Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26319 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-05T16:45:28.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dorattias/CVE-2025-26319
CVE ID: CVE-2025-26320 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-05T18:35:39.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/t0mer/broadlinkmanager-docker - https://github.com/t0mer/broadlinkmanager-docker/blob/master/broadlinkmanager/broadlinkmanager.py#L639-L657 - https://github.com/BaranTeyin1/vulnerability-research/tree/main/CVE-2025-26320
CVE ID: CVE-2025-26325 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T21:27:37.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gongfuxiang/shopxo/issues/86
CVE ID: CVE-2025-26326 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-13T15:22:13.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism. Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common seq
te that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders. The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nvaccess.org - https://github.com/azurejoga/CVE-2025-26326 - https://nvdaremote.com/ - https://github.com/NVDARemote/NVDARemote - https://github.com/nvda-e
zurejoga/CVE-2025-26326 - https://nvdaremote.com/ - https://github.com/NVDARemote/NVDARemote - https://github.com/nvda-es/TeleNVDA - https://nvda-addons.org/addon.php?id=270
CVE ID: CVE-2025-26330 State: PUBLISHED Published: 2025-04-10T02:10:11.578Z Last Updated: 2025-04-11T03:55:26.018Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-863 Description: Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability to access the cluster with previous privileges of a disabled user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale
hment: References: - https://www.dell.com/support/kbdoc/en-us/000300860/dsa-2025-119-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE ID: CVE-2025-26331 State: PUBLISHED Published: 2025-03-07T08:06:12.680Z Last Updated: 2025-03-11T03:55:16.832Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Wyse Proprietary OS (Modern ThinOS) Problem Types: CWE-77 Description: Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000289886/dsa-2025-107
CVE ID: CVE-2025-26332 State: PUBLISHED Published: 2025-07-30T17:55:55.248Z Last Updated: 2025-08-05T03:56:16.757Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: TechAdvisor Problem Types: CWE-532 Description: TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CISA ADP Vulnr
access the vulnerable application with privileges of the compromised account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000337241/dsa-2025-108-security-update-for-dell-emc-xtremio-x2
CVE ID: CVE-2025-26333 State: PUBLISHED Published: 2025-09-25T15:16:41.383Z Last Updated: 2025-10-24T13:55:19.877Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: BSAFE Crypto-J Problem Types: CWE-209 Description: Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potentially exploit this vulnerability, leading to information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000296144/dsa-2025-100-dell-bsafe-crypto-j-security-update
CVE ID: CVE-2025-26335 State: PUBLISHED Published: 2025-04-11T01:20:28.507Z Last Updated: 2025-04-11T16:02:52.857Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: PowerProtect Cyber Recovery Problem Types: CWE-201 Description: Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000306005/dsa-2025-113-security-update-for-dell-power
lnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000306005/dsa-2025-113-security-update-for-dell-powerprotect-cyber-recovery
CVE ID: CVE-2025-26336 State: PUBLISHED Published: 2025-03-21T02:23:46.785Z Last Updated: 2025-03-21T13:59:49.924Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H) Vendors: Dell Products: Dell Chassis Management Controller (CMC) for Dell PowerEdge FX2, Dell Chassis Management Controller (CMC) for PowerEdge VRTX Problem Types: CWE-121 Description: Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX version(s) prior to 3.41.200.202209300499, contain(s) a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access
00.202209300499, contain(s) a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dell.com/support/kbdoc/en-us/000297463/dsa-2025-123-security-update-for-dell-chassis-management-controller-firmware-for-dell-poweredge-fx2-and-vrtx-vulnerabilities
CVE ID: CVE-2025-26339 State: PUBLISHED Published: 2025-02-12T13:26:40.883Z Last Updated: 2025-02-17T10:07:25.111Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-263
Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26339
CVE ID: CVE-2025-26340 State: PUBLISHED Published: 2025-02-12T13:26:53.241Z Last Updated: 2025-02-17T10:07:31.654Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-321 Description: A CWE-321 "Use of Hard-coded Cryptographic Key" in the JWT signing in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to bypass the authentication via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26340
CVE ID: CVE-2025-26341 State: PUBLISHED Published: 2025-02-12T13:27:01.120Z Last Updated: 2025-02-17T10:07:37.727Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26341
