Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325200 - https://vuldb.com/?ctiid.325200 - https://vuldb.com/?submit.657126 - https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC21/Tenda%20AC21%20Buffer%20overflow.md - https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC21/Tenda%20AC21%20Buffer%20overflow.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-10839 State: PUBLISHED Published: 2025-09-23T04:32:10.221Z Last Updated: 2025-09-23T19:12:58.011Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Pet Grooming Management Software Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References
loit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325201 - https://vuldb.com/?ctiid.325201 - https://vuldb.com/?submit.657156 - https://github.com/para-paradise/webray.com.cn/blob/main/Pet%20Grooming%20Management/SourceCodester%20Pet%20Grooming%20Management%20Software%20inv-print.php%20sql%20injection%20Vulnerability.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-10840 State: PUBLISHED Published: 2025-09-23T05:02:06.841Z Last Updated: 2025-09-23T19:13:39.476Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Pet Grooming Management Software Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325202 - https://vuldb.com/?ctiid.325202 - https://vuldb.com/?submit.657158 - https://github.com/xiaoliyu-1/Pet-grooming-management-print-payment.php-v.1.0-Unauthorized-sql-injection/blob/main/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-10841 State: PUBLISHED Published: 2025-09-23T05:32:37.237Z Last Updated: 2025-09-23T19:15:42.635Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325203 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325203 - https://vuldb.com/?ctiid.325203 - https://vuldb.com/?submit.657195 - https://github.com/fengzipan/cve/blob/master/tmp30/tmp30/report.md - https://code-projects.org/
CVE ID: CVE-2025-10842 State: PUBLISHED Published: 2025-09-23T06:02:05.580Z Last Updated: 2025-09-23T19:16:46.781Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/wew.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325204 - https://vuldb.com/?ctiid.32520
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325204 - https://vuldb.com/?ctiid.325204 - https://vuldb.com/?submit.657196 - https://github.com/fengzipan/cve/blob/main/tmp29/tmp29/report.md - https://code-projects.org/
CVE ID: CVE-2025-10843 State: PUBLISHED Published: 2025-09-23T06:02:09.227Z Last Updated: 2025-09-23T19:17:13.317Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Reservation Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/paypalpayout.php. Executing manipulation of the argument confirm can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
e exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325205 - https://vuldb.com/?ctiid.325205 - https://vuldb.com/?submit.657389 - https://github.com/xingrenlvke/cve/issues/10
CVE ID: CVE-2025-10844 State: PUBLISHED Published: 2025-09-23T06:32:06.651Z Last Updated: 2025-11-04T20:38:00.394Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325206 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325206 - https://vuldb.com/?ctiid.325206 - https://vuldb.com/?submit.657687 - https://karinagante.github.io/cve-2025-10844/ - https://karinagante.github.io/cve-2025-10844/#proof-of-concept-poc
CVE ID: CVE-2025-10845 State: PUBLISHED Published: 2025-09-23T06:32:08.902Z Last Updated: 2025-10-27T23:23:57.367Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325207 - https://vuldb.com/?ctiid.325207 - https://vuldb.c
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325207 - https://vuldb.com/?ctiid.325207 - https://vuldb.com/?submit.657688 - https://karinagante.github.io/cve-2025-10845/ - https://karinagante.github.io/cve-2025-10845/#proof-of-concept-poc
CVE ID: CVE-2025-10846 State: PUBLISHED Published: 2025-09-23T07:02:05.303Z Last Updated: 2025-10-27T23:24:09.769Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325208 - https://vuldb
utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325208 - https://vuldb.com/?ctiid.325208 - https://vuldb.com/?submit.657691 - https://karinagante.github.io/cve-2025-10846/ - https://karinagante.github.io/cve-2025-10846/#proof-of-concept-poc
CVE ID: CVE-2025-10847 State: PUBLISHED Published: 2025-10-01T10:48:12.150Z Last Updated: 2025-10-03T03:55:34.798Z Vendors: Broadcom Products: Unified Infrastructure Management Description: DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36180
CVE ID: CVE-2025-10848 State: PUBLISHED Published: 2025-09-23T07:32:08.552Z Last Updated: 2025-09-23T19:19:52.442Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Society Membership Information System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.php. Such manipulation of the argument student_id leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
s publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325209 - https://vuldb.com/?ctiid.325209 - https://vuldb.com/?submit.657937 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/mri9nrk1lh7ev7r6?singleDoc - https://www.campcodes.com/
CVE ID: CVE-2025-10849 State: PUBLISHED Published: 2025-10-16T06:47:30.601Z Last Updated: 2025-10-16T15:37:03.528Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: RiceTheme Products: Felan Framework Problem Types: CWE-862 Description: The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate or deactivate arbitrary plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-i
e arbitrary plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5abd601-132a-4d8b-bfcc-afd5c6ed9947?source=cve - https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955
CVE ID: CVE-2025-10850 State: PUBLISHED Published: 2025-10-16T06:47:30.221Z Last Updated: 2025-10-16T15:37:09.849Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RiceTheme Products: Felan Framework Problem Types: CWE-798 Description: The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change
