Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
hat are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322072 - https://vuldb.com/?ctiid.322072 - https://vuldb.com/?submit.640867 - https://vuldb.com/?submit.640956 - https://github.com/lan041221/cvec/issues/18
CVE ID: CVE-2025-9773 State: PUBLISHED Published: 2025-09-01T10:02:06.175Z Last Updated: 2025-09-02T15:10:11.712Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: RemoteClinic Problem Types: CWE-79, CWE-94 Description: A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing manipulation of the argument Last Name can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322073 - https://vuldb.com/?ctiid.322073 - https://vuldb.com/?subm
ADP Vulnrichment: References: - https://vuldb.com/?id.322073 - https://vuldb.com/?ctiid.322073 - https://vuldb.com/?submit.640893 - https://github.com/03hice-collab/CVE/issues/2
CVE ID: CVE-2025-9774 State: PUBLISHED Published: 2025-09-01T10:32:06.529Z Last Updated: 2025-09-02T15:10:06.179Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: RemoteClinic Problem Types: CWE-200, CWE-284 Description: A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation of the argument Email leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322074 - https://vuldb.com/?ctiid.322
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322074 - https://vuldb.com/?ctiid.322074 - https://vuldb.com/?submit.640954 - https://github.com/diy777/cve/issues/1
CVE ID: CVE-2025-9775 State: PUBLISHED Published: 2025-09-01T11:02:06.696Z Last Updated: 2025-09-02T15:09:57.878Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: RemoteClinic Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument image results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322075 - https://vuldb.com/?ctiid.322075 - https://vuldb.com/?s
SA ADP Vulnrichment: References: - https://vuldb.com/?id.322075 - https://vuldb.com/?ctiid.322075 - https://vuldb.com/?submit.640955 - https://github.com/diy777/cve/issues/2
CVE ID: CVE-2025-9776 State: PUBLISHED Published: 2025-09-11T04:26:21.016Z Last Updated: 2025-09-11T13:12:34.153Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: catfolders Products: CatFolders – Tame Your WordPress Media Library by Category Problem Types: CWE-89 Description: The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level
sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e585998a-d78f-4923-865c-c3a9820b583f?source=cve - https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Models/FolderModel.php#L376 - https://plugins.trac.wordpress.org/browser/catfolders/tags/2.5.1/includes/Rest/Controllers/ImportController.php#L433
CVE ID: CVE-2025-9778 State: PUBLISHED Published: 2025-09-01T12:02:08.108Z Last Updated: 2025-09-02T15:09:50.176Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Tenda Products: W12 Problem Types: CWE-798, CWE-259 Description: A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. The manipulation leads to hard-coded credentials. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. Additional Ana
igh. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322080 - https://vuldb.com/?ctiid.322080 - https://vuldb.com/?submit.640969 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e8.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e8.md#steps-to-reproduce - https://www.tenda.com.cn/
CVE ID: CVE-2025-9779 State: PUBLISHED Published: 2025-09-01T12:32:09.168Z Last Updated: 2025-09-02T15:09:44.766Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322081 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322081 - https://vuldb.com/?ctiid.322081 - https://vuldb.com/?submit.640987 - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9780 State: PUBLISHED Published: 2025-09-01T13:02:08.548Z Last Updated: 2025-09-02T15:09:39.129Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322082 - https://vuldb.com/?ctiid.322082 - https://vuldb.com/
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322082 - https://vuldb.com/?ctiid.322082 - https://vuldb.com/?submit.640988 - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formIpQoS/formIpQoS.md - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formIpQoS/formIpQoS.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9781 State: PUBLISHED Published: 2025-09-01T13:32:09.164Z Last Updated: 2025-09-02T15:09:33.590Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function sub_4162DC of the file /boafrm/formFilter. Such manipulation of the argument ip6addr leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322083 - https://vuldb.com/?ctiid.322083 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322083 - https://vuldb.com/?ctiid.322083 - https://vuldb.com/?submit.640989 - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9782 State: PUBLISHED Published: 2025-09-01T14:02:07.534Z Last Updated: 2025-09-02T15:09:27.355Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub_4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the argument submit-url results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322084 - https://vuldb
d be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322084 - https://vuldb.com/?ctiid.322084 - https://vuldb.com/?submit.640990 - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formOneKeyAccessButton/formOneKeyAccessButton.md - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formOneKeyAccessButton/formOneKeyAccessButton.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9783 State: PUBLISHED Published: 2025-09-01T14:32:07.404Z Last Updated: 2025-09-02T18:50:55.424Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A702R Problem Types: CWE-120, CWE-119 Description: A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322085 - https://vuldb
utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322085 - https://vuldb.com/?ctiid.322085 - https://vuldb.com/?submit.640991 - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formParentControl/formParentControl.md - https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formParentControl/formParentControl.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9784 State: PUBLISHED Published: 2025-09-02T13:37:59.772Z Last Updated: 2025-11-20T07:36:11.841Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel - HawtIO 4, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Problem Types: CWE-770 Description: A flaw was found in Unde
ack, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Problem Types: CWE-770 Description: A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-9784 - https://bugzilla.redhat.com/
CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-9784 - https://bugzilla.redhat.com/show_bug.cgi?id=2392306 - https://github.com/undertow-io/undertow/pull/1778 - https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final - https://issues.redhat.com/browse/UNDERTOW-2598
