Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ages that will execute whenever a user accesses an injected page. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe4774ee-16f2-478f-92e3-8a7da7b30336?source=cve - https://plugins.trac.wordpress.org/browser/telegram-bot/tags/4.1/columns.php#L45
CVE ID: CVE-2025-13069 State: PUBLISHED Published: 2025-11-18T09:27:37.930Z Last Updated: 2025-11-18T21:10:52.652Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ideastocode Products: Enable SVG, WebP, and ICO Upload Problem Types: CWE-434 Description: The Enable SVG, WebP, and ICO Upload plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.1.2. This is due to insufficient file type validation detecting ICO files, allowing double extension files with the appropriate magic bytes to bypass sanitization while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level ac
ation while being accepted as a valid ICO file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5716c4e1-a6d3-42e8-b90c-d16f204c8503?source=cve - https://wordpress.org/plugins/enable-svg-webp-ico-upload/
CVE ID: CVE-2025-13075 State: PUBLISHED Published: 2025-11-12T22:32:05.898Z Last Updated: 2025-11-13T14:35:15.232Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing manipulation of the argument eid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332206 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332206 - https://vuldb.com/?ctiid.332206 - https://vuldb.com/?submit.682856 - https://github.com/zhizi1234/cve/blob/main/tmp69/tmp69/report.md - https://code-projects.org/
CVE ID: CVE-2025-13076 State: PUBLISHED Published: 2025-11-12T23:02:06.294Z Last Updated: 2025-11-13T14:35:09.744Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Responsive Hotel Site Problem Types: CWE-89, CWE-74 Description: A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing manipulation of the argument usname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332207 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332207 - https://vuldb.com/?ctiid.332207 - https://vuldb.com/?submit.682867 - https://github.com/zhizi1234/cve/blob/main/tmp70/report.md - https://code-projects.org/
CVE ID: CVE-2025-13080 State: PUBLISHED Published: 2025-11-18T16:54:32.042Z Last Updated: 2025-11-18T20:35:16.717Z Vendors: Drupal Products: Drupal core Problem Types: CWE-754 Description: Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-005
CVE ID: CVE-2025-13081 State: PUBLISHED Published: 2025-11-18T16:54:56.214Z Last Updated: 2025-11-19T04:55:19.564Z Vendors: Drupal Products: Drupal core Problem Types: CWE-915 Description: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-006
CVE ID: CVE-2025-13082 State: PUBLISHED Published: 2025-11-18T16:55:16.062Z Last Updated: 2025-11-18T20:32:44.139Z Vendors: Drupal Products: Drupal core Problem Types: CWE-451 Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-007
CVE ID: CVE-2025-13083 State: PUBLISHED Published: 2025-11-18T16:55:37.269Z Last Updated: 2025-11-18T20:31:36.720Z Vendors: Drupal Products: Drupal core Problem Types: CWE-525 Description: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2025-008
CVE ID: CVE-2025-13085 State: PUBLISHED Published: 2025-11-19T06:45:25.339Z Last Updated: 2025-11-19T18:58:55.375Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: softaculous Products: SiteSEO – SEO Simplified Problem Types: CWE-285 Description: The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by
enticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740b
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d740ba8-4877-4b27-a1cb-26095f851ea6?source=cve - https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/ajax.php#L542 - https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/titlesmetas.php#L494 - https://plugins.trac.wordpress.org/browser/siteseo/trunk/main/admin.php#L106 - https://plugins.trac.wordpress.org/changeset/3397272/siteseo/trunk?contextall=1&old=3387094&old_path=%2Fsiteseo%2Ftrunk
CVE ID: CVE-2025-13087 State: PUBLISHED Published: 2025-11-20T21:32:37.510Z Last Updated: 2025-11-21T16:01:40.324Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Opto22 Products: GRV-EPIC-PR1, GRV-EPIC-PR2, groov RIO GRV-R7-MM1001-10, groov RIO GRV-R7-MM2001-10, groov RIO GRV-R7-I1VAPM-3 Problem Types: CWE-78 Description: A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code execution with root privileges. When a POST request is executed against the vulnerable endpoint, the application reads certain header details and unsafely uses these values to build commands, allowing an attacker with admin