s to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve - https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955
CVE ID: CVE-2025-10851 State: PUBLISHED Published: 2025-09-23T08:02:08.782Z Last Updated: 2025-09-23T19:33:51.513Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
he public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325210 - https://vuldb.com/?ctiid.325210 - https://vuldb.com/?submit.657939 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/esau5fkdf0upv8s6?singleDoc - https://www.campcodes.com/
CVE ID: CVE-2025-10853 State: PUBLISHED Published: 2025-11-05T19:21:32.971Z Last Updated: 2025-11-05T19:58:21.875Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: WSO2 Products: WSO2 Open Banking IAM, WSO2 API Manager, WSO2 Identity Server, WSO2 Open Banking AM, WSO2 Identity Server as Key Manager, WSO2 Enterprise Integrator, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Traffic Manager, org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui, org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui, org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui, org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui
:org.wso2.carbon.governance.wsdltool.ui, org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking. Additional Ana
ed sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4486/
CVE ID: CVE-2025-10854 State: PUBLISHED Published: 2025-09-22T12:04:51.805Z Last Updated: 2025-09-22T12:25:15.720Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-61 Description: The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhere in the filesystem when txtai is used to load untrusted embedding indices Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/neuml/txtai/issues/965
dding indices Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/neuml/txtai/issues/965 - https://research.jfrog.com/vulnerabilities/txtai-arbitrary-file-write-jfsa-2025-001471363/
CVE ID: CVE-2025-10857 State: PUBLISHED Published: 2025-09-23T08:32:11.548Z Last Updated: 2025-09-23T19:32:55.037Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Point of Sale System POS Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.325228 - https://vuldb.com/?ctiid.325228 - https://vuldb.com/?submit.657940 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/un2cmghguhg4aogn?singleDoc - https://www.campcodes.com/
CVE ID: CVE-2025-10858 State: PUBLISHED Published: 2025-09-26T09:04:31.555Z Last Updated: 2025-09-26T15:32:55.310Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/570034
CVE ID: CVE-2025-10859 State: PUBLISHED Published: 2025-09-30T12:49:07.059Z Last Updated: 2025-10-30T16:14:17.410Z Vendors: Mozilla Products: Firefox for iOS Description: Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs This vulnerability affects Firefox for iOS < 143.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1684624 - https://www.mozilla.org/security/advisories/mfsa2025-79/
CVE ID: CVE-2025-10861 State: PUBLISHED Published: 2025-10-24T11:25:45.885Z Last Updated: 2025-10-24T12:29:54.990Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: roxnor Products: Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers Problem Types: CWE-918 Description: The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.1.4. This is due to insufficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to
fficient validation on the URLs supplied via the URL parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services, as well as conduct network reconnaissance. The vulnerability was partially patched in version 2.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f4767b5-5dd6-4a2a-b44a-5297432286b1?source=cve - https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35 - https://plugins.trac.wordpress.org/browser/pop
rowser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L35 - https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/FetchDemo.php#L15 - https://plugins.trac.wordpress.org/changeset/3369146/ - https://plugins.trac.wordpress.org/changeset/3379308/
CVE ID: CVE-2025-10862 State: PUBLISHED Published: 2025-10-09T08:23:17.221Z Last Updated: 2025-10-09T15:06:58.535Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: roxnor Products: Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers Problem Types: CWE-89 Description: The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.1.3. This is due to insufficient escaping on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauth
ng on the 'id' parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93e0a1a1-fba6-4209-b679-e66d77870be2?source=cve - https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Routes/Popup.php#L232 - https://plugins.trac.wordpress.org/browser/popup-builder-block/tags/2.1.2/includes/Helpers/DataBase.php#L374 - https://plugins.trac.wordpress.org/ch
ss.org/browser/popup-builder-block/tags/2.1.2/includes/Helpers/DataBase.php#L374 - https://plugins.trac.wordpress.org/changeset/3369146/
CVE ID: CVE-2025-10867 State: PUBLISHED Published: 2025-09-26T09:04:26.530Z Last Updated: 2025-09-26T15:33:34.488Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/517757
CVE ID: CVE-2025-10868 State: PUBLISHED Published: 2025-09-26T09:10:49.812Z Last Updated: 2025-09-26T13:13:02.624Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-840 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/526482
CVE ID: CVE-2025-10869 State: PUBLISHED Published: 2025-10-15T12:37:53.634Z Last Updated: 2025-10-22T08:22:09.442Z Vendors: Oct8ne Products: Chatbot Problem Types: CWE-79 Description: Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Data/SaveInteractions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notice
teractions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-oct8ne-chatbot
CVE ID: CVE-2025-10870 State: PUBLISHED Published: 2025-11-07T09:26:39.503Z Last Updated: 2025-11-07T12:09:38.397Z Vendors: DIAL Products: CentrosNet Problem Types: CWE-89 Description: SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-dials-centrosnet