Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6053 State: PUBLISHED Published: 2025-07-18T04:23:02.813Z Last Updated: 2025-07-18T14:56:39.449Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bogdansilivestru Products: Zuppler Online Ordering Problem Types: CWE-352 Description: The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into perf
ate settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dab1dbc7-f188-4c04-9c8b-465ec0a42548?source=cve - https://wordpress.org/plugins/zuppler-online-ordering/
CVE ID: CVE-2025-6054 State: PUBLISHED Published: 2025-07-23T02:24:37.769Z Last Updated: 2025-07-23T15:14:30.683Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: stratosg Products: YANewsflash Problem Types: CWE-352 Description: The YANewsflash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the 'yanewsflash/yanewsflash.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on
b scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/171fe5db-0b43-47ba-b215-87ce9d7b5095?source=cve - https://wordpress.org/plugins/yanewsflash/
CVE ID: CVE-2025-6055 State: PUBLISHED Published: 2025-06-14T08:23:24.260Z Last Updated: 2025-06-17T18:39:21.836Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bogdanding Products: Zen Sticky Social Problem Types: CWE-352 Description: The Zen Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing or incorrect nonce validation on the 'zen-social-sticky/zen-sticky-social.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an ac
and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33cfebae-bbf3-4b0b-9afc-3ef2548045e7?source=cve - https://plugins.trac.wordpress.org/browser/zen-social-sticky/trunk/zen-sticky-social.php
CVE ID: CVE-2025-6056 State: PUBLISHED Published: 2025-07-04T11:21:42.979Z Last Updated: 2025-07-07T16:23:53.982Z Vendors: Ergon Informatik AG Products: Airlock IAM Problem Types: CWE-203 Description: Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.redguard.ch/blog/2025/07/04/cve-2025-6056-airlock-iam-username-enumeration/
CVE ID: CVE-2025-6057 State: PUBLISHED Published: 2025-07-12T04:22:22.035Z Last Updated: 2025-07-14T15:51:25.806Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: iqonicdesign Products: WPBookit Problem Types: CWE-434 Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment:
affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fac81cc0-c6c9-4009-aacb-52adc70c0261?source=cve - https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php#L85 - https://wordpress.org/plugins/wpbookit/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3326098%40wpbookit&new=3326098%40wpbookit&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6058 State: PUBLISHED Published: 2025-07-12T04:22:21.429Z Last Updated: 2025-07-14T16:01:17.241Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: iqonicdesign Products: WPBookit Problem Types: CWE-434 Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrich
the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d779ad1-fdbe-444c-85c5-99146a1a03d8?source=cve - https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-booking-type-controller.php#L455 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3314288%40wpbookit&new=3314288%40wpbookit&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6059 State: PUBLISHED Published: 2025-06-14T01:43:25.206Z Last Updated: 2025-06-17T18:40:14.761Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: seraphinitesoft Products: Seraphinite Accelerator Problem Types: CWE-352 Description: The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site admin
m several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f711c9d0-aa56-4e4c-bbcf-afa9598c3518?source=cve - https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2259 - https://plugins.trac.wordpress.org/changeset/3284098/
CVE ID: CVE-2025-6060 State: PUBLISHED Published: 2025-07-29T12:25:56.308Z Last Updated: 2025-07-29T13:19:58.062Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: DECE Software Products: Geodi Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DECE Software Geodi allows Cross-Site Scripting (XSS).This issue affects Geodi: before GEODI Setup 9.0.146. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0182
CVE ID: CVE-2025-6061 State: PUBLISHED Published: 2025-06-14T08:23:26.674Z Last Updated: 2025-06-17T18:38:46.983Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bhittani Products: kk Youtube Video Problem Types: CWE-79 Description: The kk Youtube Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kkytv' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
ributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd581604-e2f6-42c4-81ef-10873683526b?source=cve - https://plugins.trac.wordpress.org/browser/kk-youtube-video/trunk/kk-youtube-video.php
CVE ID: CVE-2025-6062 State: PUBLISHED Published: 2025-06-14T08:23:25.957Z Last Updated: 2025-06-17T18:38:57.256Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: netlatch Products: Yougler Blogger Profile Page Problem Types: CWE-352 Description: The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicki
gin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7102fb97-96a4-4fd9-824d-6fa6d483f37a?source=cve - https://plugins.trac.wordpress.org/browser/yougler-blogger-profile-page/trunk/yougler-plugin.php
CVE ID: CVE-2025-6063 State: PUBLISHED Published: 2025-06-14T08:23:27.045Z Last Updated: 2025-06-17T18:38:40.926Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dmitry78 Products: XiSearch bar Problem Types: CWE-352 Description: The XiSearch bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6. This is due to missing or incorrect nonce validation on the 'xisearch-key-config' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
s via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd828557-94f6-4278-98ef-bcf4d1d86440?source=cve - https://plugins.trac.wordpress.org/browser/xisearch-bar/trunk/xisearch.php
CVE ID: CVE-2025-6064 State: PUBLISHED Published: 2025-06-14T08:23:22.208Z Last Updated: 2025-06-17T18:39:51.077Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: djerba Products: WP URL Shortener Problem Types: CWE-352 Description: The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'url_shortener_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking o
eb scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/154b3a1a-7246-42de-a555-2c655778d59e?source=cve - https://plugins.trac.wordpress.org/browser/wp-url-shortener/trunk/index.php
