Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
handling and exposed Electron APIs. All users of 5ire client versions prior to patched releases, particularly those interacting with untrusted chatbots or pasting external content, are affected. Version 0.11.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanbingxyz/5ire/security/advisories/GHSA-mr8w-mmvv-6hq8 - https://github.com/nanbingxyz/5ire/commit/56601e012095194a4be0d4cb6da6b5b3cb53dea8 - https://positive.security/blog/url-open-rce - https://shabarkin.notion.site/1-click-RCE-in-Electron-Applications-501c2e96e7934610979cd3c72e844a22 - https://www.electronjs.org/docs/latest/tutorial/security - https://www.youtube.com/
s-501c2e96e7934610979cd3c72e844a22 - https://www.electronjs.org/docs/latest/tutorial/security - https://www.youtube.com/watch?v=ROFYhS9E9eU
CVE ID: CVE-2025-47778 State: PUBLISHED Published: 2025-05-14T15:29:08.187Z Last Updated: 2025-05-14T18:13:14.564Z Vendors: sulu Products: sulu Problem Types: CWE-611 Description: Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has been patched in versions 2.6.9, 2.5.25, and 3.0.0-alpha3. As a workaround, one may patch the effect file `src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually. Additional Analyst Notes: - CISA ADP Vulnric
`src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php` manually. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255 - https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544 - https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php
CVE ID: CVE-2025-47779 State: PUBLISHED Published: 2025-05-22T16:54:26.314Z Last Updated: 2025-11-03T20:04:36.858Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: asterisk Products: asterisk Problem Types: CWE-140, CWE-792 Description: Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows
any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisor
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw - https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
CVE ID: CVE-2025-47780 State: PUBLISHED Published: 2025-05-22T16:56:28.937Z Last Updated: 2025-11-03T20:04:38.254Z Vendors: asterisk Products: asterisk Problem Types: CWE-78 Description: Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expec
urity risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2
CVE ID: CVE-2025-47781 State: PUBLISHED Published: 2025-05-14T15:52:13.559Z Last Updated: 2025-05-14T17:37:43.435Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lukevella Products: rallly Problem Types: CWE-331 Description: Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the authentication. A token that consists of 6 digits only presents weak entropy however and when coupled with no token brute force protection, makes
at consists of 6 digits only presents weak entropy however and when coupled with no token brute force protection, makes it possible for an unauthenticated attacker with knowledge of a valid email address to successfully brute force the token within 15 minutes (token expiration time) and take over the account associated with the targeted email address. All users on the Rallly applications are impacted. As long as an attacker knows the user's email address they used to register on the app, they can systematically take over any user account. For the authentication mechanism to be safe, the token would need to be assigned a complex high entropy value that cannot be bruteforced within reasonable
be safe, the token would need to be assigned a complex high entropy value that cannot be bruteforced within reasonable time, and ideally rate limiting the /api/auth/callback/email endpoint to further make brute force attempts unreasonable within the 15 minutes time. As of time of publication, no patched versions are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lukevella/rallly/security/advisories/GHSA-gm8g-3r3j-48hv
CVE ID: CVE-2025-47782 State: PUBLISHED Published: 2025-05-14T15:54:59.309Z Last Updated: 2025-05-14T17:36:32.512Z Vendors: motioneye-project Products: motioneye Problem Types: CWE-78 Description: motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually. Addition
efault. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588 - https://github.com/motioneye-project/motioneye/issues/3142 - https://github.com/motioneye-project/motioneye/pull/3143
CVE ID: CVE-2025-47783 State: PUBLISHED Published: 2025-05-14T23:01:17.213Z Last Updated: 2025-05-15T15:32:26.174Z Vendors: HumanSignal Products: label-studio Problem Types: CWE-79 Description: Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views
ST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HumanSignal/label-studio/security/advisories/GHSA-8jhr-wpcm-hh4h
CVE ID: CVE-2025-47784 State: PUBLISHED Published: 2025-05-15T19:21:15.280Z Last Updated: 2025-05-16T16:15:56.526Z Vendors: emlog Products: emlog Problem Types: CWE-502 Description: Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause `str_replace` to replace the value of `name_orig` with empty, causing deserialization to fail and return `false`. Commit 9643250802188b791419e3c2188577073256a8a2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-f56g-m99v-mqc3 - https://github.com/emlog/emlog
t: References: - https://github.com/emlog/emlog/security/advisories/GHSA-f56g-m99v-mqc3 - https://github.com/emlog/emlog/commit/9643250802188b791419e3c2188577073256a8a2
CVE ID: CVE-2025-47785 State: PUBLISHED Published: 2025-05-15T19:29:23.499Z Last Updated: 2025-05-19T14:35:52.539Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: emlog Products: emlog Problem Types: CWE-89 Description: Emlog is an open source website building system. In versions up to and including 2.5.9, SQL injection occurs because the $origContent parameter in admin/article_save.php is not strictly filtered. Since admin/article_save.php can be accessed by ordinary registered users, this will cause SQL injection to occur when the registered site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend
d site is enabled, resulting in the injection of the admin account and password, which is then exploited by the backend remote code execution. As of time of publication, it is unknown whether a fix exists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-939m-47f7-m559
CVE ID: CVE-2025-47786 State: PUBLISHED Published: 2025-05-15T19:33:24.271Z Last Updated: 2025-05-19T14:40:12.463Z Vendors: emlog Products: emlog Problem Types: CWE-79 Description: Emlog is an open source website building system. Version 2.5.13 has a stored cross-site scripting vulnerability that allows any registered user to construct malicious JavaScript, inducing all website users to click. In `/admin/comment.php`, the parameter `perpage_num` is not validated and is directly stored in the `admin_commend_perpage_num` field of the `emlog_options` table in the database. Moreover, the output is not filtered, resulting in the direct output of malicious code. As of time of publication, it is un
