Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/cve/a91PA000001Smp7YAC/insufficiently-protected-credentials-in-puppet-enterprise-20254-and-20255
CVE ID: CVE-2025-10363 State: PUBLISHED Published: 2025-10-06T16:38:57.193Z Last Updated: 2025-10-06T17:15:57.137Z Vendors: Topal Solutions AG Products: Topal Finanzbuchhaltung Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Topal Solutions AG Topal Finanzbuchhaltung on Windows allows Remote Code Execution.This issue affects at least Topal Finanzbuchhaltung: 10.1.5.20 and is fixed in version 11.2.12.00 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://labs.infoguard.ch/advisories/cve-2025-10363_topal_deserialization_unauth_rce/ - https://info.topal.ch/content/info/Topal_ReleaseNotes/de/version_v11_2_12_0.htm
CVE ID: CVE-2025-10364 State: PUBLISHED Published: 2025-09-12T13:48:18.818Z Last Updated: 2025-09-12T13:57:32.368Z Vendors: Evertz Products: 3080ipx-10G, MViP-II, cVIP, 7890IXG, CC Access Server, 5782XPS-APP-4E Problem Types: CWE-77 Description: The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vul
een developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed
could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/security-advisory-remote-code-execution-on-evertz-svdn-cve-2025-4009
CVE ID: CVE-2025-10365 State: PUBLISHED Published: 2025-09-12T13:46:11.776Z Last Updated: 2025-09-12T13:58:49.025Z Vendors: Evertz Products: 3080ipx-10G, MViP-II, cVIP, 7890IXG, CC Access Server, 5782XPS-APP-4E Problem Types: CWE-287 Description: The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vu
been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed, alteration of closed captions being generated, among others. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.c
ons being generated, among others. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/security-advisory-remote-code-execution-on-evertz-svdn-cve-2025-4009
CVE ID: CVE-2025-10366 State: PUBLISHED Published: 2025-09-13T13:32:06.495Z Last Updated: 2025-09-15T15:36:53.647Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-79, CWE-94 Description: A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of the argument Email address causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnr
dor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323774 - https://vuldb.com/?ctiid.323774 - https://vuldb.com/?submit.643517 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss1.md - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss1.md#poc
CVE ID: CVE-2025-10367 State: PUBLISHED Published: 2025-09-13T14:02:06.970Z Last Updated: 2025-09-15T15:37:29.204Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/cardEdit.php. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CI
sed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323775 - https://vuldb.com/?ctiid.323775 - https://vuldb.com/?submit.643518 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss2.md - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss2.md#poc
CVE ID: CVE-2025-10368 State: PUBLISHED Published: 2025-09-13T15:32:05.853Z Last Updated: 2025-09-15T15:38:00.986Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/manageFilesFolders.php. Performing manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Note
ld be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323776 - https://vuldb.com/?ctiid.323776 - https://vuldb.com/?submit.643519 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss3.md - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss3.md#poc
CVE ID: CVE-2025-10369 State: PUBLISHED Published: 2025-09-13T16:32:06.834Z Last Updated: 2025-09-15T15:38:29.029Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This affects an unknown part of the file /htdocs/cardRegisterNew.php. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichm
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323777 - https://vuldb.com/?ctiid.323777 - https://vuldb.com/?submit.643520 - https://vuldb.com/?submit.643521 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss4.md - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss5.md
CVE ID: CVE-2025-10370 State: PUBLISHED Published: 2025-09-13T17:02:07.247Z Last Updated: 2025-09-15T15:39:17.314Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: MiczFlor Products: RPi-Jukebox-RFID Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This vulnerability affects unknown code of the file /htdocs/userScripts.php. The manipulation of the argument Custom script leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
ble and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323778 - https://vuldb.com/?ctiid.323778 - https://vuldb.com/?submit.643522 - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss6.md - https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss6.md#poc
CVE ID: CVE-2025-10371 State: PUBLISHED Published: 2025-09-13T17:32:06.472Z Last Updated: 2025-09-15T15:39:52.415Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: eCharge Hardy Barth Products: Salia PLCC Problem Types: CWE-434, CWE-284 Description: A security flaw has been discovered in eCharge Hardy Barth Salia PLCC 2.2.0. This issue affects some unknown processing of the file /api.php. The manipulation of the argument setrfidlist results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
lic and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323779 - https://vuldb.com/?ctiid.323779 - https://vuldb.com/?submit.643535 - https://github.com/YZS17/CVE/blob/main/Salia_PLCC/file-write-api.php.md - https://github.com/YZS17/CVE/blob/main/Salia_PLCC/file-write-api.php.md#poc
CVE ID: CVE-2025-10372 State: PUBLISHED Published: 2025-09-13T18:02:05.431Z Last Updated: 2025-10-27T23:23:30.912Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_modulo_cad.php. This manipulation of the argument nm_tipo/descricao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323780 - https://vuldb.com/?ctiid.323780 - https://vuldb.com/?submit.642825 - https://karinagante.github.io/cve-2025-10372/ - https://karinagante.github.io/cve-2025-10372/#proof-of-concept-poc
CVE ID: CVE-2025-10373 State: PUBLISHED Published: 2025-09-13T18:32:07.367Z Last Updated: 2025-10-20T04:39:18.948Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_tipo_cad.php. Such manipulation of the argument nm_tipo leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
losed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323781 - https://vuldb.com/?ctiid.323781 - https://vuldb.com/?submit.642826 - https://karinagante.github.io/cve-2025-10373/ - https://karinagante.github.io/cve-2025-10373/#proof-of-concept-poc