CVE ID: CVE-2025-6065 State: PUBLISHED Published: 2025-06-14T08:23:21.618Z Last Updated: 2025-06-17T18:39:56.275Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: wework4web Products: Image Resizer On The Fly Problem Types: CWE-22 Description: The Image Resizer On The Fly plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' task in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: -
asily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/14877ff6-e393-41a3-91c1-fe7f477297cc?source=cve - https://plugins.trac.wordpress.org/browser/image-resizer-on-the-fly/trunk/image-resizer-on-the-fly.php#L25 - https://wordpress.org/plugins/image-resizer-on-the-fly/
CVE ID: CVE-2025-6067 State: PUBLISHED Published: 2025-09-06T01:47:27.304Z Last Updated: 2025-09-08T14:05:40.043Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sjaved Products: Easy Social Feed – Social Photos Gallery – Post Feed – Like Box Problem Types: CWE-79 Description: The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` and `data-linktext` parameters in all versions up to, and including, 6.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to
on and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89eb2229-a507-4f7c-be31-58959d3eca62?source=cve - https://plugins.trac.wordpress.org/browser/easy-facebook-likebox/trunk/facebook/frontend/assets/js/public.js#L81 - https://plugins.trac.wordpress.org/log/easy-facebook-likebox/
CVE ID: CVE-2025-6068 State: PUBLISHED Published: 2025-07-11T07:23:00.715Z Last Updated: 2025-07-11T16:52:22.590Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bradvin Products: FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel Problem Types: CWE-79 Description: The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authentic
, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6be4aaa-f8a1-42d6-95c1-062c5ca51004?source=cve - https://plugins.trac.wordpress.org/browser/foogallery/trunk/extensions/default-templates/shared/js/foogallery.min.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3322251%40foogallery&new=3322251%40foogallery&sf
lugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3322251%40foogallery&new=3322251%40foogallery&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6069 State: PUBLISHED Published: 2025-06-17T13:39:46.058Z Last Updated: 2025-10-09T18:37:55.979Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Python Software Foundation Products: CPython Problem Types: CWE-1333 Description: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/135462 - https://github.com/python/cpython/pull/135464 - https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949 - https
m/python/cpython/pull/135464 - https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949 - https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41 - https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b - https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/ - https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49 - https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5 - https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc - https://github.com/python/cpython/commit/fdc9d214c01cb4
python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc - https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15
CVE ID: CVE-2025-6070 State: PUBLISHED Published: 2025-06-14T08:23:25.593Z Last Updated: 2025-06-17T18:39:04.398Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: josxha Products: Restrict File Access Problem Types: CWE-22 Description: The Restrict File Access plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.2 via the output() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.co
contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e9eec61-bf51-4cf7-b567-58ee2ccd91c5?source=cve - https://plugins.trac.wordpress.org/browser/restrict-file-access/trunk/url_rewrite/url_rewrite.php#L77
CVE ID: CVE-2025-6071 State: PUBLISHED Published: 2025-07-03T16:56:51.070Z Last Updated: 2025-07-03T17:54:54.823Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ABB Products: RMC-100, RMC-100 LITE Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQTT information. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=e
A ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-6072 State: PUBLISHED Published: 2025-07-03T16:53:31.811Z Last Updated: 2025-07-03T17:55:53.572Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: RMC-100, RMC-100 LITE Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to the control network, and CVE-2025-6074 is exploited, the attacker can use the JSON configuration to overflow the date of expiration field.This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016. Additional Analyst Not
MC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-6073 State: PUBLISHED Published: 2025-07-03T16:49:24.761Z Last Updated: 2025-07-03T18:15:16.754Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: RMC-100, RMC-100 LITE Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to the control network, and user/password broker authentication is enabled, and CVE-2025-6074 is exploited, the attacker can overflow the buffer for username or password. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 21062
password. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-6074 State: PUBLISHED Published: 2025-07-03T16:46:11.859Z Last Updated: 2025-07-03T18:19:47.103Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: ABB Products: RMC-100, RMC-100 LITE Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016. Additional Anal
fects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-6075 State: PUBLISHED Published: 2025-10-31T16:41:34.983Z Last Updated: 2025-10-31T17:55:40.240Z Vendors: Python Software Foundation Products: CPython Description: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/136065 - https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/ - https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c - https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2
ommit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c - https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84 - https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca - https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742 - https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba - https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c