eover, the output is not filtered, resulting in the direct output of malicious code. As of time of publication, it is unclear if a patch exists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-82qc-9vg7-2c6c
CVE ID: CVE-2025-47787 State: PUBLISHED Published: 2025-05-15T19:27:03.663Z Last Updated: 2025-05-19T14:34:51.439Z Vendors: emlog Products: emlog Problem Types: CWE-434 Description: Emlog is an open source website building system. Emlog Pro prior to version 2.5.10 contains a file upload vulnerability. The store.php component contains a critical security flaw where it fails to properly validate the contents of remotely downloaded ZIP plugin files. This insufficient validation allows attackers to execute arbitrary code on the vulnerable system. Version 2.5.10 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security
for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/security/advisories/GHSA-4mcj-8gvh-p753 - https://github.com/emlog/emlog/commit/691c13e90df2fb35e120f4e0735078bad018eed7
CVE ID: CVE-2025-47788 State: PUBLISHED Published: 2025-05-15T19:40:58.761Z Last Updated: 2025-05-19T14:43:37.687Z Vendors: Atheos Products: Atheos Problem Types: CWE-22, CWE-23 Description: Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$target` parameter in `/controller.php` was not properly validated, which could allow an attacker to execute arbitrary files on the server via path traversal. v602 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Atheos/Atheos/security/advisories/GHSA-x9vw-6vfx-7rx5 - https://github.com/Atheos/Atheos/commit/97fe76871578d2011eb
.com/Atheos/Atheos/security/advisories/GHSA-x9vw-6vfx-7rx5 - https://github.com/Atheos/Atheos/commit/97fe76871578d2011ebe9281f3a005c5df85162b
CVE ID: CVE-2025-47789 State: PUBLISHED Published: 2025-05-15T19:50:28.480Z Last Updated: 2025-05-16T14:51:36.535Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: horilla-opensource Products: horilla Problem Types: CWE-601 Description: Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers to an external domain. Upon clicking and logging in, the user is redirected to an external domain. This allows the redirection to any arbitrary site, including phishing or malicious domains, which can be used to impersonate Horilla and trick users. Commit 1c72404df6888b
including phishing or malicious domains, which can be used to impersonate Horilla and trick users. Commit 1c72404df6888bb23af73c767fdaee5e6679ebd6 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/horilla-opensource/horilla/security/advisories/GHSA-cqp5-xx4j-r468 - https://github.com/horilla-opensource/horilla/commit/1c72404df6888bb23af73c767fdaee5e6679ebd6
CVE ID: CVE-2025-47790 State: PUBLISHED Published: 2025-05-16T14:02:57.806Z Last Updated: 2025-05-16T14:51:08.989Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-287 Description: Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime
er a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions. Additional Analyst Notes: - CISA ADP Vulnrichm
configuration change. System administration can delete affected sessions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9h3w-f3h4-qqrh - https://github.com/nextcloud/server/pull/51905 - https://hackerone.com/reports/2729367
CVE ID: CVE-2025-47791 State: PUBLISHED Published: 2025-05-16T14:09:27.322Z Last Updated: 2025-05-16T14:50:38.405Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-918 Description: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0
r server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c7vq-m7f8-rx37 - https://github.com/nextcloud/server/pull/49558
CVE ID: CVE-2025-47792 State: PUBLISHED Published: 2025-05-16T14:13:53.209Z Last Updated: 2025-05-16T14:27:53.727Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichmen
op fixes the issue in version 3.15. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65 - https://github.com/nextcloud/desktop/pull/7517 - https://hackerone.com/reports/1995856
CVE ID: CVE-2025-47793 State: PUBLISHED Published: 2025-05-16T14:31:50.742Z Last Updated: 2025-05-16T14:49:07.567Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-770 Description: Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload f
p prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgg-hhfq-vhww - https://github.com/nextcloud/groupfolders/pull/3328 - https://github.com/nextcloud/server/pull/48623 - https://hackerone.com/reports/2713272
CVE ID: CVE-2025-47794 State: PUBLISHED Published: 2025-05-16T14:35:25.280Z Last Updated: 2025-05-16T14:48:34.016Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may read temporary files from Nextcloud running with a different user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Ente
ifferent user account, or run a symlink attack. Nextcloud Server versions 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1 fix the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q568-2933-gcjq - https://github.com/nextcloud/server/pull/51194 - https://hackerone.com/reports/1960647
CVE ID: CVE-2025-47806 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-08T15:46:31.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gstreamer.freedesktop.org/security/ - https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
CVE ID: CVE-2025-47807 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-12T13:54:09.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gstreamer.freedesktop.org/security/ - https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
CVE ID: CVE-2025-47808 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T19:50:58.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gstreamer.freedesktop.org/security/ - https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md
CVE ID: CVE-2025-47809 State: PUBLISHED Published: 2025-05-16T00:00:00.000Z Last Updated: 2025-05-16T13:36:00.498Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Wibu Products: CodeMeter Problem Types: CWE-272 Description: Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Exp
een restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wibu.com/support/security-advisories/wibu-100120.html
CVE ID: CVE-2025-47811 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-15T13:44:06.934Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: wftpserver Products: Wing FTP Server Problem Types: CWE-267 Description: In Wing FTP Server through 7.4.4, the administrative web interface (listening by default on port 5466) runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands (i.e., through the web console or the task scheduler), and they are automatically executed in the highest possible privilege context. Because administrative users of the web interface are not neces