Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
he script via the /query/{name} endpoint. The injected commands are executed with SYSTEM privileges, enabling full remote compromise. This capability is an intended feature, but the lack of safeguards or privilege separation makes it risky when exposed to untrusted actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/nscp_authenticated_rce.rb - https://www.exploit-db.com/exploits/48360 - https://vulncheck.com/advisories/nsclient-localtoremote-system-compromise
CVE ID: CVE-2025-34080 State: PUBLISHED Published: 2025-07-01T17:51:53.979Z Last Updated: 2025-11-21T19:25:27.043Z Vendors: Contec Co.,Ltd. Products: CONPROSYS HMI System (CHS) Problem Types: CWE-79 Description: The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU92266386/ - https://www.vulncheck.com/advisories/conprosys-hmi-system-reflected-xss
CVE ID: CVE-2025-34081 State: PUBLISHED Published: 2025-07-01T17:56:56.073Z Last Updated: 2025-11-21T19:24:57.237Z Vendors: Contec Co.,Ltd. Products: CONPROSYS HMI System (CHS) Problem Types: CWE-215 Description: The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jvn.jp/en/vu/JVNVU92266386/ - https://www.vulncheck.com/advisories/conprosys-hmi-system-exposed-php-debug-info
CVE ID: CVE-2025-34082 State: PUBLISHED Published: 2025-07-03T19:46:27.555Z Last Updated: 2025-11-19T14:36:48.342Z Vendors: IGEL Technology GmbH Products: OS Problem Types: CWE-78 Description: A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to improper input sanitization in the handling of specially crafted PROXYCMD commands on TCP ports 30022 and 5900. An unauthenticated attacker with network access to a vulnerable device can inject arbitrary commands, leading to remote code execution with elevated privileges. NOTE: IGEL OS v10.x has reached end-of-life (EOL) status. Additional Analyst
te code execution with elevated privileges. NOTE: IGEL OS v10.x has reached end-of-life (EOL) status. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/misc/igel_command_injection.rb - https://kb.igel.com/security-safety/current/isn-2021-01-igel-os-remote-command-execution-vulne - https://www.igel.com/wp-content/uploads/2021/02/lxos_11.04.270.txt - https://vulncheck.com/advisories/igel-os-secure-terminal-shadow-rce
CVE ID: CVE-2025-34083 State: REJECTED Published: 2025-07-09T00:50:19.933Z Last Updated: 2025-07-16T15:49:00.572Z Description: No description available.
CVE ID: CVE-2025-34084 State: REJECTED Published: 2025-07-09T00:49:52.654Z Last Updated: 2025-07-16T15:49:08.043Z Description: No description available.
CVE ID: CVE-2025-34085 State: REJECTED Published: 2025-07-09T00:48:47.721Z Last Updated: 2025-07-16T15:48:49.693Z Description: No description available.
