Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4508 State: PUBLISHED Published: 2025-05-10T17:00:07.517Z Last Updated: 2025-05-12T14:54:03.073Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: e-Diary Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. This vulnerability affects unknown code of the file /my-profile.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
y be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308224 - https://vuldb.com/?ctiid.308224 - https://vuldb.com/?submit.567263 - https://github.com/y77-88/myCVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-4509 State: PUBLISHED Published: 2025-05-10T17:31:05.536Z Last Updated: 2025-05-12T14:51:57.749Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: e-Diary Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul e-Diary Management System 1.0. This issue affects some unknown processing of the file /manage-notes.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308225 - https://vuldb.com/?ctiid.308225 - https://vuldb.com/?submit.567288 - https://github.com/y77-88/myCVE/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-4510 State: PUBLISHED Published: 2025-05-10T18:00:06.553Z Last Updated: 2025-05-12T14:06:47.091Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Changjietong Products: UFIDA CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Changjietong UFIDA CRM 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /optnty/optntyday.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
d. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308230 - https://vuldb.com/?ctiid.308230 - https://vuldb.com/?submit.565531 - https://github.com/Michael19820315/CVE/issues/1
CVE ID: CVE-2025-4511 State: PUBLISHED Published: 2025-05-10T18:31:04.795Z Last Updated: 2025-05-12T14:23:06.314Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: vector4wang Products: spring-boot-quick Problem Types: CWE-22 Description: A vulnerability was found in vector4wang spring-boot-quick up to 20250422. It has been rated as critical. This issue affects the function ResponseEntity of the file /spring-boot-quick-master/quick-img2txt/src/main/java/com/quick/controller/Img2TxtController.java of the component quick-img2txt. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor wa
ersal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308231 - https://vuldb.com/?ctiid.308231 - https://vuldb.com/?submit.563538 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250422-01.md
CVE ID: CVE-2025-4512 State: PUBLISHED Published: 2025-05-10T19:00:06.252Z Last Updated: 2025-05-12T14:22:37.657Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Inetum Products: IODAS Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/iodasweb/app.jsp. The manipulation of the argument action leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308232 - https://vuldb.com/?ctiid.308232 - https://vuldb.com/?submit.563733 - https://github.com/lam-sec/iodasweb-poc
CVE ID: CVE-2025-4513 State: PUBLISHED Published: 2025-05-10T19:31:04.319Z Last Updated: 2025-05-12T14:22:03.770Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Catalyst Products: User Key Authentication Plugin Problem Types: CWE-601 Description: A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown functionality of the file /auth/userkey/logout.php of the component Logout. The manipulation of the argument return leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
nched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308233 - https://vuldb.com/?ctiid.308233 - https://vuldb.com/?submit.564090 - https://github.com/Cyber-Wo0dy/report/blob/main/moodle/key_user_authentication/v2022081901/key_user_authentication_open_redirection
CVE ID: CVE-2025-4514 State: PUBLISHED Published: 2025-05-10T20:00:05.891Z Last Updated: 2025-05-12T14:40:22.224Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Zhengzhou Jiuhua Electronic Technology Products: mayicms Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some unknown functionality of the file /javascript.php. The manipulation of the argument Value leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308234 - https://vuldb.com/?ctiid.308234 - https://vuldb.com/?submit.564243 - https://github.com/Axianke/cve/issues/1
CVE ID: CVE-2025-4515 State: PUBLISHED Published: 2025-05-10T20:31:04.532Z Last Updated: 2025-05-12T14:39:41.539Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Zylon Products: PrivateGPT Problem Types: CWE-942, CWE-346 Description: A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any w
sclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308235 - https://vuldb.com/?ctiid.308235 - https://vuldb.com/?submit.564451 - https://gist.github.com/superboy-zjc/2a727cb0c1d468f21a91e0416d006ffe
CVE ID: CVE-2025-4516 State: PUBLISHED Published: 2025-05-15T13:29:20.126Z Last Updated: 2025-06-03T20:53:33.583Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-416 Description: There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/issues/133767 - https://gith
ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/issues/133767 - https://github.com/python/cpython/pull/129648 - https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/ - https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142 - https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e - https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292 - https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d - https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f - https://github
edb393e43c7929b429d - https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f - https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77 - https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b
CVE ID: CVE-2025-4517 State: PUBLISHED Published: 2025-06-03T12:58:50.352Z Last Updated: 2025-10-24T03:55:17.500Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Python Software Foundation Products: CPython Problem Types: CWE-22 Description: Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-ex
ta" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links. Additional Anal
ting source distributions it's important to avoid installing source distributions with suspicious links. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/135034 - https://github.com/python/cpython/pull/135037 - https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/ - https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a - https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a - https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f - https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da -
