Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62976 State: PUBLISHED Published: 2025-10-27T01:34:17.528Z Last Updated: 2025-11-13T10:33:48.598Z Vendors: Joovii Products: Sendle Shipping Problem Types: CWE-862 Description: Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/official-sendle-shipping-method/vulnerability/wordpress-sendle-shipping-plugin-6-02-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62977 State: PUBLISHED Published: 2025-10-27T01:34:17.906Z Last Updated: 2025-11-13T10:33:48.772Z Vendors: 沃之涛 Products: 百度站长SEO合集(支持百度/神马/Bing/头条推送) Problem Types: CWE-862 Description: Missing Authorization vulnerability in 沃之涛 百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 百度站长SEO合集(支持百度/神马/Bing/头条推送): from n/a through <= 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/baiduseo/vulnerability/wordpress-seo-bing-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62978 State: PUBLISHED Published: 2025-10-27T01:34:18.281Z Last Updated: 2025-11-13T10:33:48.705Z Vendors: Kiotviet Products: KiotViet Sync Problem Types: CWE-862 Description: Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/kiotvietsync/vulnerability/wordpress-kiotviet-sync-plugin-1-8-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62979 State: PUBLISHED Published: 2025-10-27T01:34:18.671Z Last Updated: 2025-11-13T10:33:48.608Z Vendors: airesvsg Products: ACF to REST API Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through <= 3.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/acf-to-rest-api/vulnerability/wordpress-acf-to-rest-api-plugin-3-3-4-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-62980 State: PUBLISHED Published: 2025-10-27T01:34:19.046Z Last Updated: 2025-11-13T10:33:48.757Z Vendors: MDZ Products: Persian Admnin Fonts Problem Types: CWE-862 Description: Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/persian-admin-fonts/vulnerability/wordpress-persian-admnin-fonts-plugin-4-1-03-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62981 State: PUBLISHED Published: 2025-10-27T01:34:19.548Z Last Updated: 2025-11-19T14:45:27.008Z Vendors: CRM Perks Products: WP Gravity Forms Zoho CRM and Bigin Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gf-zoho/vulnerability/wordpress-wp-gravity-forms-zoho-crm-and-bigin-plugin-1-2-8-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-62982 State: PUBLISHED Published: 2025-10-27T01:34:19.955Z Last Updated: 2025-11-19T14:45:11.030Z Vendors: Sarah Giles Products: Dynamic User Directory Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through <= 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62983 State: PUBLISHED Published: 2025-10-27T01:34:20.337Z Last Updated: 2025-11-13T10:33:48.824Z Vendors: Sudar Muthu Products: Posts By Tag Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu Posts By Tag posts-by-tag allows Stored XSS.This issue affects Posts By Tag: from n/a through <= 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/posts-by-tag/vulnerability/wordpress-posts-by-tag-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62984 State: PUBLISHED Published: 2025-10-27T01:34:20.717Z Last Updated: 2025-11-19T14:44:38.347Z Vendors: WPeka Products: WP AdCenter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpadcenter/vulnerability/wordpress-wp-adcenter-plugin-2-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62985 State: PUBLISHED Published: 2025-10-27T01:34:21.085Z Last Updated: 2025-11-13T10:33:49.043Z Vendors: llamaman Products: Simple Pull Quote Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in llamaman Simple Pull Quote simple-pull-quote allows Stored XSS.This issue affects Simple Pull Quote: from n/a through <= 1.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/simple-pull-quote/vulnerability/wordpress-simple-pull-quote-plugin-1-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62986 State: PUBLISHED Published: 2025-10-27T01:34:21.481Z Last Updated: 2025-11-13T10:33:49.052Z Vendors: FanBridge Products: FanBridge signup Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in FanBridge FanBridge signup fanbridge-signup allows Stored XSS.This issue affects FanBridge signup: from n/a through <= 0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/fanbridge-signup/vulnerability/wordpress-fanbridge-signup-plugin-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62987 State: PUBLISHED Published: 2025-10-27T01:34:21.954Z Last Updated: 2025-11-13T10:33:49.047Z Vendors: Builderall Products: Builderall Builder for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Stored XSS.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/builderall-cheetah-for-wp/vulnerability/wordpress-builderall-builder-for-wordpress-plugin-3-0-1-cro
ase/Wordpress/Plugin/builderall-cheetah-for-wp/vulnerability/wordpress-builderall-builder-for-wordpress-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62988 State: PUBLISHED Published: 2025-10-27T01:34:22.355Z Last Updated: 2025-11-13T10:33:49.048Z Vendors: Codeless Products: Slider Templates Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Codeless Slider Templates slider-templates allows Server Side Request Forgery.This issue affects Slider Templates: from n/a through <= 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/slider-templates/vulnerability/wordpress-slider-templates-plugin-1-0-3-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-63147 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-18T16:32:56.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/5/1.md
CVE ID: CVE-2025-63149 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:19:46.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/3/1.md
CVE ID: CVE-2025-63152 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:13:56.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/4/1.md
CVE ID: CVE-2025-63153 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:14:59.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/6/1.md
CVE ID: CVE-2025-63154 State: PUBLISHED Published: 2025-11-10T00:00:00.000Z Last Updated: 2025-11-12T20:16:14.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/4/1.md
CVE ID: CVE-2025-63205 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T16:10:24.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics Probe, and NOMAD, firmware versions 6.5.0-9, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bridgetech.tv/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63205_bridgetech%20probes%20Inf
getech.tv/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63205_bridgetech%20probes%20Information%20Disclosure
CVE ID: CVE-2025-63206 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T16:07:18.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dasansmc.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63206_Dasan%20Switch%20DS2924%20Authentication%20Bypass
CVE ID: CVE-2025-63207 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T16:06:04.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rvr.it/en/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63207_RVR%20Elettronica%20TEX
w.rvr.it/en/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63207_RVR%20Elettronica%20TEX%20Broken%20Access%20Control
CVE ID: CVE-2025-63208 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T15:36:05.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bridgetech.tv/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63208_bridgetech%20VB288%20Information%20Disclosure
CVE ID: CVE-2025-63209 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-19T18:31:47.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an information disclosure vulnerability allowing unauthenticated attackers to retrieve admin credentials and system settings via an unprotected /setup.xml endpoint. The admin password is stored in plaintext under the <p05> XML tag, potentially leading to remote compromise of the transmitter system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
emote compromise of the transmitter system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.elcaradio.com - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63209_ELCA%20Star%20Transmitter%20Remote%20Control%20-%20Information%20Disclosure
CVE ID: CVE-2025-63210 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-19T18:24:00.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit this issue by modifying intercepted responses from the /celoxservice endpoint. By injecting a forged response body during the loginWithUserName flow, the attacker can gain Superuser or Operator access without providing valid credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.newtec.com/ - https://github.com/shiky8/my--cve-vulne
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.newtec.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63210_Newtec%20Celox%20UHD%20Authentication%20Bypass%20_%20Privilege%20Escalation
CVE ID: CVE-2025-63211 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-21T15:53:30.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbitrary code via the addName parameter to the /vbc/core/userSetupDoc/userSetupDoc endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bridgetech.tv/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63211_bridgetech%20VBC%20Server%20and%20Element%20Manager%20Stored%20%20xss
CVE ID: CVE-2025-63212 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T21:02:43.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs and hijack sessions without providing any credentials. This attack requires the legitimate user (admin) to have previously closed the browser window without logging out. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.g
d the browser window without logging out. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gatesair.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63212%20_GatesAir%20Flexiva-LX%20Series%20_%20Session%20Hijacking
CVE ID: CVE-2025-63213 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-21T15:55:29.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inject arbitrary commands. These commands are executed with root privileges, allowing attackers to gain full control over the device. This poses a significant security risk to any device running this software. Additional Analyst
control over the device. This poses a significant security risk to any device running this software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://qvidium.tv/ - https://undercodetesting.com/zero-day-vulnerabilities-discovered-in-qvidium-opera11-remote-code-execution-rce-exploit/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63213_QVidium%20Opera11%20RCE
CVE ID: CVE-2025-63214 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-20T21:11:14.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to delete and create arbitrary accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bridgetech.tv/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63214_bridgetech%20VBC%20Server%20and%20Element%20Manager%20Broken%20Access%20Control
CVE ID: CVE-2025-63215 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T15:40:44.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sound4helpdesk.com/ - https://www.sound4helpdesk.com/impact-downloads/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CV
https://www.sound4helpdesk.com/impact-downloads/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63215%20_%20Sound4%20IMPACT%20%20RCE
CVE ID: CVE-2025-63216 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T14:46:56.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.itel.it/ - https://github.com/shiky8/my--cve-vulnerability-rese
otes: - CISA ADP Vulnrichment: References: - https://www.itel.it/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63216_Itel%20DAB%20Gateway%20Authentication%20Bypass
CVE ID: CVE-2025-63217 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T14:32:15.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.itel.it/ - https://github.com/shiky8/my--cve-vulnerability-research
: - CISA ADP Vulnrichment: References: - https://www.itel.it/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63217%20_%20Itel%20DAB%20MUX%20Authentication%20Bypass
CVE ID: CVE-2025-63218 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-19T15:14:03.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to full compromise of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axeltechnology.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree
nrichment: References: - https://www.axeltechnology.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63218_Axel%20Technology%20WOLF1MS%20and%20WOLF2MS%20-%20Broken%20Access%20Control
CVE ID: CVE-2025-63219 State: PUBLISHED Published: 2025-11-19T00:00:00.000Z Last Updated: 2025-11-19T21:36:02.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and compromise system integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.itel.it/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63219_ITEL%20ISO%20FM%20SFN%20Adapter%2
t/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63219_ITEL%20ISO%20FM%20SFN%20Adapter%20-%20Session%20Hijacking