Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
loit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315005 - https://vuldb.com/?ctiid.315005 - https://vuldb.com/?submit.603698 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_9/9.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_9/9.md#poc
CVE ID: CVE-2025-7090 State: PUBLISHED Published: 2025-07-06T19:02:06.107Z Last Updated: 2025-07-07T16:02:01.511Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Belkin F9K1122 1.00.33. Affected by this issue is the function formConnectionSetting of the file /goform/formConnectionSetting of the component webs. The manipulation of the argument max_Conn/timeOut leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early ab
ay be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315002 - https://vuldb.com/?ctiid.315002 - https://vuldb.com/?submit.603699 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_10/10.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_10/10.md#poc
CVE ID: CVE-2025-7091 State: PUBLISHED Published: 2025-07-06T19:32:05.446Z Last Updated: 2025-07-07T16:01:19.432Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. Affected is the function formWlanMP of the file /goform/formWlanMP of the component webs. The manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/
wer5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315006 - https://vuldb.com/?ctiid.315006 - https://vuldb.com/?submit.603700 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_11/1
ldb.com/?ctiid.315006 - https://vuldb.com/?submit.603700 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_11/11.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_11/11.md#poc
CVE ID: CVE-2025-7092 State: PUBLISHED Published: 2025-07-06T20:02:05.250Z Last Updated: 2025-07-07T16:00:43.928Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. This vulnerability affects the function formWlanSetupWPS of the file /goform/formWlanSetupWPS of the component webs. The manipulation of the argument wps_enrolee_pin/webpage leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
iated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315004 - https://vuldb.com/?ctiid.315004 - https://vuldb.com/?submit.603701 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_12/12.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_12/12.md#poc
CVE ID: CVE-2025-7093 State: PUBLISHED Published: 2025-07-06T20:32:05.782Z Last Updated: 2025-07-07T15:57:38.459Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. Affected by this vulnerability is the function formSetLanguage of the file /goform/formSetLanguage of the component webs. The manipulation of the argument webpage leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure
tely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315007 - https://vuldb.com/?ctiid.315007 - https://vuldb.com/?submit.603710 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_13/13.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_13/13.md#poc
CVE ID: CVE-2025-7094 State: PUBLISHED Published: 2025-07-06T21:02:04.949Z Last Updated: 2025-07-07T15:55:13.859Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument submit-url-ok leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclos
emotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315008 - https://vuldb.com/?ctiid.315008 - https://vuldb.com/?submit.603711 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_14/14.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_14/14.md#poc
CVE ID: CVE-2025-7095 State: PUBLISHED Published: 2025-07-06T21:32:06.051Z Last Updated: 2025-07-07T15:49:16.811Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R) Vendors: Comodo Products: Internet Security Premium Problem Types: CWE-295, CWE-287 Description: A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this dis
y of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315009 - https://vuldb.com/?ctiid.315009 - https://vuldb.com/?submit.603712 - https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view?usp=sharing
CVE ID: CVE-2025-7096 State: PUBLISHED Published: 2025-07-06T22:02:05.665Z Last Updated: 2025-07-07T15:46:23.946Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Comodo Products: Internet Security Premium Problem Types: CWE-354, CWE-345 Description: A vulnerability classified as critical was found in Comodo Internet Security Premium 12.3.4.8162. This vulnerability affects unknown code of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation leads to improper validation of integrity check value. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315010 - https://vuldb.com/?ctiid.315010 - https://vuldb.com/?submit.603713 - https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view?usp=sharing
CVE ID: CVE-2025-7097 State: PUBLISHED Published: 2025-07-06T22:32:05.190Z Last Updated: 2025-07-07T15:45:53.308Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Comodo Products: Internet Security Premium Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation
s command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315011 - https://vuldb.com/?ctiid.315011 - https://vuldb.com/?submit.603714 - https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view?usp=sharing
CVE ID: CVE-2025-7098 State: PUBLISHED Published: 2025-07-06T23:02:05.835Z Last Updated: 2025-07-07T15:45:22.471Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Comodo Products: Internet Security Premium Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162. Affected is an unknown function of the component File Name Handler. The manipulation of the argument name/folder leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed
. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315012 - https://vuldb.com/?ctiid.315012 - https://vuldb.com/?submit.603715 - https://vuldb.com/?submit.603716 - https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view?usp=sharing
CVE ID: CVE-2025-7099 State: PUBLISHED Published: 2025-07-06T23:32:07.369Z Last Updated: 2025-07-07T15:44:51.694Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: BoyunCMS Problem Types: CWE-502, CWE-20 Description: A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation of the argument db_host leads to deserialization. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit
be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315013 - https://vuldb.com/?ctiid.315013 - https://vuldb.com/?submit.604310 - https://note-hxlab.wetolink.com/share/cQGEOmctNARD