CVE ID: CVE-2025-10374 State: PUBLISHED Published: 2025-09-13T19:02:07.384Z Last Updated: 2025-09-15T15:41:51.019Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR) Vendors: Shenzhen Sixun Products: Business Management System Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in Shenzhen Sixun Business Management System 7/11. This affects an unknown part of the file /Adm/OperatorStop. Performing manipulation results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323788 - https://vuldb.com/?ctiid.323788 - https://vuldb.com/?submit.639092 - https://www.yuque.com/hongzh0/tx13c7/lgb05p6ar7ybugcz
CVE ID: CVE-2025-10375 State: PUBLISHED Published: 2025-10-11T09:28:42.013Z Last Updated: 2025-10-14T18:44:50.500Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: accessibewp Products: Web Accessibility by accessiBe Problem Types: CWE-352 Description: The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. This makes it possible for unauthenticated attackers to modify plugin set
y_config, and accessibe_add_verification_page. This makes it possible for unauthenticated attackers to modify plugin settings and create verification files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3aac40c-1576-45b5-90f8-14ff05c089c7?source=cve - https://plugins.trac.wordpress.org/browser/accessibe/tags/2.7/class.accessibeforwp.php#L273 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3376235%40accessibe&new=3376235%40accessibe&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10376 State: PUBLISHED Published: 2025-10-11T09:28:42.803Z Last Updated: 2025-10-14T18:44:36.808Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ercbs Products: Course Redirects for Learndash Plugin Problem Types: CWE-352 Description: The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to missing nonce validation when processing form submissions on the settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such
modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f04ef770-73d9-4940-9736-c214bf5137ba?source=cve - https://plugins.trac.wordpress.org/browser/course-redirects-for-learndash/trunk/redirect_course.php#L76
CVE ID: CVE-2025-10377 State: PUBLISHED Published: 2025-09-26T03:25:35.336Z Last Updated: 2025-09-26T19:34:03.486Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: qriouslad Products: System Dashboard Problem Types: CWE-352 Description: The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers to toggle critical logging settings including Page Access Logs, Error Logs, and Email Delivery Logs via a forged request granted they can trick a site administrator into p
Access Logs, Error Logs, and Email Delivery Logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea38e16f-4012-4d22-9a47-76f91251e1d7?source=cve - https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.20/admin/class-system-dashboard-admin.php#L9108 - https://plugins.trac.wordpress.org/changeset/3364295/system-dashboard/tags/2.8.21/admin/class-system-dashboard-admin.php?old=3253979&old_path=system-dashboard%2Ftags%2F2.8.20%2Fadmin%2Fclass-system-dashboard-admin.php
CVE ID: CVE-2025-10380 State: PUBLISHED Published: 2025-09-23T03:34:34.263Z Last Updated: 2025-09-23T14:04:23.987Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wplakeorg Products: Advanced Views – Display Posts, Custom Fields, and More Problem Types: CWE-1336 Description: The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or highe
Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=cve - https://plugins.trac.wordpress.org/browser/acf-views/tags/3.7.19/src/Template_Engines/Twig.php#L106 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364566%40acf-views&new=3364566%40acf-views&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10383 State: PUBLISHED Published: 2025-10-04T03:33:31.544Z Last Updated: 2025-10-06T15:55:20.550Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: contest-gallery Products: Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Problem Types: CWE-79 Description: The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level acc
d output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with author-level access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de379f74-660a-4e59-b1c4-4b88dff8a843?source=cve - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L367 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L381 - https://plugins.trac.wordpress.org/browser/contest-gallery
lery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L381 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/input.php#L389 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/textarea.php#L330 - https://plugins.trac.wordpress.org/browser/contest-gallery/tags/26.1.1/v10/v10-admin/upload/fields/textarea.php#L338 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3372123%40contest-gallery&new=3372123%40contest-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10384 State: PUBLISHED Published: 2025-09-13T19:32:06.572Z Last Updated: 2025-09-15T15:42:30.600Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yangzongzhuan Products: RuoYi Problem Types: CWE-285, CWE-266 Description: A flaw has been found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the file /system/role/authUser/cancelAll of the component Role Handler. Executing manipulation of the argument roleId/userIds can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did
rom remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323819 - https://vuldb.com/?ctiid.323819 - https://vuldb.com/?submit.643810 - https://www.cnblogs.com/aibot/p/19063509
CVE ID: CVE-2025-10385 State: PUBLISHED Published: 2025-09-14T01:02:05.536Z Last Updated: 2025-09-15T15:43:34.081Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Mercury Products: KM08-708H GiGA WiFi Wave2 Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in Mercury KM08-708H GiGA WiFi Wave2 1.1. Affected by this issue is the function sub_450B2C of the file /goform/mcr_setSysAdm. The manipulation of the argument ChgUserId leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323820 - https://vuldb.com/?ctiid.323820 - https://vuldb.com/?submit.643902 - https://github.com/Jjx-wy/kt/blob/main/KT%20KM08-708H.md
CVE ID: CVE-2025-10386 State: PUBLISHED Published: 2025-09-14T01:32:07.114Z Last Updated: 2025-09-15T15:47:12.048Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Yida Products: ECMS Consulting Enterprise Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Request Handler. The manipulation of the argument requestUrl results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but
k remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323821 - https://vuldb.com/?ctiid.323821 - https://vuldb.com/?submit.643990 - https://github.com/1276486/CVE/issues/10