Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-7307 State: PUBLISHED Published: 2025-08-27T21:26:14.907Z Last Updated: 2025-08-28T19:45:31.965Z Vendors: Sangfor Technologies Co. Ltd. Products: Sangfor Behavior Management System (DC Management System) Problem Types: CWE-611 Description: Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity definitions, leading to potential disclosure of internal files, server-side request forgery (SSRF), or other impacts depending on parser behavior
otential disclosure of internal files, server-side request forgery (SSRF), or other impacts depending on parser behavior. The vulnerability is due to improper configuration of the XML parser, which allows resolution of external entities without restriction. This product is now integrated into their IAM (Internet Access Management) platform and an affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-09-06 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cnblogs.com/pursue-security/p/17666126.html - https://support.sangfor.com.cn/productDocument/read?product_id=22&version_id=329&category_id=261800
y/p/17666126.html - https://support.sangfor.com.cn/productDocument/read?product_id=22&version_id=329&category_id=261800 - https://www.sangfor.com/blog/cybersecurity/launching-sangfor-iam-12-0-23-manage-risky-shadow-it-right-way - https://www.vulncheck.com/advisories/sangfor-behavior-management-system-xml-external-entity-injection
CVE ID: CVE-2023-7308 State: PUBLISHED Published: 2025-08-27T21:26:35.196Z Last Updated: 2025-11-20T17:15:48.071Z Vendors: NSFOCUS Products: SecGate3600 Firewall Problem Types: CWE-306 Description: SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet.cgi endpoint. The affected component fails to enforce authentication checks on POST requests to retrieve user data. An unauthenticated remote attacker can exploit this flaw to obtain sensitive information, including user identifiers and configuration details, by sending crafted requests to the vulnerable endpoint. An affected version range i
entifiers and configuration details, by sending crafted requests to the vulnerable endpoint. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-18 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jjjj1029056414/selfpoc/blob/main/wangshen-SecGate3600-information-leakage.py - https://nsfocusglobal.com/products/next-gen-firewall-2/ - https://www.vulncheck.com/advisories/secgate3600-firewall-info-disc
CVE ID: CVE-2023-7309 State: PUBLISHED Published: 2025-08-27T21:23:59.636Z Last Updated: 2025-08-28T19:44:48.216Z Vendors: Zhejiang Dahua Technology Co., Ltd. Products: Smart Park Integrated Management Platform Problem Types: CWE-434, CWE-22 Description: A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform (also referred to as the Dahua Smart Campus Integrated Management Platform), affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files to the server via crafted SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and fu
SOAP requests, including executable JSP payloads. Successful exploitation may lead to remote code execution (RCE) and full compromise of the affected system. The vulnerability is presumed to affect builds released prior to September 2023 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-02-15 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.dahuatech.com/bulletin/info?IsDpValue=hJVIA5%2BGjY24RaJ%2FIGLBoTg6hGbLYAQKuf5hnmPaK9M%3D - https://developer.aliyun.com/article/1333161 - https://github.com/tequilasunsh1ne/dah
2FIGLBoTg6hGbLYAQKuf5hnmPaK9M%3D - https://developer.aliyun.com/article/1333161 - https://github.com/tequilasunsh1ne/dahua_bitmap_fileupload - https://www.vulncheck.com/advisories/dahua-smart-park-integrated-management-platform-front-end-arbitrary-file-upload
CVE ID: CVE-2023-7311 State: PUBLISHED Published: 2025-10-15T01:19:38.316Z Last Updated: 2025-10-15T20:04:48.098Z Vendors: BYTEVALUE (Luoyang Baiwei Intelligent Technology Co., Ltd.) Products: Flow Control Router Problem Types: CWE-78 Description: BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The `path` parameter is not properly validated and is echoed into a shell context, allowing an attacker to inject and execute arbitrary shell commands on the device. Successful exploitation can lead to writing backdoors, privilege escalation on the host, and full compromise of the router and its management functions. VulnCheck
g backdoors, privilege escalation on the host, and full compromise of the router and its management functions. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/web/bytevalue_goform_webread_open_rce.yaml - https://isc.sans.edu/diary/Exploit+against+Unnamed+Bytevalue+router+vulnerability+included+in+Mirai+Bot/30642 - https://blog.csdn.net/zkaqlaoniao/article/details/134328873 - https://www.vulncheck.com/advisories/bytevalue-intelligent-flow-control-router-command-injection
CVE ID: CVE-2023-7312 State: PUBLISHED Published: 2025-10-30T21:19:51.723Z Last Updated: 2025-11-17T21:36:23.135Z Vendors: Nagios Products: Fusion Problem Types: CWE-79 Description: Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers. Additional Analyst N
ion fields could persist a malicious payload that executes in the context of other users' browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#fusion - https://www.nagios.com/changelog/nagios-fusion/ - https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail
CVE ID: CVE-2023-7313 State: PUBLISHED Published: 2025-10-30T21:50:39.771Z Last Updated: 2025-11-17T18:21:45.677Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-bulk-modification
CVE ID: CVE-2023-7314 State: PUBLISHED Published: 2025-10-30T21:49:27.209Z Last Updated: 2025-11-17T18:21:45.860Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-bandwidth-report
CVE ID: CVE-2023-7315 State: PUBLISHED Published: 2025-10-30T21:52:33.775Z Last Updated: 2025-11-17T18:21:46.100Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-graph-explorer
CVE ID: CVE-2023-7316 State: PUBLISHED Published: 2025-10-30T21:52:58.088Z Last Updated: 2025-11-17T18:21:46.276Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-graph-explorer-2
CVE ID: CVE-2023-7317 State: PUBLISHED Published: 2025-10-30T21:47:19.903Z Last Updated: 2025-11-17T18:21:46.464Z Vendors: Nagios Products: XI Problem Types: CWE-862 Description: Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisorie
ios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/ - https://www.vulncheck.com/advisories/nagios-xi-web-ssh-terminal-missing-access-control
CVE ID: CVE-2023-7318 State: PUBLISHED Published: 2025-10-30T21:51:25.049Z Last Updated: 2025-11-17T18:21:46.618Z Vendors: Nagios Products: XI Problem Types: CWE-79 Description: Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/#nagios-xi - https://www.nagios.com/changelog/nagios-xi/2024r1-0-2/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-cor
xi - https://www.nagios.com/changelog/nagios-xi/2024r1-0-2/ - https://www.vulncheck.com/advisories/nagios-xi-xss-via-core-command-expansion
CVE ID: CVE-2023-7319 State: PUBLISHED Published: 2025-10-30T21:28:29.373Z Last Updated: 2025-11-17T21:36:23.299Z Vendors: Nagios Products: Network Analyzer Problem Types: CWE-79 Description: Nagios Network Analyzer versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Percentile Calculator menu. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/#network-analyzer - https://www.vulncheck.com/advisories/nagios-network-analyzer-xss-via-percentile-calculator-menu
CVE ID: CVE-2023-7320 State: PUBLISHED Published: 2025-10-29T06:45:48.702Z Last Updated: 2025-10-29T14:19:46.784Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: automattic Products: WooCommerce Problem Types: CWE-200 Description: The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract sensitive user information including PII(Personal Identifiable Information). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
on including PII(Personal Identifiable Information). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2d1879-c337-41c9-9f47-f9c2fe8e5928?source=cve - https://wpscan.com/vulnerability/d1cec296-b5df-4cea-8c0d-d03a975cb6af - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2939652@woocommerce/trunk&old=2933569@woocommerce/trunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-7321 State: PUBLISHED Published: 2025-10-30T21:27:23.232Z Last Updated: 2025-11-17T21:36:23.480Z Vendors: Nagios Products: Log Server Problem Types: CWE-79 Description: Nagios Log Server versions prior to 2.1.14 are vulnerable to cross-site scripting (XSS) via the Snapshots Page. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-log-server-2024r1/ - https://www.vulncheck.com/advisories/nagios-log-server-xss-via-snapshots-page
CVE ID: CVE-2023-7322 State: PUBLISHED Published: 2025-10-30T21:23:34.547Z Last Updated: 2025-11-17T21:36:23.640Z Vendors: Nagios Products: Log Server Problem Types: CWE-863 Description: Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-log-se
rights. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-log-server-2024r1/ - https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access
CVE ID: CVE-2023-7323 State: PUBLISHED Published: 2025-10-30T21:27:03.493Z Last Updated: 2025-11-17T21:36:23.836Z Vendors: Nagios Products: Log Server Problem Types: CWE-79 Description: Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/nagios-log-server-2024r1/ - https://www.vulncheck.com/advisories/nagios-log-server-xss-via-create-user-function
CVE ID: CVE-2023-7324 State: PUBLISHED Published: 2025-10-29T13:46:14.184Z Last Updated: 2025-10-29T13:46:14.184Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize possible addl_desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). References: - https://git.kernel.org/stable/c/af5114d824f3511a69d68beff49ca9a7c32d44e0 - https://git.kernel.org/stable/c/a156a262c543fa5ff30bcb2fc6ad1a95cb4ab57a - https://git.kernel.org/stable/c/8e454aba72805241239caf8ba9b8e5a6be772b96 - https://git.kernel.org/stable/c/2ecd344173a5663d523433819da0484cb268b186 - https://git
2805241239caf8ba9b8e5a6be772b96 - https://git.kernel.org/stable/c/2ecd344173a5663d523433819da0484cb268b186 - https://git.kernel.org/stable/c/384aa697d8f2a28b5e962f5292cdfd2e528b5df7 - https://git.kernel.org/stable/c/27067c672980b497cc34048b69b12820851ac6b9 - https://git.kernel.org/stable/c/b91ef85a32fdba45fcbad87dd526d73d3b6d857d - https://git.kernel.org/stable/c/db95d4df71cb55506425b6e4a5f8d68e3a765b63
CVE ID: CVE-2023-7325 State: PUBLISHED Published: 2025-10-30T21:17:54.830Z Last Updated: 2025-10-31T17:18:04.911Z Vendors: Anheng Information (Hangzhou DBAPP Security Information Technology Co., Ltd.) Products: Mingyu Operations and Maintenance Audit and Risk Control System Problem Types: CWE-306, CWE-918 Description: Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix socket RPC endpoints and perform privileged XML-RPC methods. An attacker able to s
