Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10643 State: PUBLISHED Published: 2025-09-17T20:41:32.882Z Last Updated: 2025-09-18T15:39:08.899Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Wondershare Products: Repairit Problem Types: CWE-732 Description: Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to a storage account token. An attacker can leverage this vulnerability to bypass authentication on the sys
ions granted to a storage account token. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26902. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-895/
CVE ID: CVE-2025-10644 State: PUBLISHED Published: 2025-09-17T20:41:42.581Z Last Updated: 2025-09-18T15:26:54.354Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Wondershare Products: Repairit Problem Types: CWE-266 Description: Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on
an SAS token. An attacker can leverage this vulnerability to launch a supply-chain attack and execute arbitrary code on customers' endpoints. Was ZDI-CAN-26892. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-896/
CVE ID: CVE-2025-10645 State: PUBLISHED Published: 2025-10-07T08:23:38.793Z Last Updated: 2025-10-07T18:20:23.922Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: webfactory Products: WP Reset Problem Types: CWE-532 Description: The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45
Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed?source=cve - https://plugins.trac.wordpress.org/changeset/3364169/
CVE ID: CVE-2025-10646 State: PUBLISHED Published: 2025-11-25T03:27:43.284Z Last Updated: 2025-11-25T03:27:43.284Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: quadlayers Products: Search Exclude Problem Types: CWE-862 Description: The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings, such as adding arbitrary posts to the search exclusion list. References: - https://www.wordfen
o modify plugin settings, such as adding arbitrary posts to the search exclusion list. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f62d05-84fb-4cd6-9e5f-0dcfa305ce68?source=cve - https://plugins.trac.wordpress.org/changeset/3379004/search-exclude
CVE ID: CVE-2025-10647 State: PUBLISHED Published: 2025-09-19T08:23:58.303Z Last Updated: 2025-09-19T11:46:39.318Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: salzano Products: Embed PDF for WPForms Problem Types: CWE-434 Description: The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_media function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst
o upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af67a544-daff-469f-a66b-e998b79b7845?source=cve - https://wordpress.org/plugins/embed-pdf-wpforms/ - https://plugins.trac.wordpress.org/changeset/3364156/embed-pdf-wpforms/trunk/includes/class-wpforms-field-pdf-viewer.php
CVE ID: CVE-2025-10648 State: PUBLISHED Published: 2025-10-15T08:25:50.573Z Last Updated: 2025-10-15T15:25:33.972Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: cyberlord92 Products: YourMembership Single Sign On – YM SSO Login Problem Types: CWE-862 Description: The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ted attackers to read the profile data of the latest SSO login. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb25412-8f63-4a9d-84bd-44fac59c6eed?source=cve - https://plugins.trac.wordpress.org/browser/login-with-yourmembership/trunk/class-moym-sso.php#L88 - https://plugins.trac.wordpress.org/browser/login-with-yourmembership/trunk/class-moym-sso.php#L112
CVE ID: CVE-2025-10649 State: PUBLISHED Published: 2025-10-08T11:16:54.824Z Last Updated: 2025-10-08T13:27:52.426Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: uscnanbu Products: Welcart e-Commerce Problem Types: CWE-89 Description: The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extra
Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d59eedb-550f-44c1-a0cd-609c5661134d?source=cve - https://plugins.trac.wordpress.org/changeset/3374119/usc-e-shop
CVE ID: CVE-2025-10650 State: PUBLISHED Published: 2025-09-18T19:11:51.354Z Last Updated: 2025-09-18T20:43:22.529Z Vendors: SoftIron Products: HyperCloud Problem Types: CWE-269 Description: SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisories.softiron.cloud/
CVE ID: CVE-2025-10651 State: PUBLISHED Published: 2025-10-22T05:27:56.728Z Last Updated: 2025-10-22T13:33:50.557Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: uscnanbu Products: Welcart e-Commerce Problem Types: CWE-79 Description: The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22. This is due to insufficient sanitization on the order_mail field and a lack of escaping on output. This makes it possible for authenticated attackers, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execut
, with Editor-level permissions and above, to inject arbitrary web scripts via the General Setting page that will execute when an administrator accesses the E-mail Setting page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1f81e8-64ed-4330-9c76-1a8d2e2d307d?source=cve - https://plugins.trac.wordpress.org/changeset/3374769/usc-e-shop - https://www.welcart.com/archives/26052.html
CVE ID: CVE-2025-10652 State: PUBLISHED Published: 2025-09-20T01:53:42.323Z Last Updated: 2025-09-22T15:13:24.222Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: robcore89 Products: Robcore Netatmo Problem Types: CWE-89 Description: The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into al
possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd383f1-0546-4ff2-9f93-ee9d48ac3053?source=cve - https://plugins.trac.wordpress.org/browser/robcore-netatmo/tags/1.7/robcore-netatmo.php#L80 - https://plugins.trac.wordpress.org/browser/robcore-netatmo/tags/1.7/inc/class_robcore_netatmo.php#L3
CVE ID: CVE-2025-10653 State: PUBLISHED Published: 2025-10-02T20:03:12.268Z Last Updated: 2025-10-02T20:27:45.612Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Raise3D Products: Pro2 Series Problem Types: CWE-288 Description: An unauthenticated debug port may allow access to the device file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-01 - https://support.raise3d.com/
CVE ID: CVE-2025-10657 State: PUBLISHED Published: 2025-09-26T21:05:19.043Z Last Updated: 2025-09-30T03:55:08.351Z Vendors: Docker Products: Docker Desktop Problem Types: CWE-269 Description: In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/ ) enabled, an administrator can utilize the command restrictions feature https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/config/#command-restrictions to restrict commands that a container with a Docker socket mount may issue on that socket. Due to a software bug, the configuration to restrict command
