Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10194 State: PUBLISHED Published: 2025-10-15T08:26:04.836Z Last Updated: 2025-10-15T13:21:06.725Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: eflyjason Products: Shortcode Button Problem Types: CWE-79 Description: The Shortcode Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8119092-d513-4e6c-ab83-d4a49ec66281?source=cve - https://plugins.trac.wordpress.org/browser/shortcode-button/trunk/shortcode-button.php#L65 - https://wordpress.org/plugins/shortcode-button/
CVE ID: CVE-2025-10195 State: PUBLISHED Published: 2025-09-10T00:02:05.924Z Last Updated: 2025-09-10T13:05:57.042Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Seismic App Problem Types: CWE-926 Description: A vulnerability has been found in Seismic App 2.4.2 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.seismic.doccenter. Such manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any
disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323235 - https://vuldb.com/?ctiid.323235 - https://vuldb.com/?submit.639041 - https://github.com/KMov-g/androidapps/blob/main/com.seismic.doccenter.md - https://github.com/KMov-g/androidapps/blob/main/com.seismic.doccenter.md#steps-to-reproduce
CVE ID: CVE-2025-10196 State: PUBLISHED Published: 2025-09-30T03:35:33.767Z Last Updated: 2025-09-30T13:12:25.090Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sdebois Products: Survey Anyplace Problem Types: CWE-79 Description: The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplace_embed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use
kers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efdb6ec5-e6a8-4279-b637-38267a852472?source=cve - https://plugins.svn.wordpress.org/surveyanyplace/trunk/resources/library/surveyanyplace-shortcodes.php - https://plugins.svn.wordpress.org/surveyanyplace/trunk/resources/templates/surveyanyplace.php
CVE ID: CVE-2025-10197 State: PUBLISHED Published: 2025-09-10T00:32:06.598Z Last Updated: 2025-09-10T13:03:58.941Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: HJSoft Products: HCM Human Resources Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the file /templates/attestation/../../selfservice/lawresource/downlawbase. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor wa
ection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323236 - https://vuldb.com/?ctiid.323236 - https://vuldb.com/?submit.639745 - https://github.com/eeeeeekkkkkkkk/POC/blob/main/%E5%AE%8F%E6%99%AFHCM%20%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9Fdownlawbase%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
CVE ID: CVE-2025-10198 State: PUBLISHED Published: 2025-09-09T17:28:14.696Z Last Updated: 2025-11-03T18:08:24.774Z Vendors: LizardByte Products: Sunshine for Windows Problem Types: CWE-427 Uncontrolled Search Path Element Description: Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LizardByte/Sunshine/pull/3971
CVE ID: CVE-2025-10199 State: PUBLISHED Published: 2025-09-09T17:30:19.958Z Last Updated: 2025-11-03T18:08:25.842Z Vendors: LizardByte Products: Sunshine for Windows Problem Types: CWE-428: Unquoted Search Path or Element Description: A local privilege escalation vulnerability exists in Sunshine for Windows (version v2025.122.141614 and likely prior versions) due to an unquoted service path. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LizardByte/Sunshine/security/advisories/GHSA-r3rw-mx4q-7vfp
CVE ID: CVE-2025-10200 State: PUBLISHED Published: 2025-09-10T19:12:02.495Z Last Updated: 2025-09-11T03:56:29.807Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html - https://issues.chromium.org/issues/440454442
CVE ID: CVE-2025-10201 State: PUBLISHED Published: 2025-09-10T19:12:03.219Z Last Updated: 2025-09-11T03:56:31.571Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Mojo in Google Chrome on Android, Linux, ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_9.html - https://issues.chromium.org/issues/439305148
CVE ID: CVE-2025-10203 State: PUBLISHED Published: 2025-09-15T16:27:44.315Z Last Updated: 2025-09-15T18:07:25.615Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Digilent Products: WaveForms Problem Types: CWE-23 Description: Relative path traversal vulnerability due to improper input validation in Digilent WaveForms that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .DWF3WORK file. This vulnerability affects Digilent WaveForms 3.24.3 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/relative-path-traversal-vulnerability-in-digilent-waveforms.html
CVE ID: CVE-2025-10204 State: PUBLISHED Published: 2025-09-14T12:43:30.393Z Last Updated: 2025-09-15T15:58:31.372Z Vendors: LG Electronics Products: AC Smart II Problem Types: CWE-306 Description: A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to change the administrator password without verifying login status or user permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lgsecurity.lge.com/bulletins
