Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54129 State: PUBLISHED Published: 2025-07-21T20:53:26.575Z Last Updated: 2025-07-22T20:44:14.038Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: haxtheweb Products: issues Problem Types: CWE-204 Description: HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and
ence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-wh3h-vfcv-m5g5
CVE ID: CVE-2025-54130 State: PUBLISHED Published: 2025-08-05T00:12:28.632Z Last Updated: 2025-08-05T13:57:58.596Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-285 Description: Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive editor files, such as the .vscode/settings.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to th
t in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-vqv7-vq92-x87f
CVE ID: CVE-2025-54131 State: PUBLISHED Published: 2025-08-01T23:05:02.617Z Last Updated: 2025-08-04T13:57:16.983Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-77 Description: Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(cmd). If a user has swapped Cursor from its default settings (requiring approval for every terminal call) to an allowlist, an attacker can execute arbitrary command execution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indi
xecution outside of the allowlist without user approval. An attacker can trigger this vulnerability if chained with indirect prompt injection. This is fixed in version 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-534m-3w6r-8pqr
CVE ID: CVE-2025-54132 State: PUBLISHED Published: 2025-08-01T23:05:17.187Z Last Updated: 2025-08-04T17:17:40.695Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: cursor Products: cursor Problem Types: CWE-918 Description: Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get rendered by Cursor in the chat box. An attacker can use this to exfiltrate sensitive information to a third-party attacker controlled server through an image fetch after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this
after successfully performing a prompt injection. A malicious model (or hallucination/backdoor) might also trigger this exploit at will. This issue requires prompt injection from malicious data (web, image upload, source code) in order to exploit. In that case, it can send sensitive information to an attacker-controlled external server. This is fixed in version 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-43wj-mwcc-x93p
CVE ID: CVE-2025-54133 State: PUBLISHED Published: 2025-08-01T23:07:00.592Z Last Updated: 2025-08-04T17:17:06.179Z Vendors: cursor Products: cursor Problem Types: CWE-78, CWE-200 Description: Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model Context Protocol) deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When users click malicious `cursor://anysphere.cursor-deeplink/mcp/install` links, the installation dialog does not show the arguments being passed to the command being run. If a user clicks a malicious deeplink,
lation dialog does not show the arguments being passed to the command being run. If a user clicks a malicious deeplink, then examines the installation dialog and clicks through, the full command including the arguments will be executed on the machine. This is fixed in version 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-r22h-5wp2-2wfv
CVE ID: CVE-2025-54134 State: PUBLISHED Published: 2025-07-21T20:58:35.724Z Last Updated: 2025-07-23T18:30:23.112Z Vendors: haxtheweb Products: issues Problem Types: CWE-20, CWE-248, CWE-703 Description: HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9
handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-pjj3-j5j6-qj27 - https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34 - https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22 - https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52
CVE ID: CVE-2025-54135 State: PUBLISHED Published: 2025-08-05T00:11:07.363Z Last Updated: 2025-08-05T13:58:39.517Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-78, CWE-829 Description: Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the se
the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm
CVE ID: CVE-2025-54136 State: PUBLISHED Published: 2025-08-01T23:08:21.817Z Last Updated: 2025-08-04T17:16:42.841Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: cursor Products: cursor Problem Types: CWE-78 Description: Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a collaborator accepts a harmless MCP, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-promp
P, the attacker can silently swap it for a malicious command (e.g., calc.exe) without triggering any warning or re-prompt. If an attacker has write permissions on a user's active branches of a source repository that contains existing MCP servers the user has previously approved, or allows an attacker has arbitrary file-write locally, the attacker can achieve arbitrary code execution. This is fixed in version 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cursor/cursor/security/advisories/GHSA-24mc-g4xr-4395