plication reads certain header details and unsafely uses these values to build commands, allowing an attacker with administrative privileges to inject arbitrary commands that execute as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-03 - https://www.opto22.com/support/resources-tools/knowledgebase/kb91326 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-03.json
CVE ID: CVE-2025-13088 State: PUBLISHED Published: 2025-11-18T08:27:36.700Z Last Updated: 2025-11-18T21:05:36.780Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ikhodal Products: Category and Product Woocommerce Tabs Problem Types: CWE-98 Description: The Category and Product Woocommerce Tabs plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0. This is due to insufficient input validation on the 'template' parameter in the categoryProductTab() function. This makes it possible for authenticated attackers, with contributor level access and above, to include and execute arbitrary .php files on the server. Additio
d attackers, with contributor level access and above, to include and execute arbitrary .php files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3938bbb-dc3d-4550-a05d-0cde970e38f8?source=cve - https://plugins.trac.wordpress.org/browser/category-and-product-woocommerce-tabs/tags/1.0/include/wccategorytab.php#L108
CVE ID: CVE-2025-13097 State: PUBLISHED Published: 2025-11-14T02:29:54.212Z Last Updated: 2025-11-14T14:44:31.876Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html - https://issues.chromium.org/issues/402791076
CVE ID: CVE-2025-13102 State: PUBLISHED Published: 2025-11-14T02:29:56.903Z Last Updated: 2025-11-14T16:07:44.247Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/351564774
CVE ID: CVE-2025-13107 State: PUBLISHED Published: 2025-11-14T02:29:58.900Z Last Updated: 2025-11-14T15:35:36.673Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/429440615
CVE ID: CVE-2025-13114 State: PUBLISHED Published: 2025-11-13T13:32:06.750Z Last Updated: 2025-11-13T13:56:17.637Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: macrozheng Products: mall-swarm Problem Types: CWE-285, CWE-266 Description: A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
rly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332319 - https://vuldb.com/?ctiid.332319 - https://vuldb.com/?submit.683221 - https://github.com/Hwwg/cve/issues/5
CVE ID: CVE-2025-13115 State: PUBLISHED Published: 2025-11-13T13:32:09.111Z Last Updated: 2025-11-15T06:19:23.088Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: macrozheng Products: mall-swarm, mall Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted e
itiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332320 - https://vuldb.com/?ctiid.332320 - https://vuldb.com/?submit.683222 - https://vuldb.com/?submit.686528 - https://github.com/Hwwg/cve/issues/6 - https://github.com/Hwwg/cve/issues/11
CVE ID: CVE-2025-13116 State: PUBLISHED Published: 2025-11-13T14:02:05.516Z Last Updated: 2025-11-15T06:19:26.073Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: macrozheng Products: mall-swarm, mall Problem Types: CWE-285, CWE-266 Description: A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not
n made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332321 - https://vuldb.com/?ctiid.332321 - https://vuldb.com/?submit.683339 - https://vuldb.com/?submit.686530 - https://github.com/Hwwg/cve/issues/8 - https://github.com/Hwwg/cve/issues/13
CVE ID: CVE-2025-13117 State: PUBLISHED Published: 2025-11-13T14:32:06.265Z Last Updated: 2025-11-15T06:19:29.104Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: macrozheng Products: mall-swarm, mall Problem Types: CWE-285, CWE-266 Description: A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the file /order/cancelOrder. The manipulation of the argument orderId leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond
t has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332322 - https://vuldb.com/?ctiid.332322 - https://vuldb.com/?submit.683340 - https://vuldb.com/?submit.686529 - https://github.com/Hwwg/cve/issues/7 - https://github.com/Hwwg/cve/issues/12
CVE ID: CVE-2025-13118 State: PUBLISHED Published: 2025-11-13T15:02:05.419Z Last Updated: 2025-11-15T06:19:32.172Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: macrozheng Products: mall-swarm, mall Problem Types: CWE-285, CWE-266 Description: A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes:
be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332323 - https://vuldb.com/?ctiid.332323 - https://vuldb.com/?submit.683345 - https://vuldb.com/?submit.686531 - https://github.com/Hwwg/cve/issues/9 - https://github.com/Hwwg/cve/issues/14
