windows if the core isolation feature is either absent or disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cpuid.com - http://cpuzsys.com - https://github.com/ZiaLib/Zmsr
CVE ID: CVE-2025-51082 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T19:43:06.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/fast_setting_wifi_set. The manipulation of the argument `timeZone` leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51082.md
CVE ID: CVE-2025-51085 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T19:43:55.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` and `timeType` leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51085.md
CVE ID: CVE-2025-51087 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T14:59:27.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51087.md
CVE ID: CVE-2025-51088 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T19:45:16.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet. The manipulation of the argument `shareSpeed` leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51088.md
CVE ID: CVE-2025-51089 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T19:46:41.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument `mac` leads to heap-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/TL-SN/IOT/blob/main/Tenda/Tenda-AC8v4%20%20V16.03.34.06/CVE-2025-51089.md
CVE ID: CVE-2025-51092 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:07.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://abimelsbk.hashnode.dev/sql-injection-vulnerabilit
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://abimelsbk.hashnode.dev/sql-injection-vulnerability-at-login-signup-php-project
CVE ID: CVE-2025-51281 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T14:50:35.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en`, `val and id parameters in the qj_asp function. This vulnerability allows authenticated attackers to cause a Denial of Service (DoS) by sending crafted GET requests with overly long values for these parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/BinaryHK/CVE/blob/main/CVE-2025-51281/CVE-2025-51281.md
CVE ID: CVE-2025-51306 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T19:22:47.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gatling.io/products - https://github.com/Flo354/vulnerabilities/tree/main/gatling-enterprise - https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51306-broken-logout.md - https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterp
/gatling-enterprise/CVE-2025-51306-broken-logout.md - https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51306-change-permissions-not-reflected.md
CVE ID: CVE-2025-51308 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T19:20:16.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, allowing him to collect some information, due to missing authorization checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gatling.io/products - https://github.com/Flo354/vulnerabilities/tree/main/gatling-enterprise - https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51308-broken-access-control.md
CVE ID: CVE-2025-51381 State: PUBLISHED Published: 2025-06-18T04:27:50.253Z Last Updated: 2025-06-18T13:56:08.664Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: KAON Products: KCM3100 Problem Types: CWE-288 Description: An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of the product from within the LAN to which the product is connected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://notices.jcom.co.jp/notice/93847.html - https://jvn.jp/en/jp/JVN46288336/
CVE ID: CVE-2025-51383 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T18:26:12.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/draw-hub/zMeedA/blob/master/CVE-2025-51383.md
CVE ID: CVE-2025-51384 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T18:30:34.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/draw-hub/zMeedA/blob/master/CVE-2025-51384.md
CVE ID: CVE-2025-51385 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T18:29:35.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8200 16.07.26A1 is vulnerable to Buffer Overflow in the yyxz_dlink_asp function via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/draw-hub/zMeedA/blob/master/CVE-2025-51385.md
CVE ID: CVE-2025-51387 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T13:44:34.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings were observed: RunAsNode is enabled and EnableNodeCliInspectArguments is not disabled. These configurations allow the application to be executed in Node.js mode, enabling attackers to pass arguments that result in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/r3ggi/electroniz3r - https://www.electronjs.or
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/r3ggi/electroniz3r - https://www.electronjs.org/blog/statement-run-as-node-cves#mitigation - https://packetstorm.news/files/id/207677
CVE ID: CVE-2025-51390 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T14:32:49.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://totolink.com - https://github.com/Luanruy/qianxin/blob/main/overflow-0x41ca08.md - https://github.com/Luanruy/qianxin/blob/main/CVE-2025-51390.md