Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-50849 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T15:39:26.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference (IDOR). The user profile functionality allows enabling or disabling stickers through a parameter (company_id) sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate the request to target other users' accounts and toggle the sticker setting by modifying the company_id or other object identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cs.com - https://gi
or other object identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cs.com - https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50849.md
CVE ID: CVE-2025-50850 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T19:57:19.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cs.com - https://github.com/
automated attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cs.com - https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.md
CVE ID: CVE-2025-50858 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:25.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ehcp.net/?p=402 - https://packetstorm.news/files/id/208533
CVE ID: CVE-2025-50859 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:18.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the template parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ehcp.net/?p=402 - https://packetstorm.news/files/id/208533
CVE ID: CVE-2025-50860 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:55:05.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ehcp.net/?p=402 - https://packetstorm.news/files/id/208535
CVE ID: CVE-2025-50861 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:43:53.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://lotus.com - http://comlotuscarsdomesticintl.com - https://github.com/JackSessions/Jack-Sessions-CVEs/tree/main
CVE ID: CVE-2025-50862 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-18T18:58:38.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB backup on rooted or debug-enabled devices. This presents a risk of user data exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://lotus.com - http://comlotuscarsdomesticintl.com - https://github.com/JackSessions/Jack-Sessions-CVEs/tree/main
CVE ID: CVE-2025-50864 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T14:49:11.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For example, a malicious origin like "notexample.com", "example.common.net" is whitelisted when the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites usi
the site's CORS policy specifies "example.com." This vulnerability enables unauthorized access to user data on sites using the elysia-cors library for CORS validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://elysiajs.com - https://github.com/elysiajs/elysia-cors/blob/main/src/index.ts - https://github.com/elysiajs/elysia-cors/tree/main - https://medium.com/@raghavagrawal_23036/cors-bypass-in-popular-opensource-library-ad27fb41e16a
CVE ID: CVE-2025-50866 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T20:05:47.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading to session hijacking or phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SacX-7/CVE-2025-50866
CVE ID: CVE-2025-50867 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T20:01:22.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SacX-7/CVE-2025-50867
CVE ID: CVE-2025-50868 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T18:04:42.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/b0mk35h/393a5491ef82fe0ede9207e4bc5953fb
CVE ID: CVE-2025-50869 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T18:06:02.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/cross-site-scripting/stored - https://gist.github.com/b0mk35h/1fabbff8c95c6b7180c4ef404a337b8b
CVE ID: CVE-2025-50870 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T19:33:01.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure. Additional Analyst No
student details by altering the email value in the request URL, leading to information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/284.html - https://gist.github.com/b0mk35h/c4d47b5c4aacecdc8e6c4b02b40ce302
CVE ID: CVE-2025-50879 State: REJECTED Published: N/A Last Updated: 2025-09-26T20:05:33.464Z Description: No description available.
CVE ID: CVE-2025-50891 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-09-18T13:06:53.359Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Adform Products: server-side backend for Site Tracking Problem Types: CWE-79 Description: The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hijacking. NOTE: a customer does not need to take any action to update locally installed software (such as Adform Site Tracking 1.1). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/AdformTracking_ReflectedXSS - https
- CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/AdformTracking_ReflectedXSS - https://github.com/nikolas-ch/CVEs/blob/main/AdformTracking_ReflectedXSS/AdformTracking_ReflectedXSS.txt - https://www.adformhelp.com/hc/en-us/categories/9738364537233-Adform-Site-Tracking
CVE ID: CVE-2025-50892 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T18:57:55.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP_MJ_READ/IRP_MJ_WRITE) sent to its device object. This allows a local, low-privileged attacker to perform arbitrary raw disk reads and writes, leading to sensitive information disclosure, denial of service, or local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://easeus.com - https://gist.github.com/christopher-ellis-workday/756c998f9f59d
CISA ADP Vulnrichment: References: - http://easeus.com - https://gist.github.com/christopher-ellis-workday/756c998f9f59dd2c437d83e60c7ed220
CVE ID: CVE-2025-50897 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T18:20:07.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with write permissions (PTE_W) in SV39 mode may incorrectly trigger a Store/AMO access fault during store instructions (sd). This occurs despite the presence of proper page table entries and valid memory access modes. The fault is reproducible when transitioning into virtual memory and attempting store operations in mapped kernel memory, indicating a potential flaw in the
itioning into virtual memory and attempting store operations in mapped kernel memory, indicating a potential flaw in the MMU, PMP, or memory access enforcement logic. This may cause unexpected kernel panics or denial of service in systems using BOOMv1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/riscv-boom/riscv-boom - https://github.com/riscv-software-src/riscv-isa-sim - https://github.com/LuLuji04/POC-Boomv1.2