CVE ID: CVE-2025-54137 State: PUBLISHED Published: 2025-07-22T21:34:20.201Z Last Updated: 2025-07-23T18:27:54.073Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: haxtheweb Products: issues Problem Types: CWE-1392 Description: HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default
during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-5fpv-5qvh-7cf3 - https://github.com/haxtheweb/haxcms-nodejs/commit/6dc2441c876350ca6fe9fbaecb058d92ef442869 - https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/lib/HAXCMS.js#L1614
CVE ID: CVE-2025-54138 State: PUBLISHED Published: 2025-07-22T21:33:59.149Z Last Updated: 2025-07-23T18:26:50.196Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: librenms Products: librenms Problem Types: CWE-98 Description: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. LibreNMS versions 25.6.0 and below contain an architectural vulnerability in the ajax_form.php endpoint that permits Remote File Inclusion based on user-controlled POST input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path in
T input. The application directly uses the type parameter to dynamically include .inc.php files from the trusted path includes/html/forms/, without validation or allowlisting. This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities. This is fixed in version 25.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/librenms/librenms/security/advisories/GHSA-gq96-8w38-hhj2 - https://github.com/librenms/librenms/pull/17990 - https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 - htt
ibrenms/librenms/pull/17990 - https://github.com/librenms/librenms/commit/ec89714d929ef0cf2321957ed9198b0f18396c81 - https://github.com/librenms/librenms/releases/tag/25.7.0
CVE ID: CVE-2025-54139 State: PUBLISHED Published: 2025-07-22T23:24:13.334Z Last Updated: 2025-07-23T14:53:40.521Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: haxtheweb Products: issues Problem Types: CWE-1021 Description: HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12 and below and in haxcms-php versions 11.0.7 and below, all pages within the HAX CMS application do not contain headers to prevent other websites from loading the site within an iframe. This applies to both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive fu
o both the CMS and generated sites. An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application. This is fixed in haxcms-nodejs version 11.0.13 and haxcms-php 11.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-54vw-f4xf-f92j - https://github.com/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99 - https://github.com/haxtheweb/haxcms-php/commi
/haxtheweb/haxcms-nodejs/commit/777f9a7ff9675a160496f350d766df1f1f9b9b99 - https://github.com/haxtheweb/haxcms-php/commit/708dc8518928fe307044e67bff8b0f397cfdd606
CVE ID: CVE-2025-54140 State: PUBLISHED Published: 2025-07-22T21:34:30.750Z Last Updated: 2025-07-23T18:28:44.036Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: pyload Products: pyload Problem Types: CWE-22 Description: pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the /json/upload endpoint of pyLoad. By manipulating the filename of an uploaded file, an attacker can traverse out of the intended upload directory, allowing them to write arbitrary files to any location on the system accessible to the pyLoad process. This may lead to: Remote Code Executi
te arbitrary files to any location on the system accessible to the pyLoad process. This may lead to: Remote Code Execution (RCE), local privilege escalation, system-wide compromise, persistence, and backdoors. This is fixed in version 0.5.0b3.dev90. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload/security/advisories/GHSA-xqpg-92fq-grfg - https://github.com/pyload/pyload/commit/fc4b136e9c4e7dcbb8e467ae802cb2c3f70a71b0 - https://github.com/pyload/pyload/blob/df094db67ec6e25294a9ac0ddb4375fd7fb9ba00/src/pyload/webui/app/blueprints/json_blueprint.py#L109
CVE ID: CVE-2025-54141 State: PUBLISHED Published: 2025-07-22T21:35:47.844Z Last Updated: 2025-07-23T18:31:31.496Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: viewvc Products: viewvc Problem Types: CWE-22, CWE-79 Description: ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style attack. This is fixed in versions 1.1.31 and 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/viewvc/vi
versions 1.1.31 and 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/viewvc/viewvc/security/advisories/GHSA-rv3m-76rj-q397 - https://github.com/viewvc/viewvc/issues/211 - https://github.com/viewvc/viewvc/commit/1dd84542c39b39e4a3f434db84a8ba3441d6a1e7 - https://github.com/viewvc/viewvc/commit/5d7c76be07b77dce4ff631e9b866056344f11e84