CVE ID: CVE-2025-34086 State: PUBLISHED Published: 2025-07-03T19:46:16.190Z Last Updated: 2025-11-19T14:36:48.499Z Vendors: Bolt Products: CMS Problem Types: CWE-94, CWE-434 Description: Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /file
/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bolt/bolt/releases/tag/3.7.1 - https://www.exploit-db.com/exploits/48296 - https://www.rapid7.com/db/modules/exploit/unix/webapp/bolt_authenticated_rce/ - https://github.com/bolt/bolt - https://boltcms.io/newsitem/
com/db/modules/exploit/unix/webapp/bolt_authenticated_rce/ - https://github.com/bolt/bolt - https://boltcms.io/newsitem/major-announcements-bolt-3-eol-bolt-4-2-5-0-releases - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/bolt_authenticated_rce.rb
CVE ID: CVE-2025-34087 State: PUBLISHED Published: 2025-07-03T19:46:49.017Z Last Updated: 2025-11-19T14:36:48.677Z Vendors: Pi-hole LLC Products: Web Problem Types: CWE-78 Description: An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the underlying operating system with the privileges of the Pi-hole service user. This behavior was present in the legacy AdminLTE interface and has since been patched in later versions. Additional Analyst Notes: - CISA ADP
ent in the legacy AdminLTE interface and has since been patched in later versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/pihole_whitelist_exec.rb - https://pi-hole.net/ - https://github.com/pi-hole/web/releases/tag/v4.0 - https://pulsesecurity.co.nz/advisories/pihole-v3.3-vulns - https://vulncheck.com/advisories/pihole-adminlte-whitelist-rce
CVE ID: CVE-2025-34088 State: PUBLISHED Published: 2025-07-03T19:46:38.590Z Last Updated: 2025-11-19T14:36:48.845Z Vendors: Artica ST Products: Pandora FMS Problem Types: CWE-78 Description: An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rap
ommand injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/pandora_ping_cmd_exec.rb - https://www.exploit-db.com/exploits/48334 - https://www.rapid7.com/db/modules/exploit/linux/http/pandora_ping_cmd_exec/ - https://github.com/pandorafms/pandorafms - https://vulncheck.com/advisories/pandora-fms-rce-via-ping
CVE ID: CVE-2025-34089 State: PUBLISHED Published: 2025-07-03T19:47:00.455Z Last Updated: 2025-07-03T20:00:11.692Z Vendors: Aexol Studio Products: Remote for Mac Problem Types: CWE-306, CWE-94 Description: An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disabled (i.e., the "Allow unknown devices" option is enabled), the /api/executeScript endpoint is exposed without access control. This allows unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in
ws unauthenticated remote attackers to inject arbitrary AppleScript payloads via the X-Script HTTP header, resulting in code execution using do shell script. Successful exploitation grants attackers the ability to run arbitrary commands on the macOS host with the privileges of the Remote for Mac background process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/osx/http/remote_for_mac_rce.rb - https://www.rapid7.com/db/modules/exploit/osx/http/remote_for_mac_rce/ - https://apps.apple.com/us/app/remote-for-mac/id1086962925 - https://packetstorm.news/files/id/195347 - https://vulncheck.com/a
//apps.apple.com/us/app/remote-for-mac/id1086962925 - https://packetstorm.news/files/id/195347 - https://vulncheck.com/advisories/remote-for-mac-rce
CVE ID: CVE-2025-34090 State: REJECTED Published: 2025-07-02T19:25:13.805Z Last Updated: 2025-07-24T01:25:41.316Z Description: No description available.
CVE ID: CVE-2025-34091 State: REJECTED Published: 2025-07-02T19:25:27.579Z Last Updated: 2025-07-24T01:25:52.272Z Description: No description available.
CVE ID: CVE-2025-34092 State: REJECTED Published: 2025-07-02T19:25:35.752Z Last Updated: 2025-07-24T01:26:17.034Z Description: No description available.