he server to connect to internal unix socket RPC endpoints and perform privileged XML-RPC methods. An attacker able to send such requests can invoke administrative RPC methods via the unix socket interface to create arbitrary user accounts on the system, resulting in account creation and potential takeover of the bastion host. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:17.837319 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cn-sec.com/archives/1947658.html - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/%E5%AE%89%E6%81%92/%E5%AE%89%E6%81%92%20%E6%98%8E%E5%BE%A1%E8%BF%90%E7%BB%B4%E5%AE%A1%
WIKI-Book/blob/main/docs/wiki/iot/%E5%AE%89%E6%81%92/%E5%AE%89%E6%81%92%20%E6%98%8E%E5%BE%A1%E8%BF%90%E7%BB%B4%E5%AE%A1%E8%AE%A1%E4%B8%8E%E9%A3%8E%E9%99%A9%E6%8E%A7%E5%88%B6%E7%B3%BB%E7%BB%9F%20xmlrpc.sock%20%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E.md - https://www.vulncheck.com/advisories/mingyu-operations-and-maintenance-audit-and-risk-control-system-xmirpc-sock-ssrf
CVE ID: CVE-2023-7326 State: PUBLISHED Published: 2025-11-12T22:09:43.255Z Last Updated: 2025-11-13T14:35:41.772Z Vendors: Seiko Epson Products: Epson Stylus SX510W Problem Types: CWE-400 Description: The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTATION/HTML/TOP/INDEX.HTML. A remote attacker can send a malformed request that triggers improper input parsing or memory handling, resulting in the printer process shutting down or powering off, causing a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51441 -
condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51441 - https://www.epson.eu/en_EU/support/sc/epson-stylus-sx510w/s/s837 - https://www.vulncheck.com/advisories/epson-stylus-printer-remote-power-off-dos
CVE ID: CVE-2023-7327 State: PUBLISHED Published: 2025-11-12T22:07:07.320Z Last Updated: 2025-11-13T17:03:12.995Z Vendors: Ozeki Ltd. Products: Ozeki SMS Gateway Problem Types: CWE-22 Description: Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service, leading to disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51646 - https://ozeki-sms-gateway.com/ - https://www.vulnchec
ichment: References: - https://www.exploit-db.com/exploits/51646 - https://ozeki-sms-gateway.com/ - https://www.vulncheck.com/advisories/ozeki-sms-gateway-unauthenticated-arbitrary-file-read
CVE ID: CVE-2023-7328 State: PUBLISHED Published: 2025-11-14T22:51:05.202Z Last Updated: 2025-11-18T16:25:16.998Z Vendors: DB Elettronica Telecomunicazioni SpA Products: Screen SFT DAB 600/C Problem Types: CWE-306 Description: Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structured user data, including account names and connection metadata such as client IP and timeout values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51460 - https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ - https://www.
ww.exploit-db.com/exploits/51460 - https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5776.php - https://packetstormsecurity.com/files/172332/ - https://www.vulncheck.com/advisories/screen-sft-dab-600c-unauthenticated-information-disclosure
CVE ID: CVE-2023-7329 State: PUBLISHED Published: 2025-11-12T22:06:26.619Z Last Updated: 2025-11-13T17:00:32.000Z Vendors: tinycontrol Products: Lan Controller Problem Types: CWE-306 Description: Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configuration loss. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php - https://packetstormsecurity.com/files/174455
rences: - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5785.php - https://packetstormsecurity.com/files/174455/ - https://www.exploit-db.com/exploits/51730 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275810 - https://tinycontrol.pl/en/archives/lan-controller-35/ - https://www.vulncheck.com/advisories/tinycontrol-lan-controller-v3-remote-dos
CVE ID: CVE-2023-7330 State: PUBLISHED Published: 2025-11-24T20:31:19.914Z Last Updated: 2025-11-24T21:06:27.538Z Vendors: Beijing Star-Net Ruijie Network Technology Co., Ltd. Products: NBR Series Routers Problem Types: CWE-434 Description: Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php. The endpoint accepts attacker-supplied values in the name and uploadDir parameters and saves the provided multipart file content without adequate validation or sanitization of file type, path, or extension. A remote attacker can upload a crafted PHP file and then access it from the web root, resulting in arbitrary code execution in the
tacker can upload a crafted PHP file and then access it from the web root, resulting in arbitrary code execution in the context of the web service. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-14 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/ruijie/ruijie-nbr-fileupload.yaml - https://cn-sec.com/archives/1995366.html - https://www.cnblogs.com/Domren/articles/19093295 - https://rfk0z.github.io/posts/Ruijie-NBR-router-fileupload-php-arbitrary-file-upload-vulnerability/ - https://www.vulncheck.com/advisories/ruijie-networks-nbr-routers-unauthenticated-arbit
rary-file-upload-vulnerability/ - https://www.vulncheck.com/advisories/ruijie-networks-nbr-routers-unauthenticated-arbitrary-file-upload-via-fileuploadphp