CVE ID: CVE-2025-50900 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T13:39:13.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preHandle In the filter code, use CodecUtils.urlDecode(request.getRequestURI()) to obtain the URL-decoded request path, and then determine whether the path endsWith /error. If so, execute return true to skip this Interceptor. Else, redirect to /user/login api. Allowing unauthenticated attackers to gain sensitive information or escalated privileges. Additional Analyst N
ogin api. Allowing unauthenticated attackers to gain sensitive information or escalated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/racerz/Rebuild-Vulnerability-1ede0e0074f280d8a906c38442a393f0?pvs=4 - https://racerz.notion.site/Rebuild-Vulnerability-1ede0e0074f280d8a906c38442a393f0
CVE ID: CVE-2025-50901 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T14:48:49.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/IC8RPM
CVE ID: CVE-2025-50902 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T13:39:14.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attackers to gain sensitive information via crafted HTTP Post message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/old-peanut/wechat_applet__open_source/issues/IC95QM
CVE ID: CVE-2025-50904 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T13:45:59.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /admin/ API without any token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WinterChenS/my-site/issues/95
CVE ID: CVE-2025-50926 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T20:06:53.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the List All Email Addresses function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ehcp.net/?p=402 - https://packetstorm.news/files/id/207907
CVE ID: CVE-2025-50927 State: PUBLISHED Published: 2025-08-08T00:00:00.000Z Last Updated: 2025-08-08T17:46:30.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via injecting a crafted payload into the ftpusername parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ehcp.net/?p=402 - https://packetstorm.news/files/id/207908
CVE ID: CVE-2025-50928 State: PUBLISHED Published: 2025-08-08T00:00:00.000Z Last Updated: 2025-08-08T17:39:32.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ehcp.net/?p=402 - https://packetstorm.news/files/id/207907
CVE ID: CVE-2025-50938 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T19:57:25.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zhblue/hustoj - https://github.com/zhblue/hustoj/issues/1093
CVE ID: CVE-2025-50944 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T14:26:24.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the method push.lite.avtech.com.MySSLSocketFactoryNew.checkServerTrusted in AVTECH EagleEyes 2.0.0. The custom X509TrustManager used in checkServerTrusted only checks the certificate's expiration date, skipping proper TLS chain validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/eagleeyes-lite - https://github.com/shinyColumn/CVE-2025-50944
CVE ID: CVE-2025-50946 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-13T20:20:45.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OliveTin/OliveTin - https://github.com/OliveTin/OliveTin/blob/8c073bf45fca6c6eda4e8a9feb182433277343ee/service/internal/executor/arguments.go#L211 - https://github.com/chrisWalker11/Cves/blob/main/CVE-2025-50946/CVE-2025-50946.md
CVE ID: CVE-2025-50949 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-24T12:55:22.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fontforge/fontforge/pull/5491
CVE ID: CVE-2025-50950 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T15:42:25.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mpruett/audiofile/issues/66
CVE ID: CVE-2025-50951 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-24T12:55:28.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fontforge/fontforge/pull/5495
CVE ID: CVE-2025-50952 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T20:28:59.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/uclouvain/openjpeg/issues/1505
CVE ID: CVE-2025-50971 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-09-04T14:33:41.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/abantecart_file_traversal_1.4.2_via_template_parameter.md
CVE ID: CVE-2025-50972 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T17:36:56.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and UNION-based injection to extract arbitrary data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/abantecart_sql_injection_1.4.2_via_template_parameter.md
CVE ID: CVE-2025-50974 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T16:19:37.030Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of the following parameters BYTE_UNIT, DAY_BEGIN, DAY_END, HIST_LEVEL, MONTH_BEGIN, MONTH_END, NUM_CONTENT, NUM_DOMAINS, NUM_HOSTS, NUM_URLS, PERF_INTERVAL, YEAR_BEGIN, YEAR_END. Additional Analyst Notes: - CISA ADP Vulnrichment:
M_DOMAINS, NUM_HOSTS, NUM_URLS, PERF_INTERVAL, YEAR_BEGIN, YEAR_END. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Command-Injection.md
CVE ID: CVE-2025-50975 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:44:04.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr, allowing an authenticated administrator to inject persistent JavaScript. This stored XSS payload is executed whenever another admin views the firewall rules page, enabling session hijacking, unauthorized actions within the interface, or further internal pivoting. Exploitation requires only high-privilege GUI access, and the comp
s within the interface, or further internal pivoting. Exploitation requires only high-privilege GUI access, and the complexity of the attack is low. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Stored-XSS-via-Firewall.md
CVE ID: CVE-2025-50976 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T16:20:49.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Reflected-XSS-via-DNS.md
CVE ID: CVE-2025-50977 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-28T14:17:12.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute JavaScript code in the context of the application. The flaw can be exploited through GET requests to the summary endpoint as well as POST requests to specific Wicket interface endpoints, though the GET method provides easier weapo
ry endpoint as well as POST requests to specific Wicket interface endpoints, though the GET method provides easier weaponization. This vulnerability enables authenticated administrators to execute arbitrary client-side code, potentially leading to session hijacking, data theft, or further privilege escalation attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/4rdr/proofs/blob/main/info/gitblit-v1.7.1-reflected-XSS-via-angularjs-expression.md