CVE ID: CVE-2025-34093 State: PUBLISHED Published: 2025-07-10T19:13:44.410Z Last Updated: 2025-11-21T19:24:13.191Z Vendors: Polycom Products: HDX Series Problem Types: CWE-78 Description: An authenticated command injection vulnerability exists in the Polycom HDX Series command shell interface accessible over Telnet. The lan traceroute command in the devcmds console accepts unsanitized input, allowing attackers to execute arbitrary system commands. By injecting shell metacharacters through the traceroute interface, an attacker can achieve remote code execution under the context of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allo
ext of the root user. This flaw affects systems where Telnet access is enabled and either unauthenticated access is allowed or credentials are known. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb - https://staaldraad.github.io/2017/11/12/polycom-hdx-rce/ - https://web.archive.org/web/20200312205144/http://support.polycom.com/content/dam/polycom-support/global/documentation/securityadvisory-remotecodeexecutionon-hdx-v0.3-hotfix-release.pdf - https://www.exploit-db.com/exploits/24494 - https://vulncheck.com/advisories/polycom-hdx-series-telnet-rce
CVE ID: CVE-2025-34095 State: PUBLISHED Published: 2025-07-10T19:14:30.933Z Last Updated: 2025-07-11T13:21:05.453Z Vendors: Real Time Logic Products: Mako Server Problem Types: CWE-78 Description: An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is then persisted on disk and triggered via a subsequent GET request to examples/manage.lsp. This allows remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments. Addition
remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/makoserver_cmd_exec.rb - https://www.exploit-db.com/exploits/43132 - https://vulncheck/advisories/mako-server-rce
CVE ID: CVE-2025-34096 State: PUBLISHED Published: 2025-07-10T19:15:06.156Z Last Updated: 2025-11-21T19:23:01.461Z Vendors: EFS Software Inc. Products: Easy File Sharing HTTP Server Problem Types: CWE-119 Description: A stack-based buffer overflow vulnerability exists in Easy File Sharing HTTP Server version 7.2. The flaw is triggered when a crafted POST request is sent to the /sendemail.ghp endpoint containing an overly long Email parameter. The application fails to properly validate the length of this field, resulting in a memory corruption condition. An unauthenticated remote attacker can exploit this to execute arbitrary code with the privileges of the server process. Additional Analyst
emote attacker can exploit this to execute arbitrary code with the privileges of the server process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyfilesharing_post.rb - https://www.exploit-db.com/exploits/42186 - https://vulncheck/advisories/easy-file-sharing-http-server-buffer-overflow
CVE ID: CVE-2025-34097 State: PUBLISHED Published: 2025-07-10T19:12:37.309Z Last Updated: 2025-11-19T14:36:49.011Z Vendors: ProcessMaker Inc. Products: ProcessMaker Problem Types: CWE-434 Description: An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege es
erver with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_plugin_upload.rb - https://wiki.processmaker.net/3.0/Plugin_Development - https://www.fortiguard.com/encyclopedia/ips/45757 - https://www.exploit-db.com/exploits/44399 - https://process-maker-authenticated-plugin-upload-rce - https://vulncheck.com/advisories/process-maker-authenticated-plugin-u
://process-maker-authenticated-plugin-upload-rce - https://vulncheck.com/advisories/process-maker-authenticated-plugin-upload-rce
CVE ID: CVE-2025-34098 State: PUBLISHED Published: 2025-07-10T19:11:52.790Z Last Updated: 2025-07-10T20:25:47.596Z Vendors: Riverbed Technology Products: SteelHead VCX Problem Types: CWE-200 Description: A path traversal vulnerability exists in Riverbed SteelHead VCX appliances (confirmed in VCX255U 9.6.0a) due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter expressions to the log_filter endpoint using the filterStr parameter. This input is processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitra
processed by a backend parser that permits execution of file expansion syntax, allowing the attacker to retrieve arbitrary system files via the log viewing interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/riverbed_steelhead_vcx_file_read.rb - https://www.exploit-db.com/exploits/42101 - https://vulncheck.com/advisories/riverbed-steel-head-vcx-authenticated-arbitrary-file-read
CVE ID: CVE-2025-34099 State: PUBLISHED Published: 2025-07-10T19:10:18.695Z Last Updated: 2025-11-19T14:36:49.188Z Vendors: VICIdial Group Products: VICIdial Problem Types: CWE-78, CWE-20 Description: An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated
to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/vicidial_user_authorization_unauth_cmd_exec.rb - https://vulncheck.com/advisories/vicidial-unauth-command-injection - https://www.exploit-db.com/exploits/42370