CVE ID: CVE-2025-10205 State: PUBLISHED Published: 2025-09-17T14:51:52.567Z Last Updated: 2025-09-18T11:22:31.377Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: FLXEON Problem Types: CWE-759 Description: Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE ID: CVE-2025-10207 State: PUBLISHED Published: 2025-09-18T11:25:07.835Z Last Updated: 2025-09-18T13:32:39.633Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: FLXEON Problem Types: CWE-1287 Description: Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7121&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE ID: CVE-2025-10209 State: PUBLISHED Published: 2025-09-10T18:32:06.527Z Last Updated: 2025-09-10T18:49:58.764Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Papermerge Products: DMS Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in Papermerge DMS up to 3.5.3. This issue affects some unknown processing of the component Authorization Token Handler. Performing manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
d. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323482 - https://vuldb.com/?ctiid.323482 - https://vuldb.com/?submit.639750 - https://docs.google.com/document/d/19j0mCR-QOuhlxAJMir00Z8_MZdydVdmE_Ak09ra2NHw/edit?usp=sharing
CVE ID: CVE-2025-10210 State: PUBLISHED Published: 2025-09-10T19:02:06.847Z Last Updated: 2025-09-10T19:16:38.028Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manipulation of the argument key can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
e exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323483 - https://vuldb.com/?ctiid.323483 - https://vuldb.com/?submit.639777 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e5.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e5.md#poc
CVE ID: CVE-2025-10211 State: PUBLISHED Published: 2025-09-10T20:02:05.846Z Last Updated: 2025-09-10T20:14:34.320Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: yanyutao0402 Products: ChanCMS Problem Types: CWE-918 Description: A security vulnerability has been detected in yanyutao0402 ChanCMS 3.3.0. The affected element is the function CollectController of the file /cms/collect/getArticle. The manipulation of the argument taskUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Ana
cly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323484 - https://vuldb.com/?ctiid.323484 - https://vuldb.com/?submit.639779 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e7.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e7.md#poc
CVE ID: CVE-2025-10212 State: PUBLISHED Published: 2025-10-03T11:17:06.242Z Last Updated: 2025-10-03T15:59:19.663Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: sitealert Products: SiteAlert (Formerly WP Health) Problem Types: CWE-862 Description: The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc. Additional Analyst Notes: - CISA ADP Vuln
uding a list of installed and outdated plugins, PHP and Database version, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0696b9e2-3685-4bea-8b1f-74e2dc927532?source=cve - https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L129 - https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L159 - https://plugins.trac.wordpress.org/browser/my-wp-health-check/tags/1.9.8/php/ajax.php#L144
CVE ID: CVE-2025-10213 State: PUBLISHED Published: 2025-09-10T11:38:37.847Z Last Updated: 2025-09-10T20:23:13.325Z Vendors: UPDF Products: UPDF Problem Types: CWE-427 Description: DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a dxtn.dll file of their choice in the 'C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\' directory, which could lead to arbitrary code execution and persistence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf
CVE ID: CVE-2025-10214 State: PUBLISHED Published: 2025-09-10T11:39:12.641Z Last Updated: 2025-09-10T20:22:38.145Z Vendors: UPDF Products: UPDF Problem Types: CWE-427 Description: DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\<user>\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf
CVE ID: CVE-2025-10215 State: PUBLISHED Published: 2025-09-10T11:39:30.395Z Last Updated: 2025-09-10T20:22:06.791Z Vendors: UPDF Products: UPDF Problem Types: CWE-427 Description: DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-updf
CVE ID: CVE-2025-10216 State: PUBLISHED Published: 2025-09-10T21:02:05.844Z Last Updated: 2025-09-11T15:33:10.813Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: GrandNode Problem Types: CWE-362 Description: A vulnerability was detected in GrandNode up to 2.3.0. The impacted element is an unknown function of the file /checkout/ConfirmOrder/ of the component Voucher Handler. The manipulation of the argument giftvouchercouponcode results in race condition. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The vendor was contacted early about this disclosur
