Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ault. In versions prior to 4.2, no such user-level protection is in place, only basic IP-based rate limiting is enforced. This IP-based protection can be bypassed by distributing requests across multiple IPs (e.g., rotating IP or proxies). Effectively bypassing both login and password reset security controls. Successful exploitation allows an attacker to enumerate valid email addresses registered for the application, increasing the risk of follow-up attacks such as password spraying. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.liquidfiles.com/release_notes/version_4-2-x.html - https://www.liquidfiles.com/updates/v4.2.html
CVE ID: CVE-2025-56139 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T20:16:03.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different URL, which can be malicious. This UI misrepresentation enables attackers to deceive users by displaying trusted previews for harmful links, facilitating phishing attacks and user confusion. Additional Analyst Notes: - CISA ADP Vu
ed previews for harmful links, facilitating phishing attacks and user confusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hdhrmi.blogspot.com/2025/07/aiman-al-hadhrami-linkedin-vulnerability.html - https://hdhrmi.blogspot.com/2025/09/link-preview-mismatch-cve-2025-56139.html
CVE ID: CVE-2025-56146 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-10-28T20:14:13.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@parvbajaj2000/cve-2025-56146-missing-ssl-certificate-validation-in-indian-bank-indsmart-android-app-9db200ac1c69
CVE ID: CVE-2025-56154 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T18:14:51.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/danpros/htmly/releases/tag/v3.0.9#:~:text=Security%20fixes%20found%20in%20version%203.0.8 - https://gist.github.com/akinerkisa/28e97fa132b1a98cff5d05a79b437901
CVE ID: CVE-2025-56161 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T18:13:36.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields (bcrypt password hash, mobile number, pay_money, expend_money.) are exposed in JSON responses. Route names vary per deployment (e.g. /api/goods.pinglun/list), but all call the same vulnerable model logic. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ods.pinglun/list), but all call the same vulnerable model logic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/xany/yoshop2.0 - https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56161.md
CVE ID: CVE-2025-56162 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T19:26:40.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw('field(goods_id, ...)'), allowing attackers to: (a) enumerate or modify database data, including dumping admin password hashes; (b) write web-shell files or invoke xp_cmdshell, leading to remote code execution on servers configured with sufficient DB privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee
configured with sufficient DB privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/xany/yoshop2.0 - https://github.com/ZyWAC/CVE-Disclosures/blob/6b337a44934ffe948275995e9b79158e97c78fc4/2025/YOSHOP2.0/CVE-2025-56162.md
CVE ID: CVE-2025-56200 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:36:11.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://validatorjs.com - https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596 - https://github.com/validatorjs/v
//validatorjs.com - https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596 - https://github.com/validatorjs/validator.js - https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666
CVE ID: CVE-2025-56207 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-10-01T20:02:53.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows users or attackers to transfer NFTs to the zero address, leading to permanent asset loss and non-compliance with the ERC721 standard. The eth address is 0x41d3d86a84c8507a7bc14f2491ec4d188fa944e7, contract name is MoneyMakingOpportunity, and compiler version is v0.8.17+commit.8df45f5f. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
unity, and compiler version is v0.8.17+commit.8df45f5f. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Monekon/CVE/blob/main/Vulnerabilities/MMO_Transfer_to_ZeroAddress.md
CVE ID: CVE-2025-56212 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T13:37:12.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-11896/20b47e0ff9d894d
CVE ID: CVE-2025-56214 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T13:35:10.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-11996/43458c7f19aa2e0
CVE ID: CVE-2025-56215 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T15:50:37.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in contact.php via the pagetitle parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-11976/fdd8631102e9985
CVE ID: CVE-2025-56216 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T15:04:52.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-11876/0a7da72fe66f76a
CVE ID: CVE-2025-56218 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-20T19:57:59.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ascertia.com - http://signinghub.com - https://github.com/saykino/CVE-2025-56218
CVE ID: CVE-2025-56219 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T15:53:18.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhaustion and a Denial of Service (DoS) when an excessively large number of user accounts are created. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ascertia.com - http://signinghub.com - https://github.com/saykino/CVE-2025-56219
CVE ID: CVE-2025-56221 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-17T19:02:49.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/saykino/CVE-2025-56221
CVE ID: CVE-2025-56223 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T15:16:50.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) via uploading an excessive number of files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ascertia.com - http://signinghub.com - https://github.com/saykino/CVE-2025-56223
CVE ID: CVE-2025-56224 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T15:50:41.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ascertia.com - http://signinghub.com - https://github.com/saykino/CVE-2025-56224
CVE ID: CVE-2025-56230 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T21:38:15.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/CVE-2025-56230-1a74e9f2a40d80dca0a2d0615dc7ac5a
CVE ID: CVE-2025-56231 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T20:24:57.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tonec.com - https://www.notion.so/CVE-2025-56231-2a04e9f2a40d80b184f4d02be58d3600