CVE ID: CVE-2025-13119 State: PUBLISHED Published: 2025-11-13T15:02:07.963Z Last Updated: 2025-11-13T15:38:15.829Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Fabian Ros, SourceCodester Products: Simple E-Banking System Problem Types: CWE-352, CWE-862 Description: A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332324 - https://vuldb.com/?ctiid.332324 - https://vuldb.com/?subm
ADP Vulnrichment: References: - https://vuldb.com/?id.332324 - https://vuldb.com/?ctiid.332324 - https://vuldb.com/?submit.683335 - https://github.com/i4G5d/CRITICAL-SECURITY-VULNERABILITY-REPORT-CSRF-Forced-Withdrawal
CVE ID: CVE-2025-13120 State: PUBLISHED Published: 2025-11-13T15:32:07.825Z Last Updated: 2025-11-13T16:20:19.005Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: mruby Problem Types: CWE-416, CWE-119 Description: A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue. Additional Analyst Notes:
1bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332325 - https://vuldb.com/?ctiid.332325 - https://vuldb.com/?submit.683435 - https://github.com/mruby/mruby/issues/6649 - https://github.com/makesoftwaresafe/mruby/pull/263 - https://github.com/mruby/mruby/issues/6649#issue-3534393003 - https://github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bc
CVE ID: CVE-2025-13121 State: PUBLISHED Published: 2025-11-13T16:32:06.206Z Last Updated: 2025-11-13T18:49:16.750Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: cameasy Products: Liketea Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in cameasy Liketea 1.0.0. Impacted is the function list of the file laravel/app/Http/Controllers/Front/StoreController.php of the component API Endpoint. Such manipulation of the argument lng/lat leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
as been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332349 - https://vuldb.com/?ctiid.332349 - https://vuldb.com/?submit.683659 - https://github.com/ictrun/liketea-sql-injection/blob/main/README.md - https://github.com/ictrun/liketea-sql-injection/blob/main/README.md#proof-of-concept
CVE ID: CVE-2025-13122 State: PUBLISHED Published: 2025-11-13T18:02:05.673Z Last Updated: 2025-11-13T19:34:41.727Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C) Vendors: SourceCodester Products: Patients Waiting Area Queue Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of the file /php/api_patient_checkin.php. Performing manipulation of the argument appointmentID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Note
tion. It is possible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332350 - https://vuldb.com/?ctiid.332350 - https://vuldb.com/?submit.683789 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13123 State: PUBLISHED Published: 2025-11-13T19:02:06.768Z Last Updated: 2025-11-13T19:36:38.742Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: AMTT Products: Hotel Broadband Operation System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Executing manipulation of the argument uid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
blished and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332351 - https://vuldb.com/?ctiid.332351 - https://vuldb.com/?submit.683824 - https://github.com/R178/cve/issues/2
CVE ID: CVE-2025-13130 State: PUBLISHED Published: 2025-11-13T22:02:05.548Z Last Updated: 2025-11-14T15:24:32.425Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R) Vendors: n/a Products: Radarr Problem Types: CWE-276, CWE-266 Description: A vulnerability has been found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of the component Service. Such manipulation leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vuln
ndor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332361 - https://vuldb.com/?ctiid.332361 - https://vuldb.com/?submit.683876 - https://github.com/lakshayyverma/CVE-Discovery/blob/main/Radarr.md
CVE ID: CVE-2025-13131 State: PUBLISHED Published: 2025-11-13T22:02:07.748Z Last Updated: 2025-11-14T15:58:36.445Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:C) Vendors: n/a Products: Sonarr Problem Types: CWE-276, CWE-266 Description: A vulnerability was found in Sonarr 4.0.15.2940. The impacted element is an unknown function of the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe of the component Service. Performing manipulation results in incorrect default permissions. The attack is only possible with local access. The vendor confirms this vulnerability but classifies it as a "low severity issue due to the default service user being used as it would