Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2165 State: PUBLISHED Published: 2025-03-26T02:23:49.139Z Last Updated: 2025-03-26T18:41:08.145Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: samhoamt Products: SH Email Alert Problem Types: CWE-79 Description: The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Not
ecute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc20180b-4665-4ade-b512-b0f0148200e7?source=cve - https://plugins.trac.wordpress.org/browser/sh-email-alert/tags/1.0/manage.php#L156 - https://wordpress.org/plugins/sh-email-alert/
CVE ID: CVE-2025-2166 State: PUBLISHED Published: 2025-03-14T04:22:33.305Z Last Updated: 2025-03-14T13:59:06.925Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: creativemindssolutions Products: CM FAQ – Simplify support with an intuitive FAQ management tool Problem Types: CWE-79 Description: The CM FAQ – Simplify support with an intuitive FAQ management tool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they
2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b8d21cb-fe87-4947-a44b-7d670cf2123e?source=cve - https://plugins.trac.wordpress.org/browser/cm-faq/tags/1.2.4/package/cminds-free.php#L2662 - https://plugins.trac.wordpress.org/browser/cm-faq/tags/1.2.5/package/cminds-free.php#L2662 - https://plugins.trac.wordpress.org/browser/cm-faq/tags/1.2.6/package/cminds-free.php#L2662
CVE ID: CVE-2025-2167 State: PUBLISHED Published: 2025-03-26T08:21:50.518Z Last Updated: 2025-03-26T14:15:27.664Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: bastho Products: Event post Problem Types: CWE-79 Description: The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32bcff2d-e322-4c9c-b1c2-f07aa54faff9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257882%40event-post&new=3257882%40event-post&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2168 State: PUBLISHED Published: 2025-05-01T03:23:39.967Z Last Updated: 2025-05-01T13:21:23.220Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: bdthemes Products: Ultimate Store Kit – Elementor powered WooCommerce Builder, 80+ Widgets and Template Builder Problem Types: CWE-352 Description: The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it poss
and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a48634d7-30c9-4124-87dd-93a303a969eb?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/2.3.6/admin/admin-notice.php#L43 - https://plugins.trac.wordpress.org/changese
press.org/browser/ultimate-store-kit/tags/2.3.6/admin/admin-notice.php#L43 - https://plugins.trac.wordpress.org/changeset/3283438/ultimate-store-kit/trunk/admin/admin-notice.php - https://plugins.trac.wordpress.org/changeset/3255125/ultimate-store-kit/trunk/admin/admin-notice.php
CVE ID: CVE-2025-2169 State: PUBLISHED Published: 2025-03-11T03:22:19.663Z Last Updated: 2025-03-11T13:50:33.061Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: realmag777 Products: WPCS – WordPress Currency Switcher Professional Problem Types: CWE-94 Description: The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional A
running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bbb24ae0-41d6-4d8f-917c-dfd058a7a49d?source=cve - https://plugins.trac.wordpress.org/browser/currency-switcher/trunk/index.php#L1920 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249625%40currency-switcher&new=3249625%40currency-switcher&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3253183%40currency-switcher&new=3253183%40currency-switcher&sfp_email=&sfph_mail=
CVE ID: CVE-2025-2170 State: PUBLISHED Published: 2025-04-30T18:46:34.939Z Last Updated: 2025-05-14T16:34:26.710Z Vendors: SonicWall Products: SMA1000 Problem Types: CWE-918 Description: A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0008
CVE ID: CVE-2025-2171 State: PUBLISHED Published: 2025-06-23T14:01:07.690Z Last Updated: 2025-06-23T20:48:28.991Z Vendors: Aviatrix Products: Controller Problem Types: CWE-307 Description: Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0003.md - https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller
CVE ID: CVE-2025-2172 State: PUBLISHED Published: 2025-06-23T14:01:19.310Z Last Updated: 2025-06-24T03:55:35.598Z Vendors: Aviatrix Products: Controller Problem Types: CWE-78 Description: Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0004.md - https://cloud.google.com/blog/topics/threat-intelligence/remote-code-execution-aviatrix-controller
CVE ID: CVE-2025-2173 State: PUBLISHED Published: 2025-03-11T06:31:05.166Z Last Updated: 2025-03-11T13:47:03.081Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: libzvbi Problem Types: CWE-824, CWE-908 Description: A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def6
the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299202 - https://vuldb.com/?ctiid.299202 - https://vuldb.com/?submit.512798 - https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf - https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce - https://github.com/zapping-vbi/zvbi/releases/tag/v0.
/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce - https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44
CVE ID: CVE-2025-2174 State: PUBLISHED Published: 2025-03-11T06:31:06.971Z Last Updated: 2025-03-11T13:40:54.884Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: libzvbi Problem Types: CWE-190, CWE-189 Description: A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca16721
sed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299203 - https://vuldb.com/?ctiid.299203 - https://vuldb.com/?submit.512800 - https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf - https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f - https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.
apping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f - https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44
CVE ID: CVE-2025-2175 State: PUBLISHED Published: 2025-03-11T07:00:09.753Z Last Updated: 2025-03-11T17:13:11.689Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: n/a Products: libzvbi Problem Types: CWE-190, CWE-189 Description: A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues.
