Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-60450 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T15:48:16.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XS
cessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-Vulnerability-in-MetInfo-via-SVG-Upload/
CVE ID: CVE-2025-60451 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T14:26:51.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
when the uploaded file is viewed or accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-Vulnerability-in-MetInfo-Webset-Module/
CVE ID: CVE-2025-60452 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T14:28:26.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\download_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Download-Module/
CVE ID: CVE-2025-60453 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T14:29:30.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Column-Module
Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Column-Module/
CVE ID: CVE-2025-60454 State: PUBLISHED Published: 2025-10-03T00:00:00.000Z Last Updated: 2025-10-03T15:46:31.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\img_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Image-Module/
CVE ID: CVE-2025-60455 State: PUBLISHED Published: 2025-11-18T00:00:00.000Z Last Updated: 2025-11-19T18:47:17.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/modular/modular/issues/4795 - https://github.com/modular/modular/blame/main/max/serve/kvcache_agent/kvcache_agent.py#L220 - https://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4 - https://github.com/modular/modular/commi
://github.com/modular/modular/commit/10620059fb5c47fb0c30e5d21a8ff3b8d622fba4 - https://github.com/modular/modular/commit/ee9c4ab02345dd30bed8b79771b6909ff1b930a1 - https://github.com/modular/modular/commit/b20e749fa892dbe772e890a268002f732164d9f5 - https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem
CVE ID: CVE-2025-60500 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T18:32:03.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/H4zaz/CVE-2025-60500
CVE ID: CVE-2025-60503 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-03T16:35:11.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session, which could lead to session hijacking or other malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ead to session hijacking or other malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ultimatefosters.com - https://github.com/H4zaz/CVE-2025-60503
CVE ID: CVE-2025-60506 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T14:53:49.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://onurcangenc.com.tr/
ttacker-controlled actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://onurcangenc.com.tr/blog/moodle-xss-pdfannotator - https://github.com/onurcangnc/moodle-xss-pdfannotator - https://onurcangenc.com.tr/posts/cve-2025-60506-stored-cross-site-scripting-xss-in-moodle-pdf-annotator-plugin-v1-5-release-9/
CVE ID: CVE-2025-60507 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T18:30:11.863Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/securi
ad executes in their browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/security/ - https://onurcangenc.com.tr/posts/moodle-genia%C4%B1-plugin-vulnerability-stored-reflected-xss-via-pdf-upload-and-chatbot-%C4%B1nput/ - https://github.com/onurcangnc/moodle_genai_plugin_xss - https://moodle.org/plugins/local_geniai
CVE ID: CVE-2025-60511 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T18:35:59.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries that are executed with that block's configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources. Additional Analyst Notes: - CISA A
Source of Truth entries, alter model behavior, and potentially misuse API resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://moodle.com - http://openai.com - https://onurcangenc.com.tr/posts/idor-in-moodle-openai-chat-block-block_openai_chat-proof-of-concept-poc--cve-2025-60511/ - https://github.com/onurcangnc/moodle_block_openai_chat
CVE ID: CVE-2025-60514 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-17T19:34:19.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tillywork/tillywork/pull/288/commits/c57171fd17a857d7ec79e9051b23ace98d5c6a17 - https://www.secstrike.ai/cve-2025-60514-tillywork-sql-injection-public-disclosure/
CVE ID: CVE-2025-60535 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T18:21:25.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://wallos.com - https://github.com/ellite/Wallos/ - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60535.md
CVE ID: CVE-2025-60536 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T18:27:15.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS) via uploading a crafted configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/provectus/kafka-ui - https://github.com/provectus/kafka-ui/blob/v0.7.2/kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/builtin/sr/SchemaRegistrySerde.java - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60536.md
CVE ID: CVE-2025-60537 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T18:30:01.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/provectus/kafka-ui - https://github.com/provectus/kafka-ui/blob/v0.7.2/kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/CustomSerdeLoader.java - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60537.md
CVE ID: CVE-2025-60540 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-15T19:25:40.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/karakeep-app/karakeep/ - https://github.com/vityuasd/VulList/blob/main/CVE-2025-60540.md
CVE ID: CVE-2025-60541 State: PUBLISHED Published: 2025-11-06T00:00:00.000Z Last Updated: 2025-11-07T15:20:19.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/linshenkx/prompt-optimizer/issues/179 - https://github.com/linshenkx/prompt-optimizer
CVE ID: CVE-2025-60542 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-30T20:28:41.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/typeorm/typeorm/releases?q=security&expanded=true - https://github.com/typeorm/typeorm/pull/11574 - https://github.com/typeorm/typeorm/releases/tag/0.3.26 - https://medium.com/@alizada.cavad/cve-2025-60542-typeorm-mysql-sqli-0-3-25-a1b32bc60453
CVE ID: CVE-2025-60547 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:09:34.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/02-buffer%20overflow-formSetWAN_Wizard7.md
CVE ID: CVE-2025-60548 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T17:32:22.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/01-buffer%20overflow-formLanSetupRouterSettings.md
CVE ID: CVE-2025-60549 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:05:38.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/05-buffer%20overflow-formAutoDetecWAN_wizard4.md
CVE ID: CVE-2025-60550 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:06:38.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/04-buffer%20overflow-formEasySetTimezone.md
CVE ID: CVE-2025-60551 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:07:36.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/07-buffer%20overflow-formDeviceReboot.md
CVE ID: CVE-2025-60552 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:08:33.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/06-buffer%20overflow-formTcpipSetup.md
CVE ID: CVE-2025-60553 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T17:30:11.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/03-buffer%20overflow-formSetWAN_Wizard52.md
CVE ID: CVE-2025-60554 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T18:42:30.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/08-buffer%20overflow-formSetEnableWizard.md
CVE ID: CVE-2025-60555 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T19:59:04.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/10-buffer%20overflow-formSetWizardSelectMode.md
CVE ID: CVE-2025-60556 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:01:10.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/09-buffer%20overflow-formSetWizard1.md
CVE ID: CVE-2025-60557 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:02:44.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/13-buffer%20overflow-formSetEasy_Wizard.md
CVE ID: CVE-2025-60558 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:04:10.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/16-buffer%20overflow-formVirtualServ.md
CVE ID: CVE-2025-60559 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:04:00.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/19-buffer%20overflow-formSetDomainFilter.md
CVE ID: CVE-2025-60561 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:05:10.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/12-buffer%20overflow-formSetEmail.md
CVE ID: CVE-2025-60562 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T15:59:28.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/15-buffer%20overflow-formWlSiteSurvey.md
CVE ID: CVE-2025-60563 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T15:57:23.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/18-buffer%20overflow-formSetPortTr.md
CVE ID: CVE-2025-60564 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T15:55:16.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/14-buffer%20overflow-formSetLog.md
CVE ID: CVE-2025-60565 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:13:10.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/17-buffer%20overflow-formSchedule.md
CVE ID: CVE-2025-60566 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:12:01.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/20-buffer%20overflow-formSetMACFilter.md
CVE ID: CVE-2025-60568 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:19:15.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/23-buffer%20overflow-formAdvFirewall.md
CVE ID: CVE-2025-60569 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:16:16.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/luckysmallbird/DLINK-DIR600LAx-Vulnerability/blob/main/25-buffer%20overflow-formSetRoute.md