CVE ID: CVE-2025-56232 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-06T21:22:57.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle (MitM) attack to intercept update requests and replace installer or update packages with malicious files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://youtu.be/WchHCmqGaFQ - https://www.notion.so/CVE-2025-56232-2a04e9f2a40d80dab203e39b5c9462f6
CVE ID: CVE-2025-56233 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-10-28T20:20:41.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. For the processing of TCP packets with RST or SYN flag set, Openindiana has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within the current receive window, which violates RFC5961. This flaw allows attackers to send multiple random TCP RST/SYN packets to hit the acceptable range of sequence numbers, thereby interrupting normal connections and causing a
RST/SYN packets to hit the acceptable range of sequence numbers, thereby interrupting normal connections and causing a denial of service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zq-star/TCP-Vuln-Report/blob/master/Openindiana%20minimal/tcp-rst-syn/openindiana-minimal-tcp-rst-syn.md
CVE ID: CVE-2025-56234 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-10-28T20:21:58.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: AT_NA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC AT_NA2000 has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within the current receive window, which violates RFC5961. This flaw allows attackers to send multiple random TCP RST packets to hit the acceptable range of sequence numbers, thereby interrupting normal connections and causing a deni
RST packets to hit the acceptable range of sequence numbers, thereby interrupting normal connections and causing a denial-of-service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zq-star/TCP-Vuln-Report/blob/master/PLC/AT-NA2000/tcp-rst/at-na2000-tcp-rst.md
CVE ID: CVE-2025-56236 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:03:21.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FormCms/FormCms/issues/27 - https://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md
CVE ID: CVE-2025-56241 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-11-17T18:31:46.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/52093 - https://github.com/amirhosseinjamshidi64/Aztech-POC - https://gist.github.com/amirhosseinjamshidi64/cca123a0dda5a17f3708ffc2dd2a7a45
CVE ID: CVE-2025-56243 State: PUBLISHED Published: 2025-10-07T00:00:00.000Z Last Updated: 2025-10-07T18:55:27.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event_id GET parameter is improperly handled. An attacker can craft a malicious URL to execute arbitrary JavaScript in the victim s browser by injecting code into this parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/hafizgemilang/a75cbf48883881e0b27d33c67906d9d6
CVE ID: CVE-2025-56252 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T19:11:11.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/fir3storm/5a9c367b4fc1efbc444d72d800c175bb
CVE ID: CVE-2025-56254 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T13:32:31.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rishb0/CVEs-Assigned/blob/main/CVE-2025-56254.md
CVE ID: CVE-2025-56263 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T13:54:59.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/by-night/sms/issues/50 - https://github.com/echo0d/vulnerability/blob/main/by-night_sms/fileUpload.md
CVE ID: CVE-2025-56264 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T15:12:22.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/echo0d/vulnerability/blob/main/zhangyd-c_OneBlog/DoS.md
CVE ID: CVE-2025-56265 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T18:35:33.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1 - https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload - https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFi
trictedFileUpload - https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSviaUnristrictedFileUpload.txt
CVE ID: CVE-2025-56266 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T18:46:33.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/AvigilonACM_v7.10.0.20/ - https://github.com/nikolas-ch/CVEs/tree/main/AvigilonACM_v7.10.0.20/HostHeaderInjection - https://github.com/nikolas-ch/CVEs/blob/main/AvigilonACM_v7.10.0.20/HostHeaderInjection/HostHeaderInjection.txt
CVE ID: CVE-2025-56267 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T18:36:43.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/AvigilonACM_v7.10.0.20 - https://github.com/nikolas-ch/CVEs/tree/main/AvigilonACM_v7.10.0.20/CSV_Injection - https://github.com/nikolas-ch/CVEs/blob/main/AvigilonACM_v7.10.0.20/CSV_Injection/CSV_Injection.txt
CVE ID: CVE-2025-56274 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-16T17:27:38.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high privileged (such as admin) sessions and perform sensitive operations such as adding new users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://sourcecodester.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56274.md
CVE ID: CVE-2025-56276 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T18:33:15.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. An attacker enters malicious JavaScript code as a username, which triggers the XSS vulnerability when the admin views user information, resulting in the disclosure of the admin's cookie information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code-projects.org/food-ordering-review-system-in-php-with-source-code/ - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56276.md
CVE ID: CVE-2025-56280 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T17:27:23.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code-projects.org/food-ordering-review-system-in-php-with-source-code/ - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56280.md
CVE ID: CVE-2025-56289 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T18:33:09.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Document Management System 1.0 has a Cross Site Scripting (XSS) vulnerability, where attackers can leak admin's cookie information by entering malicious XSS code in the Company field when adding files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56289.md
CVE ID: CVE-2025-56293 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T18:33:04.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Human Resource Integrated System 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section in the Childs Name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56293.md
CVE ID: CVE-2025-56295 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T18:32:58.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying personal avatar information and use web shell connection tools to obtain server permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://code-projects.com - https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56295.md