ssue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299204 - https://vuldb.com/?ctiid.299204 - https://vuldb.com/?submit.512801 - https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf - https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44
CVE ID: CVE-2025-2176 State: PUBLISHED Published: 2025-03-11T07:31:05.090Z Last Updated: 2025-03-11T15:21:26.833Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: libzvbi Problem Types: CWE-190, CWE-189 Description: A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recomm
.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299205 - https://vuldb.com/?ctiid.299205 - https://vuldb.com/?submit.512802 - https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf - https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f - https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44
CVE ID: CVE-2025-2177 State: PUBLISHED Published: 2025-03-11T07:31:06.438Z Last Updated: 2025-03-11T14:12:36.161Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: libzvbi Problem Types: CWE-190, CWE-189 Description: A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is r
rsion 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.299206 - https://vuldb.com/?ctiid.299206 - https://vuldb.com/?submit.512803 - https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf - https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f - https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44
CVE ID: CVE-2025-2179 State: PUBLISHED Published: 2025-07-29T17:15:08.461Z Last Updated: 2025-07-29T17:37:23.305Z Vendors: Palo Alto Networks Products: GlobalProtect App, GlobalProtect UWP App Problem Types: CWE-266 Description: An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltone
t UWP app are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-2179
CVE ID: CVE-2025-2180 State: PUBLISHED Published: 2025-08-13T17:02:47.899Z Last Updated: 2025-08-13T17:21:30.216Z Vendors: Palo Alto Networks Products: Checkov by Prisma Cloud Problem Types: CWE-502 Description: An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-2180
CVE ID: CVE-2025-2181 State: PUBLISHED Published: 2025-08-13T17:03:03.787Z Last Updated: 2025-08-13T20:31:43.129Z Vendors: Palo Alto Networks Products: Checkov by Prisma Cloud Problem Types: CWE-312 Description: A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-2181
CVE ID: CVE-2025-2182 State: PUBLISHED Published: 2025-08-13T17:03:21.617Z Last Updated: 2025-08-13T20:32:15.474Z Vendors: Palo Alto Networks Products: Cloud NGFW, PAN-OS, Prisma Access Problem Types: CWE-312 Description: A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec. Additional Analyst Notes: - CISA ADP
pact in non-clustered firewalls or clusters of firewalls that do not enable MACsec. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-2182
CVE ID: CVE-2025-2183 State: PUBLISHED Published: 2025-08-13T17:05:08.612Z Last Updated: 2025-08-16T03:55:51.624Z Vendors: Palo Alto Networks Products: GlobalProtect App, Global Protect UWP App Problem Types: CWE-295 Description: An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment
s software signed by the malicious root certificates on that endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-2183
CVE ID: CVE-2025-2184 State: PUBLISHED Published: 2025-08-13T17:05:30.544Z Last Updated: 2025-08-13T20:33:40.634Z Vendors: Palo Alto Networks Products: Cortex XDR Broker VM Problem Types: CWE-1392 Description: A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2025-2184
CVE ID: CVE-2025-2185 State: PUBLISHED Published: 2025-04-24T23:22:35.146Z Last Updated: 2025-04-25T16:02:29.038Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: ALBEDO Telecom Products: Net.Time - PTP/NTP clock (Serial No. NBC0081P) Problem Types: CWE-613 Description: ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which could permit an attacker to transmit passwords over unencrypted connections, resulting in the product becoming vulnerable to interception. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-a
to interception. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-02 - https://www.albedotelecom.com/contactus.php
CVE ID: CVE-2025-2186 State: PUBLISHED Published: 2025-03-22T12:42:11.690Z Last Updated: 2025-03-24T13:48:35.072Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: amans2k Products: FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce Problem Types: CWE-89 Description: The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes
ficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88f8fa25-e3d5-4dfd-aae5-68b5880ffd53?source=cve - https://plugins.trac.wordpress.org/browser/wp-marketing-automations/trunk/includes/api/wc/class-bwfan-api-get-automation-dynamic-coupon.php#L50 - https://plugins.trac.wordpress.org/changeset/3257474/
CVE ID: CVE-2025-2188 State: PUBLISHED Published: 2025-04-17T09:28:58.004Z Last Updated: 2025-04-17T17:47:58.371Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Honor Products: com.hihonor.gamecenter Description: There is a whitelist mechanism bypass in GameCenter ,successful exploitation of this vulnerability may affect service confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honor.com/global/security/cve-2025-2188/
CVE ID: CVE-2025-2189 State: PUBLISHED Published: 2025-03-11T11:40:20.173Z Last Updated: 2025-03-11T13:15:46.249Z Vendors: Mogify Infotech Products: Tinxy Wi-Fi Lock Controller v1 RF, Tinxy Door Lock with Wi-Fi Controller, Tinxy 1 Node 10A and 16A Smart Wi-Fi Switches, Tinxy 2, 4 and 6 Node Smart Wi-Fi Switches, Tinxy Smart 15 Watts 3 in 1 Square Panel Ceiling Light, Tinxy Smart 8 Watts 3 in 1 Round Panel Ceiling Light Problem Types: CWE-312 Description: This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtai
e. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0043
CVE ID: CVE-2025-2190 State: PUBLISHED Published: 2025-03-11T07:09:09.942Z Last Updated: 2025-09-09T13:56:03.568Z Vendors: TECNO Products: com.transsnet.store Problem Types: CWE-297 Description: The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/393?lang=en_US - https://security.tecno.com/SRC/securityUpdates