CVE ID: CVE-2025-7100 State: PUBLISHED Published: 2025-07-07T00:02:07.578Z Last Updated: 2025-07-07T15:43:24.706Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UC) Vendors: n/a Products: BoyunCMS Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in BoyunCMS up to 1.4.20 and classified as critical. Affected by this issue is some unknown functionality of the file /application/user/controller/Index.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315014 - https://vuldb.com/?ctiid.315014 - https://vuldb.com/?submit.604455 - https://note-hxlab.wetolink.com/share/KLjaD7oBzCSp
CVE ID: CVE-2025-7101 State: PUBLISHED Published: 2025-07-07T00:32:07.738Z Last Updated: 2025-07-07T15:42:44.283Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: BoyunCMS Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in BoyunCMS up to 1.4.20. It has been classified as critical. This affects an unknown part of the file /install/install_ok.php of the component Configuration File Handler. The manipulation of the argument db_pass leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315015 - https://vuldb.com/?ctiid.315015 - https://vuldb.com/?submit.604323 - https://note-hxlab.wetolink.com/share/6wemW8CnOMbu
CVE ID: CVE-2025-7102 State: PUBLISHED Published: 2025-07-07T01:02:08.578Z Last Updated: 2025-07-07T15:41:30.591Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: BoyunCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315016 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315016 - https://vuldb.com/?ctiid.315016 - https://vuldb.com/?submit.604401 - https://note-hxlab.wetolink.com/share/sEjaSsXWRNz1
CVE ID: CVE-2025-7103 State: PUBLISHED Published: 2025-07-07T01:32:07.395Z Last Updated: 2025-07-07T15:40:51.224Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: BoyunCMS Problem Types: CWE-918 Description: A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315017
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315017 - https://vuldb.com/?ctiid.315017 - https://vuldb.com/?submit.604403 - https://note-hxlab.wetolink.com/share/gRI0WyQLQsmd
CVE ID: CVE-2025-7104 State: PUBLISHED Published: 2025-09-29T17:10:59.630Z Last Updated: 2025-10-15T16:08:39.319Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-915 Description: A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in th
in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/32a175c4-7543-4503-a3d0-7880abd1826b - https://github.com/danny-avila/librechat/commit/a37bf6719cfbc2de270f7d87b6b85d87cc1768db
CVE ID: CVE-2025-7106 State: PUBLISHED Published: 2025-09-23T09:54:33.716Z Last Updated: 2025-09-23T19:29:47.785Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-284 Description: danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having `CREATE: false` permission, a
issions is present. This allows users with the 'USER' role to create agents despite having `CREATE: false` permission, as the check for `['USE', 'CREATE']` passes with just `USE: true`. This vulnerability affects other permission checks as well, such as `PROMPTS`. The issue is present in all versions prior to the fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7de2765b-d1fe-4495-9144-220070857c48 - https://github.com/danny-avila/librechat/commit/91a2df47599c09d80886bfc28e0ccf1debd42110
CVE ID: CVE-2025-7107 State: PUBLISHED Published: 2025-07-07T02:02:07.997Z Last Updated: 2025-07-07T15:37:13.337Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C) Vendors: SimStudioAI Products: sim Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/files/parse/route.ts. The manipulation of the argument filePath leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is
een disclosed to the public and may be used. The patch is identified as b2450530d1ddd0397a11001a72aa0fde401db16a. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315018 - https://vuldb.com/?ctiid.315018 - https://vuldb.com/?submit.601043 - https://github.com/vri-report/reports/issues/2 - https://github.com/simstudioai/sim/pull/437 - https://github.com/vri-report/reports/issues/2#issue-3161840085 - https://github.com/simstudioai/sim/commit/b2450530d1ddd0397a11001a72aa0fde401db16a
CVE ID: CVE-2025-7108 State: PUBLISHED Published: 2025-07-07T02:32:05.272Z Last Updated: 2025-07-07T17:16:11.927Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: risesoft-y9 Products: Digital-Infrastructure Problem Types: CWE-22 Description: A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile of the file /Digital-Infrastructure-9.6.7/y9-digitalbase-webapp/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java. The manipulation of the argument fullPath leads to path traversal. The attack c
public/controller/Y9FileController.java. The manipulation of the argument fullPath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315019 - https://vuldb.com/?ctiid.315019 - https://vuldb.com/?submit.601825 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250621-01.md
CVE ID: CVE-2025-7109 State: PUBLISHED Published: 2025-07-07T03:02:05.460Z Last Updated: 2025-07-08T20:41:54.292Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file /intranet/educar_aluno_beneficio_lst.php of the component Student Benefits Registration. The manipulation of the argument Benefício leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor
scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315020 - https://vuldb.com/?ctiid.315020 - https://vuldb.com/?submit.604790 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README11.md
CVE ID: CVE-2025-7110 State: PUBLISHED Published: 2025-07-07T03:32:05.738Z Last Updated: 2025-07-08T20:36:56.302Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_lst.php of the component School Module. The manipulation of the argument Escola leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but
. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315021 - https://vuldb.com/?ctiid.315021 - https://vuldb.com/?submit.604802 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README12.md
CVE ID: CVE-2025-7111 State: PUBLISHED Published: 2025-07-07T04:02:07.620Z Last Updated: 2025-07-08T20:35:56.678Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar_curso_det.php?cod_curso=ID of the component Course Module. The manipulation of the argument Curso leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this discl