CVE ID: CVE-2025-34100 State: PUBLISHED Published: 2025-07-10T19:16:28.782Z Last Updated: 2025-07-11T13:19:28.608Z Vendors: BuilderEngine Products: CMS Problem Types: CWE-434, CWE-20, CWE-306 Description: An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php file and subsequently execute arbitrary PHP code on the server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload comp
server under the context of the web server process. While the root vulnerability lies within the jQuery File Upload component, BuilderEngine’s improper integration and lack of access controls expose this functionality to unauthenticated users, resulting in full remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/builderengine_upload_exec.rb - https://www.exploit-db.com/exploits/40390 - https://support.alertlogic.com/hc/en-us/articles/115004703183-BuilderEngine-Content-Management-System-CMS-elFinder-2-0-Arbitrary-File-Upload - https://vulncheck.com/advisories/bu
183-BuilderEngine-Content-Management-System-CMS-elFinder-2-0-Arbitrary-File-Upload - https://vulncheck.com/advisories/builder-engine-unauthenticated-arbitrary-file-upload
CVE ID: CVE-2025-34101 State: PUBLISHED Published: 2025-07-10T19:11:05.353Z Last Updated: 2025-07-10T20:25:09.207Z Vendors: Serviio Products: Media Server Problem Types: CWE-78, CWE-306, CWE-20 Description: An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console component (default port 23423). The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to a call to cmd.exe, enabling arbitrary command execution under the privileges of the web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access
web server. No authentication is required to exploit this issue, as the REST API is exposed by default and lacks access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php - https://packetstorm.news/files/id/142387 - https://fortiguard.fortinet.com/encyclopedia/ips/44042 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/serviio_checkstreamurl_cmd_exec.rb - https://vulncheck.com/advisories/serviio-media-server-unauthenticated-command-injection - https://www.exploit-db.com/exploits/42023
CVE ID: CVE-2025-34102 State: PUBLISHED Published: 2025-07-10T19:16:01.206Z Last Updated: 2025-07-11T13:18:34.823Z Vendors: Crypttech Products: CryptoLog Problem Types: CWE-89, CWE-78, CWE-306, CWE-20 Description: A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in login.php to bypass authentication, followed by command injection in logshares_ajax.php to execute arbitrary operating system commands. The login bypass is achieved by submitting crafted
in logshares_ajax.php to execute arbitrary operating system commands. The login bypass is achieved by submitting crafted SQL via the user POST parameter. Once authenticated, the attacker can abuse the lsid POST parameter in the logshares_ajax.php endpoint to inject and execute a command using $(...) syntax, resulting in code execution under the web context. This exploitation path does not exist in the ASP.NET version of CryptoLog released since 2009. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentest.blog/advisory-cryptolog-unauthenticated-remote-code-execution/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/cr
te-code-execution/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/crypttech_cryptolog_login_exec.rb - https://vulncheck/advisories/cryptolog-unauthenticated-rce - https://www.exploit-db.com/exploits/41980
CVE ID: CVE-2025-34103 State: PUBLISHED Published: 2025-07-15T13:10:41.256Z Last Updated: 2025-11-21T19:21:54.751Z Vendors: WePresent (Barco) Products: WiPG-1000 Problem Types: CWE-78, CWE-306 Description: An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticated remote attacker to execute arbitrary commands as the web server user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/advisories/wepresent-wipg1000.txt -
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/advisories/wepresent-wipg1000.txt - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/wipg1000_cmd_injection.rb - https://www.exploit-db.com/exploits/41935 - https://www.vulncheck.com/advisories/we-present-wi-pg-1000-unauthenticated-command-injection
CVE ID: CVE-2025-34104 State: PUBLISHED Published: 2025-07-15T13:06:51.072Z Last Updated: 2025-07-15T13:40:50.302Z Vendors: Piwik (now Matomo) Products: Web Analytics Platform Problem Types: CWE-434, CWE-306 Description: An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file. Additional
0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://matomo.org/changelog/piwik-3-0-3/ - https://matomo.org/faq/plugins/faq_21/ - https://firefart.at/post/turning_piwik_superuser_creds_into_rce/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb - https://www.vulncheck.com/advisories/piwik-authenticated-rce-via-custom-plugin-upload