Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9627 State: PUBLISHED Published: 2025-09-11T07:24:56.522Z Last Updated: 2025-09-11T14:38:59.031Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: izem Products: Run Log Problem Types: CWE-352 Description: The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect nonce validation on the oirl_plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings including distance units, pace display preferences, style themes, and display positions via a forged request granted they can trick a site administrator
splay preferences, style themes, and display positions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b9ba35b-5ef8-4170-97f4-400fe9bd3af2?source=cve - https://plugins.trac.wordpress.org/browser/run-log/trunk/run-log.php#L143
CVE ID: CVE-2025-9628 State: PUBLISHED Published: 2025-09-11T07:24:51.445Z Last Updated: 2025-09-11T14:40:58.271Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: jh5ru Products: The integration of the AMO.CRM Problem Types: CWE-352 Description: The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settings_page function. This makes it possible for unauthenticated attackers to modify critical API connection settings including the AMO.CRM API URL, login credentials, and API hash key via a forged request granted
API connection settings including the AMO.CRM API URL, login credentials, and API hash key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3623713f-ad39-429c-890f-cd113efb905a?source=cve - https://plugins.trac.wordpress.org/browser/leads-for-amo-crm/tags/1.0.1/amocrmleads.php#L64 - https://plugins.trac.wordpress.org/browser/leads-for-amo-crm/tags/1.0.1/main.php#L10
CVE ID: CVE-2025-9629 State: PUBLISHED Published: 2025-09-17T01:49:16.942Z Last Updated: 2025-09-17T13:09:57.499Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: shenyanzhi Products: USS Upyun Problem Types: CWE-352 Description: The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the uss_setting_page function when processing the uss_set form type. This makes it possible for unauthenticated attackers to modify critical Upyun cloud storage settings including bucket name, operator credentials, upload paths, and image processing paramet
cal Upyun cloud storage settings including bucket name, operator credentials, upload paths, and image processing parameters via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2cee46a-03d5-4a31-ba15-28be97794199?source=cve - https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L493 - https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L499 - https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.1/upyun-uss-wordpress.php#L493
CVE ID: CVE-2025-9630 State: PUBLISHED Published: 2025-10-03T11:17:19.882Z Last Updated: 2025-10-03T14:01:55.192Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: samueljesse Products: WP SinoType Problem Types: CWE-352 Description: The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotype_config function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Not
granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b02198f5-10df-4c4c-beed-aec8acacaec9?source=cve - https://plugins.trac.wordpress.org/browser/wp-sinotype/trunk/sinotype.php#L65 - https://plugins.trac.wordpress.org/browser/wp-sinotype/trunk/sinotype.php#L161
CVE ID: CVE-2025-9631 State: PUBLISHED Published: 2025-09-11T07:24:49.603Z Last Updated: 2025-09-11T14:41:39.556Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: gyaku Products: AutoCatSet Problem Types: CWE-352 Description: The AutoCatSet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the autocatset_ajax function. This makes it possible for unauthenticated attackers to trigger automatic recategorization of posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ed request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3bd31f-0f5a-4b4a-811b-5482db866bd5?source=cve - https://plugins.trac.wordpress.org/browser/autocatset/trunk/lib/ajax.php#L5 - https://plugins.trac.wordpress.org/browser/autocatset/trunk/autocatset.php#L93
CVE ID: CVE-2025-9632 State: PUBLISHED Published: 2025-09-11T07:25:01.363Z Last Updated: 2025-09-11T14:37:25.217Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: vinzzb Products: PhpList Subber Problem Types: CWE-352 Description: The PhpList Subber plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the bulk_action_handler function. This makes it possible for unauthenticated attackers to trigger bulk synchronization of subscription forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a
n forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8113238-5208-42cd-aed6-7ec61c3ced85?source=cve - https://plugins.trac.wordpress.org/browser/phpls/tags/1.1/admin/init.php#L60 - https://plugins.trac.wordpress.org/browser/phpls/tags/1.1/admin/init.php#L45