CVE ID: CVE-2025-26342 State: PUBLISHED Published: 2025-02-12T13:27:08.060Z Last Updated: 2025-02-17T10:07:43.571Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26342
CVE ID: CVE-2025-26343 State: PUBLISHED Published: 2025-02-12T13:27:15.132Z Last Updated: 2025-02-17T10:07:49.833Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-1390 Description: A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26343
CVE ID: CVE-2025-26344 State: PUBLISHED Published: 2025-02-12T13:27:21.371Z Last Updated: 2025-02-18T17:35:24.866Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26344
CVE ID: CVE-2025-26345 State: PUBLISHED Published: 2025-02-12T13:27:28.560Z Last Updated: 2025-02-18T17:34:41.369Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26345
CVE ID: CVE-2025-26346 State: PUBLISHED Published: 2025-02-12T13:27:34.734Z Last Updated: 2025-02-17T10:08:13.026Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Q-Free Products: MaxTime Problem Types: CWE-89 Description: A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-202
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26346
CVE ID: CVE-2025-26347 State: PUBLISHED Published: 2025-02-12T13:27:47.970Z Last Updated: 2025-02-17T10:08:18.709Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26347
CVE ID: CVE-2025-26348 State: PUBLISHED Published: 2025-02-12T13:27:54.227Z Last Updated: 2025-02-17T10:08:24.221Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Q-Free Products: MaxTime Problem Types: CWE-89 Description: A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-263
Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26348
CVE ID: CVE-2025-26349 State: PUBLISHED Published: 2025-02-12T13:27:59.971Z Last Updated: 2025-02-17T10:08:29.601Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-23 Description: A CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26349
CVE ID: CVE-2025-26350 State: PUBLISHED Published: 2025-02-12T13:28:05.735Z Last Updated: 2025-02-17T10:08:36.253Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-434 Description: A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26350
CVE ID: CVE-2025-26351 State: PUBLISHED Published: 2025-02-12T13:28:11.526Z Last Updated: 2025-02-17T10:08:42.407Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in the template download mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26351
CVE ID: CVE-2025-26352 State: PUBLISHED Published: 2025-02-12T13:28:17.120Z Last Updated: 2025-02-17T10:08:48.172Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26352
CVE ID: CVE-2025-26353 State: PUBLISHED Published: 2025-02-12T13:28:23.011Z Last Updated: 2025-02-17T10:08:54.350Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in maxtime/api/sql/sql.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26353
CVE ID: CVE-2025-26354 State: PUBLISHED Published: 2025-02-12T13:28:28.951Z Last Updated: 2025-02-17T10:08:59.841Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (copy endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26354
CVE ID: CVE-2025-26355 State: PUBLISHED Published: 2025-02-12T13:28:34.414Z Last Updated: 2025-02-17T10:09:05.779Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26355
CVE ID: CVE-2025-26356 State: PUBLISHED Published: 2025-02-12T13:28:40.634Z Last Updated: 2025-02-17T10:09:12.515Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26356
CVE ID: CVE-2025-26357 State: PUBLISHED Published: 2025-02-12T13:28:46.264Z Last Updated: 2025-02-17T10:09:18.675Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-35 Description: A CWE-35 "Path Traversal" in maxtime/api/database/database.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26357
CVE ID: CVE-2025-26358 State: PUBLISHED Published: 2025-02-12T13:28:52.297Z Last Updated: 2025-10-07T14:13:07.209Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) Vendors: Q-Free Products: MaxTime Problem Types: CWE-20 Description: A CWE-15 "External Control of System or Configuration Setting" in ldbMT.so in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to modify system configuration via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26358
CVE ID: CVE-2025-26359 State: PUBLISHED Published: 2025-02-12T13:28:58.627Z Last Updated: 2025-02-17T10:09:30.182Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26359
CVE ID: CVE-2025-26360 State: PUBLISHED Published: 2025-02-12T13:29:04.109Z Last Updated: 2025-02-17T10:09:35.544Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/persistance/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26360
CVE ID: CVE-2025-26361 State: PUBLISHED Published: 2025-02-12T13:29:10.061Z Last Updated: 2025-02-17T10:09:40.823Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to factory reset the device via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26361
CVE ID: CVE-2025-26362 State: PUBLISHED Published: 2025-02-12T13:29:15.849Z Last Updated: 2025-02-17T10:09:46.495Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26362
CVE ID: CVE-2025-26363 State: PUBLISHED Published: 2025-02-12T13:29:22.018Z Last Updated: 2025-02-17T10:09:52.043Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Q-Free Products: MaxTime Problem Types: CWE-306 Description: A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26363