gh level of complexity. The exploitability is regarded as difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323485 - https://vuldb.com/?ctiid.323485 - https://vuldb.com/?submit.640784
CVE ID: CVE-2025-10217 State: PUBLISHED Published: 2025-09-30T12:10:23.803Z Last Updated: 2025-10-28T10:28:45.480Z Vendors: Hitachi Energy Products: Asset Suite Problem Types: CWE-117 Description: A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject crafted data in logfile for potentially carrying out further malicious attacks. Performance logging is typically enabled for troubleshooting purposes while resolving application performance related issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000226&LanguageCode=en&DocumentPartId=
ichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000226&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-10218 State: PUBLISHED Published: 2025-09-10T21:32:05.313Z Last Updated: 2025-09-11T15:30:05.056Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: lostvip-com Products: ruoyi-go Problem Types: CWE-89, CWE-74 Description: A flaw has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Background Management Page. This manipulation of the argument sortName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addit
en published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323486 - https://vuldb.com/?ctiid.323486 - https://vuldb.com/?submit.641027 - https://github.com/on-theway/cve/issues/10
CVE ID: CVE-2025-10219 State: REJECTED Published: 2025-09-10T12:26:57.877Z Last Updated: 2025-09-10T12:30:53.317Z Description: No description available.
CVE ID: CVE-2025-10220 State: PUBLISHED Published: 2025-09-10T12:28:39.023Z Last Updated: 2025-10-08T11:26:39.629Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-1104 Description: Use of Unmaintained Third Party Components (CWE-1104) in the NuGet dependency components in AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 on Windows allows a remote attacker to execute arbitrary code or bypass security features via exploitation of vulnerable third-party packages such as Google.Protobuf, DynamicData, System.Runtime.CompilerServices.Unsafe, and others. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
icData, System.Runtime.CompilerServices.Unsafe, and others. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10221 State: PUBLISHED Published: 2025-09-10T12:31:52.575Z Last Updated: 2025-10-08T12:02:15.274Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: AxxonSoft Products: AxxonNet ARP Agent C-WerkNet Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Windows platforms allows a local attacker to obtain plaintext credentials via reading TRACE log files containing serialized JSON with passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10222 State: PUBLISHED Published: 2025-09-10T12:34:50.665Z Last Updated: 2025-10-08T11:46:46.982Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the diagnostic dump component in AxxonSoft Axxon One VMS (C-Werk) 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such as timestamps, license states, and registry values via reading diagnostic export files created by the built-in troubleshooting tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
port files created by the built-in troubleshooting tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10223 State: PUBLISHED Published: 2025-09-10T12:35:32.800Z Last Updated: 2025-10-08T11:49:37.530Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-613 Description: Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/securi
- CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10224 State: PUBLISHED Published: 2025-09-10T12:36:22.954Z Last Updated: 2025-10-08T11:50:36.640Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-287 Description: Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One (C-Werk) 2.0.2 and earlier on Windows allows a remote authenticated user to be denied access or misassigned roles via incorrect evaluation of nested LDAP group memberships during login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-adviso
DP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10225 State: PUBLISHED Published: 2025-09-10T12:37:15.117Z Last Updated: 2025-10-08T11:51:39.395Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-119 Description: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) in the OpenSSL-based session module in AxxonSoft Axxon One (C-Werk) 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cause application crashes or unpredictable behavior via triggering memory reallocation errors when handling expired session keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http