CVE ID: CVE-2025-9633 State: PUBLISHED Published: 2025-09-11T07:25:03.959Z Last Updated: 2025-09-11T14:36:46.637Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: shawfactor Products: LH Signing Problem Types: CWE-352 Description: The LH Signing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.83. This is due to missing or incorrect nonce validation on the plugin_options function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - C
they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fadd7934-bdd9-47e9-bd34-d162ff3b7cd4?source=cve - https://plugins.trac.wordpress.org/browser/lh-signing/trunk/lh-signing.php#L1886 - https://plugins.trac.wordpress.org/browser/lh-signing/trunk/partials/option-settings.php#L3 - https://plugins.trac.wordpress.org/browser/lh-signing/trunk/lh-signing.php#L1870
CVE ID: CVE-2025-9634 State: PUBLISHED Published: 2025-09-11T07:24:55.037Z Last Updated: 2025-09-11T14:39:31.029Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: jegerwan Products: Plugin updates blocker Problem Types: CWE-352 Description: The Plugin updates blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the pub_save action handler. This makes it possible for unauthenticated attackers to disable or enable plugin updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link
es via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b66a0bc-9125-45ee-9583-bc503634a0ce?source=cve - https://plugins.trac.wordpress.org/browser/plugin-update-blocker/tags/0.2/dpu-menu.php#L3
CVE ID: CVE-2025-9635 State: PUBLISHED Published: 2025-09-11T07:24:55.459Z Last Updated: 2025-09-11T14:39:22.378Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ishan001 Products: Analytics Reduce Bounce Rate Problem Types: CWE-352 Description: The Analytics Reduce Bounce Rate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the unbounce_options function. This makes it possible for unauthenticated attackers to modify Google Analytics tracking settings via a forged request granted they can trick a site administrator into performing an action suc
alytics tracking settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/787929b7-e8e0-4b24-9556-0198199c417f?source=cve - https://plugins.trac.wordpress.org/browser/analytics-unbounce/tags/2.3/analytics-unbounce.php#L86 - https://plugins.trac.wordpress.org/browser/analytics-unbounce/tags/2.3/analytics-unbounce.php#L124
CVE ID: CVE-2025-9636 State: PUBLISHED Published: 2025-09-04T16:43:27.710Z Last Updated: 2025-09-05T03:55:49.451Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pgadmin-org/pgadmin4/issues/9114
CVE ID: CVE-2025-9639 State: PUBLISHED Published: 2025-08-29T03:39:35.620Z Last Updated: 2025-08-29T16:25:37.509Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ai3 Products: QbiCRMGateway Problem Types: CWE-23 Description: The QbiCRMGateway developed by Ai3 has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10364-6ac24-1.html - https://www.twcert.org.tw/en/cp-139-10365-bf667-2.html
CVE ID: CVE-2025-9640 State: PUBLISHED Published: 2025-10-15T12:47:29.871Z Last Updated: 2025-11-07T19:42:06.775Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-908 Description: A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information discl
an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2025-9640 - https://bugzilla.redhat.com/show_bug.cgi?id=2391698 - https://www.samba.org/samba/history/security.html
CVE ID: CVE-2025-9642 State: PUBLISHED Published: 2025-09-26T09:04:51.532Z Last Updated: 2025-09-26T13:15:17.950Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/566505 - https://hackerone.com/reports/3297413
CVE ID: CVE-2025-9643 State: PUBLISHED Published: 2025-08-29T12:02:07.233Z Last Updated: 2025-08-29T13:42:13.813Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/utility_bill_setup.php. Performing manipulation of the argument txtGasBill results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321850 - https://vuldb.com/?ctiid.321850 - https://vuldb.com/?submit.636371 - https://github.com/zzb1388/cve/issues/49 - https://itsourcecode.com/
CVE ID: CVE-2025-9644 State: PUBLISHED Published: 2025-08-29T12:32:07.735Z Last Updated: 2025-08-29T13:42:59.589Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /setting/bill_setup.php. Executing manipulation of the argument txtBillType can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321851 - https://vuldb.com/?ctiid.321851 - https://vuldb.com/?submit.636372 - https://github.com/zzb1388/cve/issues/48 - https://itsourcecode.com/