CVE ID: CVE-2025-9785 State: PUBLISHED Published: 2025-09-03T04:14:07.424Z Last Updated: 2025-09-04T03:55:26.388Z Vendors: PaperCut Products: Print Deploy Problem Types: CWE-295 Description: PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-signed certificate. If the customer does not fully configure the system to leverage the trust database on the clients, it opens up the communication between clients and the server to man-in-the-middle attacks. It was discovered that certain parts of the docum
unication between clients and the server to man-in-the-middle attacks. It was discovered that certain parts of the documentation related to the configuration of SSL in Print Deploy were lacking, which could potentially contribute to a misconfiguration of the Print Deploy client installation. PaperCut strongly recommends to use valid certificates to secure installations and to follow the updated documentation to ensure the correct SSL configuration. Those who use private CAs and/or self-signed certificates should make sure to copy their Certification Authority certificate, or their self signed certificate if using only one, to the trust store of their operating system and to the Java key stor
r their self signed certificate if using only one, to the trust store of their operating system and to the Java key store Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/papercut-ng-mf-security-bulletin-september-2025/
CVE ID: CVE-2025-9786 State: PUBLISHED Published: 2025-09-01T15:32:07.126Z Last Updated: 2025-09-02T18:39:17.541Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Learning Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /teacher_signup.php. Performing manipulation of the argument firstname results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
and could be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322102 - https://vuldb.com/?ctiid.322102 - https://vuldb.com/?submit.640996 - https://github.com/wyyyxxxx1017/CVE/issues/6 - https://www.campcodes.com/
CVE ID: CVE-2025-9788 State: PUBLISHED Published: 2025-09-01T17:32:06.556Z Last Updated: 2025-09-02T15:09:21.775Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester, Campcodes Products: School Log Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_class.php. Executing manipulation of the argument id_no can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vuln
aunched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322103 - https://vuldb.com/?ctiid.322103 - https://vuldb.com/?submit.641028 - https://github.com/wyyyxxxx1017/CVE/issues/10
CVE ID: CVE-2025-9789 State: PUBLISHED Published: 2025-09-01T18:02:07.145Z Last Updated: 2025-09-02T15:09:15.624Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is some unknown functionality of the file /admin/edituser.php. The manipulation of the argument userid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
s publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322104 - https://vuldb.com/?ctiid.322104 - https://vuldb.com/?submit.641029 - https://vuldb.com/?submit.643116 - https://vuldb.com/?submit.643146 - https://github.com/YoSheep/cve/blob/main/Online%20Hotel%20Reservation%20System%20In%20PHP%20With%20Source%20Code%20-%20SQL%20Injection%20in%20edituser.php.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-9790 State: PUBLISHED Published: 2025-09-01T18:32:07.275Z Last Updated: 2025-09-02T15:09:07.948Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in SourceCodester Hotel Reservation System 1.0. This affects an unknown part of the file /admin/updateabout.php. The manipulation of the argument address results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322105 -
ic and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322105 - https://vuldb.com/?ctiid.322105 - https://vuldb.com/?submit.641069 - https://github.com/YoSheep/cve/blob/main/Online%20Hotel%20Reservation%20System%20In%20PHP%20With%20Source%20Code%20-%20SQL%20Injection%20in%20updateabout.php.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-9791 State: PUBLISHED Published: 2025-09-01T19:02:07.802Z Last Updated: 2025-09-02T15:09:01.786Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-121, CWE-119 Description: A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322106 - https://vu
be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322106 - https://vuldb.com/?ctiid.322106 - https://vuldb.com/?submit.641088 - https://github.com/Cpppq43/Tenda/blob/main/Tenda_AC20_V16.03.08.05.md - https://github.com/Cpppq43/Tenda/blob/main/Tenda_AC20_V16.03.08.05.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-9792 State: PUBLISHED Published: 2025-09-01T19:32:07.130Z Last Updated: 2025-09-02T15:08:56.333Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /e_dashboard/e_all_info.php. Such manipulation of the argument mid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
en disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322107 - https://vuldb.com/?ctiid.322107 - https://vuldb.com/?submit.641102 - https://github.com/zzb1388/cve/issues/62 - https://itsourcecode.com/
CVE ID: CVE-2025-9793 State: PUBLISHED Published: 2025-09-01T20:02:07.257Z Last Updated: 2025-09-02T15:08:50.662Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /setting/admin.php of the component Setting Handler. Performing manipulation of the argument ddlBranch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
emotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322108 - https://vuldb.com/?ctiid.322108 - https://vuldb.com/?submit.641110 - https://github.com/zzb1388/cve/issues/61 - https://itsourcecode.com/
CVE ID: CVE-2025-9794 State: PUBLISHED Published: 2025-09-01T20:32:07.651Z Last Updated: 2025-09-02T15:08:44.126Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Computer Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/pos_transac.php?action=add. Executing manipulation of the argument cash/firstname can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. Other parameters might be affected as well. Additional Analyst Notes: -
The exploit has been published and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322109 - https://vuldb.com/?ctiid.322109 - https://vuldb.com/?submit.641103 - https://vuldb.com/?submit.642559 - https://github.com/Yuanwennnn/cve/issues/2 - https://github.com/e1evensu/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-9795 State: PUBLISHED Published: 2025-09-01T21:02:06.245Z Last Updated: 2025-09-02T15:08:37.422Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: xujeff Products: tianti 天梯 Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322110 - https://vuldb.com/?ctiid.322110 - https://vuldb.com/?submit.641122 - https://github.com/xujeff/tianti/issues/43 - https://github.com/xujeff/tianti/issues/43#issue-3287851827
CVE ID: CVE-2025-9796 State: PUBLISHED Published: 2025-09-01T21:32:08.508Z Last Updated: 2025-09-02T15:08:29.118Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: thinkgem Products: JeeSite Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b.