n/52398e33eff261329a0180ac1d54f42f - https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da - https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 - https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9 - https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e - https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a - https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
CVE ID: CVE-2025-4519 State: PUBLISHED Published: 2025-11-07T04:28:54.561Z Last Updated: 2025-11-07T14:55:39.666Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeatelier Products: IDonate – Blood Donation, Request And Donor Management System Problem Types: CWE-285 Description: The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrato
ted attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/596aef67-582a-4506-bae9-c7be1899e47a?source=cve - https://wordpress.org/plugins/idonate/#developers - https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/DonorFunctions.php#L410 - https://plugins.trac.wordpress.org/changeset/3334424/idonate/tags/2.1.10/src/Helpers/DonorFunctions.php?old=3279142&old_path=idonate%2Ftags%2F2.1.9%2Fsrc%2FHelpers%2FDonorFunctions.php
CVE ID: CVE-2025-4520 State: PUBLISHED Published: 2025-05-14T02:23:17.831Z Last Updated: 2025-05-14T13:22:58.671Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: uncannyowl Products: Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin Problem Types: CWE-862 Description: The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnr
ackers, with subscriber-level permissions or above to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve - https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99
CVE ID: CVE-2025-4522 State: PUBLISHED Published: 2025-11-07T04:28:54.987Z Last Updated: 2025-11-07T14:55:14.133Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: themeatelier Products: IDonate – Blood Donation, Request And Donor Management System Problem Types: CWE-862 Description: The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user
e wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0625ec-5ac9-4896-ac11-87fc9287f68a?source=cve - https://wordpress.org/plugins/idonate/#developers - https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/DonorFunctions.php#L658 - https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Admin/Admin.php#L75 - https://plugins.trac.wordpress.org/changeset/3334424/idonate/tags/2.1.10/src/Helpers/DonorFunctions.php?old=3279142&old_p
ttps://plugins.trac.wordpress.org/changeset/3334424/idonate/tags/2.1.10/src/Helpers/DonorFunctions.php?old=3279142&old_path=idonate%2Ftags%2F2.1.9%2Fsrc%2FHelpers%2FDonorFunctions.php
CVE ID: CVE-2025-4523 State: PUBLISHED Published: 2025-08-01T04:24:29.620Z Last Updated: 2025-08-01T19:15:23.091Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: themeatelier Products: IDonate – Blood Donation, Request And Donor Management System Problem Types: CWE-200 Description: The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address,
authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe7668b-9d70-44b7-a347-3922c0b8684c?source=cve - https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Admin/Admin.php#L76 - https://wordpress.org/plugins/idonate/#developers - https://plugins.trac.wordpress.org/browser/idonate/tags/2.1.9/src/Helpers/IDonateAjaxHandler.php#L48 - https://plugins.trac.wordpress.org/changeset/3334424/
CVE ID: CVE-2025-4524 State: PUBLISHED Published: 2025-05-21T06:39:46.492Z Last Updated: 2025-05-21T10:15:59.745Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WPStylish Products: Madara – Responsive and modern WordPress theme for manga sites Problem Types: CWE-22 Description: The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to byp
nd execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ee01da-218a-421d-8f9c-1dc6c056ef74?source=cve - https://mangabooth.com/product/wp-manga-theme-madara/
CVE ID: CVE-2025-4525 State: PUBLISHED Published: 2025-05-10T22:31:05.153Z Last Updated: 2025-05-12T14:39:10.569Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Discord Problem Types: CWE-427, CWE-426 Description: A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was cont
exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308270 - https://vuldb.com/?ctiid.308270 - https://vuldb.com/?submit.562788 - https://gist.github.com/shellkraft/ac4be6a3953e2889a7bf54aea2db88c2
CVE ID: CVE-2025-4526 State: PUBLISHED Published: 2025-05-11T01:00:06.924Z Last Updated: 2025-05-12T14:38:15.234Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dígitro Products: NGC Explorer Problem Types: CWE-549, CWE-200 Description: A vulnerability, which was classified as problematic, was found in Dígitro NGC Explorer 3.44.15. This affects an unknown part of the component Configuration Page. The manipulation leads to missing password field masking. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
is disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308271 - https://vuldb.com/?ctiid.308271 - https://vuldb.com/?submit.565307
CVE ID: CVE-2025-4527 State: PUBLISHED Published: 2025-05-11T02:00:06.268Z Last Updated: 2025-05-12T14:37:50.244Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dígitro Products: NGC Explorer Problem Types: CWE-602 Description: A vulnerability has been found in Dígitro NGC Explorer 3.44.15 and classified as problematic. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to client-side enforcement of server-side security. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but di
ck is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308272 - https://vuldb.com/?ctiid.308272 - https://vuldb.com/?submit.565308
CVE ID: CVE-2025-4528 State: PUBLISHED Published: 2025-05-11T03:00:06.849Z Last Updated: 2025-05-12T14:33:36.562Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dígitro Products: NGC Explorer Problem Types: CWE-613 Description: A vulnerability was found in Dígitro NGC Explorer up to 3.44.15 and classified as problematic. This issue affects some unknown processing. The manipulation leads to session expiration. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308273 - https://vuldb.com/?ctiid.308273 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308273 - https://vuldb.com/?ctiid.308273 - https://vuldb.com/?submit.565309
CVE ID: CVE-2025-4529 State: PUBLISHED Published: 2025-05-11T04:00:08.206Z Last Updated: 2025-05-12T14:00:29.397Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Seeyon Products: Zhiyuan OA Web Application System Problem Types: CWE-22 Description: A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\WEB-INF\lib\seeyon-apps-m3.jar!\com\seeyon\apps\m3\core\controller\M3CoreController.class of the component ZIP File Handler. The manipulation of the argument Name leads to path traversal. It is possible
.class of the component ZIP File Handler. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.308274 - https://vuldb.com/?ctiid.308274 - https://vuldb.com/?submit.565379 - https://wx.mail.qq.com/s?k=h3jd6HR4UnUJxQZ0RG