CVE ID: CVE-2025-9645 State: PUBLISHED Published: 2025-08-29T12:32:11.518Z Last Updated: 2025-08-29T13:43:59.849Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Apartment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /t_dashboard/r_all_info.php. The manipulation of the argument mid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321852 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321852 - https://vuldb.com/?ctiid.321852 - https://vuldb.com/?submit.636506 - https://github.com/loveqiaoshen/QiaoShenCVE/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-9646 State: PUBLISHED Published: 2025-08-29T13:02:06.803Z Last Updated: 2025-08-29T13:45:03.471Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This i
to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321853 - https://vuldb.com/?ctiid.321853 - https://vuldb.com/?submit.636625 - https://github.com/o2oa/o2oa/issues/170 - https://github.com/o2oa/o2oa/issues/170#issuecomment-3212894835 - https://github.com/o2oa/o2oa/issues/170#issue-3328947938
CVE ID: CVE-2025-9647 State: PUBLISHED Published: 2025-08-29T13:02:13.543Z Last Updated: 2025-08-29T13:45:48.076Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: mtons Products: mblog Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321854 - https://vuldb.com/?ctiid.321854 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321854 - https://vuldb.com/?ctiid.321854 - https://vuldb.com/?submit.636627 - https://gitee.com/mtons/mblog/issues/ICPMNE
CVE ID: CVE-2025-9648 State: PUBLISHED Published: 2025-09-29T11:47:56.141Z Last Updated: 2025-09-29T12:53:45.646Z Vendors: CivetWeb Products: CivetWeb Problem Types: CWE-158 Description: A vulnerability in the CivetWeb library's function mg_handle_form_request allows remote attackers to trigger a denial of service (DoS) condition. By sending a specially crafted HTTP POST request containing a null byte in the payload, the server enters an infinite loop during form data parsing. Multiple malicious requests will result in complete CPU exhaustion and render the service unresponsive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone execut
sive to further requests. This issue was fixed in commit 782e189. This issue affects only the library, standalone executable pre-built by vendor is not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/09/CVE-2025-9648 - https://github.com/civetweb/civetweb - https://github.com/civetweb/civetweb/issues/1348 - https://github.com/civetweb/civetweb/commit/782e18903515f43bafbf2e668994e82bdfa51133
CVE ID: CVE-2025-9649 State: PUBLISHED Published: 2025-08-29T13:32:07.505Z Last Updated: 2025-08-29T13:48:02.248Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: appneta Products: tcpreplay Problem Types: CWE-369, CWE-404 Description: A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirm
4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321855 - https://vuldb.com/?ctiid.321855 - https://vuldb.com/?submit.630493 - https://vuldb.com/?submit.630494 - https://github.com/appneta/tcpreplay/issues/968 - https://github.com/appneta/tcpreplay/issues/968#issuecomment-3226338070 - https://drive.google.com/file/d/16QQtZvUrMbF-i_1cGt5hNWmkn-YVyBOM/view?usp=sharing
CVE ID: CVE-2025-9650 State: PUBLISHED Published: 2025-08-29T14:02:06.833Z Last Updated: 2025-08-29T14:31:45.163Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yeqifu Products: carRental Problem Types: CWE-22 Description: A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/main/java/com/yeqifu/sys/utils/AppFileUtils.java. The manipulation of the argument carimg leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain
he exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321858 - https://vuldb.com/?ctiid.321858 - https://vuldb.com/?submit.636624 - https://github.com/JetpropelledSnake/CVE-File/blob/main/Unrestricted%20deletion%20of%20any%20file.md
CVE ID: CVE-2025-9651 State: PUBLISHED Published: 2025-08-29T14:02:09.556Z Last Updated: 2025-08-29T14:27:30.942Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: shafhasan Products: chatbox Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in shafhasan chatbox up to 156a39cde62f78532c3265a70eda12c70907e56f. This impacts an unknown function of the file /chat.php. The manipulation of the argument user_id results in sql injection. The attack may be performed from a remote location. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affec
used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321859 - https://vuldb.com/?ctiid.321859 - https://vuldb.com/?submit.636884 - https://www.websecurityinsights.my.id/2025/08/chatbox-10-chatphpuserid-sql-injection.html
CVE ID: CVE-2025-9652 State: PUBLISHED Published: 2025-08-29T14:32:06.507Z Last Updated: 2025-08-29T21:04:14.746Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP