Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8864 State: PUBLISHED Published: 2025-08-11T13:30:09.039Z Last Updated: 2025-08-11T15:05:42.481Z Vendors: YugabyteDB Inc Products: YugabyteDB Anywhere Problem Types: CWE-532 Description: Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE ID: CVE-2025-8865 State: PUBLISHED Published: 2025-08-11T14:19:02.960Z Last Updated: 2025-08-11T15:04:04.232Z Vendors: YugabyteDB Inc Products: YugabyteDB Problem Types: CWE-476 Description: The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An authenticated attacker could exploit this issue to crash the YCQL tablet server, resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE ID: CVE-2025-8866 State: PUBLISHED Published: 2025-08-11T16:25:35.897Z Last Updated: 2025-08-11T17:11:02.446Z Vendors: YugabyteDB Inc Products: YugabyteDB Anywhere Problem Types: CWE-200 Description: YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.yugabyte.com/preview/secure/vulnerability-disclosure-policy/
CVE ID: CVE-2025-8867 State: PUBLISHED Published: 2025-08-15T02:24:23.590Z Last Updated: 2025-08-15T12:43:06.858Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: iqonicdesign Products: Graphina – Elementor Charts and Graphs Problem Types: CWE-79 Description: The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories, titles, and tooltip settings. This makes it possible for authenticated attackers, with contributor-level access
gories, titles, and tooltip settings. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae7f76ef-3f97-4889-8902-f13a4a298475?source=cve - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/AreaChart.php#L156 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/ColumnCha
wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/ColumnChart.php#L183 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/LineChart.php#L186 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/ScatterChart.php#L181 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/RadarChart.php#L182 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/E
Chart.php#L182 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/HeatmapChart.php#L173 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/DistributeColumnChart.php#L179 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/includes/Charts/Elementor/Elements/ApexCharts/TimelineChart.php#L173 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343408%40graphina-elementor-charts-and-graphs&new=3343408%40graphina-elementor-charts-and-graphs&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8868 State: PUBLISHED Published: 2025-09-29T11:29:50.463Z Last Updated: 2025-09-29T12:55:02.884Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Chef Automate Problem Types: CWE-200, CWE-89 Description: In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.chef.io/release_notes_automate/#4.13.295
CVE ID: CVE-2025-8869 State: PUBLISHED Published: 2025-09-24T14:56:56.027Z Last Updated: 2025-11-03T17:45:31.574Z Vendors: Python Packaging Authority Products: pip Description: When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Pytho
action for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pypa/pip/pull/13550 - https://mail.python
SA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pypa/pip/pull/13550 - https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN/
CVE ID: CVE-2025-8870 State: PUBLISHED Published: 2025-11-14T15:57:04.673Z Last Updated: 2025-11-14T16:29:13.516Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Arista Networks Products: EOS Problem Types: CWE-248 Description: On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/22811-security-advisory-0125
CVE ID: CVE-2025-8871 State: PUBLISHED Published: 2025-11-05T02:25:52.044Z Last Updated: 2025-11-05T18:56:40.395Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: WPEverest Products: Everest Forms Pro Problem Types: CWE-502 Description: The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_content_type() function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a non-required signature form field along wit
oited by unauthenticated attackers when a form is present on the site with a non-required signature form field along with an image upload field. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only exploitable in PHP versions prior to 8. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
erability is only exploitable in PHP versions prior to 8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/11d45287-f875-4cc9-aaf6-47158fe32858?source=cve - https://everestforms.net/changelog/
CVE ID: CVE-2025-8874 State: PUBLISHED Published: 2025-08-12T06:42:41.228Z Last Updated: 2025-08-12T20:06:12.559Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litonice13 Products: Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Problem Types: CWE-79 Description: The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.0.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a
ncluding, 2.0.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44e4fb1b-eed4-4ef9-9856-7c5095117aa7?source=cve - https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/vendor/fancybox/jquery.fancybox.min.js - https://plugins.trac.wordpress.org/log/master-addons/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=334012
rdpress.org/log/master-addons/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340128%40master-addons&new=3340128%40master-addons&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338452%40master-addons&new=3338452%40master-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8875 State: PUBLISHED Published: 2025-08-14T14:56:11.884Z Last Updated: 2025-10-21T22:45:20.745Z Vendors: N-able Products: N-central Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/
CVE ID: CVE-2025-8876 State: PUBLISHED Published: 2025-08-14T14:53:55.176Z Last Updated: 2025-10-21T22:45:20.929Z Vendors: N-able Products: N-central Problem Types: CWE-20 Description: Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/
CVE ID: CVE-2025-8877 State: PUBLISHED Published: 2025-09-30T08:25:20.251Z Last Updated: 2025-09-30T17:17:25.813Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AffiliateWP Products: AffiliateWP Problem Types: CWE-89 Description: The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitiv
henticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae32a38-5be3-47d0-9c56-2fcda7662c71?source=cve - https://affiliatewp.com
CVE ID: CVE-2025-8878 State: PUBLISHED Published: 2025-08-16T11:11:24.022Z Last Updated: 2025-08-18T18:04:35.028Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: properfraction Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Problem Types: CWE-94 Description: The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.4. This is due to the software allowing users to execute an action that does not properly
ons up to, and including, 4.16.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9309b8bf-f581-4a56-a1ed-3941ebb36127?source=cve - https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/Classes/RegistrationAuth.php#L131 - https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L318 - https://plugins.trac.wordpress.org/browser/w
-avatar/trunk/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L318 - https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L329 - https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L339 - https://plugins.trac.wordpress.org/browser/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FrontendProfileBuilder.php#L385 - https://plugins.trac.wordpress.org/changeset/3345295/
CVE ID: CVE-2025-8879 State: PUBLISHED Published: 2025-08-13T02:43:43.287Z Last Updated: 2025-08-28T16:37:24.408Z Vendors: Google Products: Chrome Problem Types: CWE-122 Description: Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/432035817
CVE ID: CVE-2025-8880 State: PUBLISHED Published: 2025-08-13T02:43:43.711Z Last Updated: 2025-08-14T03:55:30.740Z Vendors: Google Products: Chrome Problem Types: CWE-362 Description: Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/433533359
CVE ID: CVE-2025-8881 State: PUBLISHED Published: 2025-08-13T02:43:44.561Z Last Updated: 2025-08-13T20:01:13.370Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/433800617
CVE ID: CVE-2025-8882 State: PUBLISHED Published: 2025-08-13T02:43:45.162Z Last Updated: 2025-08-14T03:55:12.479Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/435623339
CVE ID: CVE-2025-8884 State: PUBLISHED Published: 2025-10-20T14:36:31.700Z Last Updated: 2025-10-20T14:47:56.025Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: VHS Electronic Software Ltd. Co. Products: ACE Center Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers.This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0348
CVE ID: CVE-2025-8885 State: PUBLISHED Published: 2025-08-12T09:13:42.770Z Last Updated: 2025-09-12T11:09:08.850Z Vendors: Legion of the Bouncy Castle Inc. Products: BC Java, BC-FJA Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BC-FJA bc-fips on All allows Excessive Allocation. This vulnerability is associated with program files https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifi
N1ObjectIdenti... https://github.com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java . This issue affects BC Java: from 1.0 through 1.77; BC-FJA: from 1.0.0 through 1.0.2.5, from 2.0.0 through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%908885
CVE ID: CVE-2025-8886 State: PUBLISHED Published: 2025-10-10T13:48:28.078Z Last Updated: 2025-10-10T19:11:17.424Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Usta Information Systems Inc. Products: Aybs Interaktif Problem Types: CWE-732, CWE-200, CWE-862, CWE-863 Description: Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass.This issue affects Aybs Interaktif: from 2024 through 28082025. Additional Analyst Notes: - CISA ADP Vulnrichment:
ypass.This issue affects Aybs Interaktif: from 2024 through 28082025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0329
CVE ID: CVE-2025-8887 State: PUBLISHED Published: 2025-10-10T13:56:07.123Z Last Updated: 2025-10-10T19:12:02.062Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Usta Information Systems Inc. Products: Aybs Interaktif Problem Types: CWE-639, CWE-862, CWE-200 Description: Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation.This issue affects Aybs Interaktif: from 2024 through 28082025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ue affects Aybs Interaktif: from 2024 through 28082025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0329
CVE ID: CVE-2025-8889 State: PUBLISHED Published: 2025-09-09T06:00:08.095Z Last Updated: 2025-11-13T20:58:02.324Z Vendors: Unknown Products: Compress & Upload Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5d84a577-62aa-4aa2-ac39-b146eae65243/
CVE ID: CVE-2025-8891 State: PUBLISHED Published: 2025-08-13T03:42:03.487Z Last Updated: 2025-08-26T15:16:23.274Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: oceanwp Products: OceanWP Problem Types: CWE-352 Description: The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA
ey can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6f9a3d-54a6-4405-b42b-37fc8342af96?source=cve - https://themes.trac.wordpress.org/changeset/283264/oceanwp/4.1.2/inc/activation-notice/api.php - https://research.cleantalk.org/cve-2025-8891/
CVE ID: CVE-2025-8892 State: PUBLISHED Published: 2025-09-22T19:01:28.720Z Last Updated: 2025-11-07T15:30:06.556Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components Problem Types: CWE-120 Description: A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0019
CVE ID: CVE-2025-8893 State: PUBLISHED Published: 2025-09-16T14:17:05.441Z Last Updated: 2025-10-06T15:19:18.552Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit, Revit LT, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD MAP 3D, Civil 3D, Advance Steel, AutoCAD LT Problem Types: CWE-787 Description: A maliciously crafted PDF file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current proces
is vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0018