CVE ID: CVE-2025-54142 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-08-29T14:27:14.217Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Akamai Products: AkamaiGhost Problem Types: CWE-444 Description: Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.akamai.com/customers/s/feed/0D5a700000W51m8CAB - https://www.a
- CISA ADP Vulnrichment: References: - https://community.akamai.com/customers/s/feed/0D5a700000W51m8CAB - https://www.akamai.com/blog/security-research/advisory-cve-2025-54142-http-request-smuggling-via-options-body
CVE ID: CVE-2025-54143 State: PUBLISHED Published: 2025-08-19T20:52:47.450Z Last Updated: 2025-08-20T15:17:47.691Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Sandboxed iframes could allow local downloads despite sandbox restrictions Description: Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page This vulnerability affects Firefox for iOS < 141. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1912671 - https://www.mozilla.org/security/advisories/mfsa2025-60/
CVE ID: CVE-2025-54144 State: PUBLISHED Published: 2025-08-19T20:52:47.918Z Last Updated: 2025-08-20T15:17:40.281Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Internal Firefox open-text URL scheme allowed loading of arbitrary URLs Description: The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link This vulnerability affects Firefox for iOS < 141. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1946062 - https://www.mozilla.org/security/advisories/mfsa2025-60/
CVE ID: CVE-2025-54145 State: PUBLISHED Published: 2025-08-19T20:52:48.366Z Last Updated: 2025-08-20T15:17:33.903Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites Description: The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme This vulnerability affects Firefox for iOS < 141. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1946122 - https://www.mozilla.org/security/advisories/mfsa2025-60/
CVE ID: CVE-2025-54153 State: PUBLISHED Published: 2025-10-03T18:14:56.019Z Last Updated: 2025-10-03T19:09:37.246Z Vendors: QNAP Systems Inc. Products: Qsync Central Problem Types: CWE-89 Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-35
CVE ID: CVE-2025-54154 State: PUBLISHED Published: 2025-10-03T18:15:05.561Z Last Updated: 2025-10-03T19:09:28.893Z Vendors: QNAP Systems Inc. Products: QNAP Authenticator Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QNAP Authenticator 1.3.1.1227 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-30
CVE ID: CVE-2025-54156 State: PUBLISHED Published: 2025-08-18T21:21:38.589Z Last Updated: 2025-08-19T19:23:01.181Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Santesoft Products: Sante PACS Server Problem Types: CWE-319 Description: The Sante PACS Server Web Portal sends credential information without encryption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE ID: CVE-2025-54167 State: PUBLISHED Published: 2025-11-07T15:12:39.176Z Last Updated: 2025-11-07T15:57:14.662Z Vendors: QNAP Systems Inc. Products: Notification Center Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Notification Center 2.1.0.3443 and later Notification Center 1.9.2.3163 and later Notification Center 3.0.0.3466 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References:
2.3163 and later Notification Center 3.0.0.3466 and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-40
CVE ID: CVE-2025-54168 State: PUBLISHED Published: 2025-11-07T15:12:10.966Z Last Updated: 2025-11-07T15:57:21.137Z Vendors: QNAP Systems Inc. Products: QuLog Center Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuLog Center 1.8.2.923 ( 2025/08/27 ) and later Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qnap.com/en/security-advisory/qsa-25-42
CVE ID: CVE-2025-54172 State: PUBLISHED Published: 2025-08-20T12:52:47.745Z Last Updated: 2025-08-20T15:12:10.775Z Vendors: OpenSolution Products: Quick.CMS Problem Types: CWE-79 Description: QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. Regular admin user is not able to inject any JS scripts into the page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other ve
details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-54172 - https://opensolution.org/cms-system-quick-cms.html
CVE ID: CVE-2025-54174 State: PUBLISHED Published: 2025-08-20T12:53:09.860Z Last Updated: 2025-08-20T15:10:56.787Z Vendors: OpenSolution Products: Quick.CMS Problem Types: CWE-352 Description: QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious article with content defined by the attacker. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and migh
lnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/CVE-2025-54172 - https://opensolution.org/cms-system-quick-cms.html