tainer with a Docker socket mount may issue on that socket. Due to a software bug, the configuration to restrict commands was ignored when passed to ECI, allowing any command to be executed on the socket. This grants excessive privileges by permitting unrestricted access to powerful Docker commands. The vulnerability affects only Docker Desktop 4.46.0 users that have ECI enabled and are using the Docker socket command restrictions feature. In addition, since ECI restricts mounting the Docker socket into containers by default, it only affects containers which are explicitly allowed by the administrator to mount the Docker socket. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
allowed by the administrator to mount the Docker socket. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/release-notes
CVE ID: CVE-2025-10658 State: PUBLISHED Published: 2025-09-20T06:43:18.759Z Last Updated: 2025-09-22T15:01:56.425Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: psmplugins Products: SupportCandy – Helpdesk & Customer Support Ticket System Problem Types: CWE-307 Description: The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.3.7. This is due to missing rate limiting on the OTP verification for guest login. This makes it possible for unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute f
r unauthenticated attackers to bypass authentication and gain unauthorized access to customer support tickets by brute forcing the 6-digit OTP code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b11670a-f6e4-4555-ab76-4223f0194517?source=cve - https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/class-wpsc-current-user.php#L820 - https://plugins.trac.wordpress.org/browser/supportcandy/tags/3.3.7/includes/models/class-wpsc-email-otp.php#L348 - https://plugins.trac.wordpress.org/changeset/3364335/
CVE ID: CVE-2025-10659 State: PUBLISHED Published: 2025-09-30T20:00:53.126Z Last Updated: 2025-09-30T20:41:17.681Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MegaSys Products: Telenium Online Web Application: Problem Types: CWE-78 Description: The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a c
correctly validated or sanitized, an unauthenticated attacker can inject arbitrary operating system commands through a crafted HTTP request, leading to remote code execution on the server in the context of the web application service account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-01 - https://support.portal.megasys.com/
CVE ID: CVE-2025-10660 State: PUBLISHED Published: 2025-10-15T08:25:50.946Z Last Updated: 2025-10-15T19:35:38.467Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: nicholasbosch Products: WP Dashboard Chat Problem Types: CWE-89 Description: The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that ca
tackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21ffbb00-7c84-4d00-9a7f-0e412d8d5ed7?source=cve - https://plugins.trac.wordpress.org/browser/wp-dashboard-chat/tags/1.0.3/wp-dashboard-chat.php#L99 - https://plugins.trac.wordpress.org/browser/wp-dashboard-chat/tags/1.0.3/wp-dashboard-chat.php#L207
CVE ID: CVE-2025-10662 State: PUBLISHED Published: 2025-09-18T10:32:05.368Z Last Updated: 2025-09-18T13:39:26.837Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: SeaCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This affects another injection point than CVE-2025-25513. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
injection point than CVE-2025-25513. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324783 - https://vuldb.com/?ctiid.324783 - https://vuldb.com/?submit.649866 - https://github.com/coolcj-stack/seacms-v13.3-sqli/blob/main/README.md
CVE ID: CVE-2025-10663 State: PUBLISHED Published: 2025-09-18T11:02:08.600Z Last Updated: 2025-09-18T13:36:29.378Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Online Course Registration Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /my-profile.php. Performing manipulation of the argument cgpa results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324784 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324784 - https://vuldb.com/?ctiid.324784 - https://vuldb.com/?submit.651914 - https://github.com/LitBot123/mycve/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-10664 State: PUBLISHED Published: 2025-09-18T12:02:07.491Z Last Updated: 2025-09-18T13:23:00.921Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Small CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /create-ticket.php. Executing manipulation of the argument subject can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324785 - https://vuldb.com/?ctiid.324785 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324785 - https://vuldb.com/?ctiid.324785 - https://vuldb.com/?submit.651933 - https://github.com/HF101010/myCVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-10665 State: PUBLISHED Published: 2025-09-18T12:02:10.246Z Last Updated: 2025-09-18T13:20:07.829Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: kidaze Products: CourseSelectionSystem Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Affected is an unknown function of the file /Profilers/PProfile/COUNT3s3.php. The manipulation of the argument csem leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery,
ploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324786 - https://vuldb.com/?ctiid.324786 - https://vuldb.com/?submit.651941 - https://github.com/qi-wm/cve/issues/1
CVE ID: CVE-2025-10666 State: PUBLISHED Published: 2025-09-18T13:02:06.922Z Last Updated: 2025-09-18T14:39:51.823Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-825 Problem Types: CWE-120, CWE-119 Description: A security flaw has been discovered in D-Link DIR-825 up to 2.10. Affected by this vulnerability is the function sub_4106d4 of the file apply.cgi. The manipulation of the argument countdown_time results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Note
loited. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324787 - https://vuldb.com/?ctiid.324787 - https://vuldb.com/?submit.652047 - https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md - https://github.com/panda666-888/vuls/blob/main/d-link/dir-825/apply.cgi.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-10667 State: PUBLISHED Published: 2025-09-18T13:02:10.036Z Last Updated: 2025-09-18T13:19:11.612Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Discussion Forum Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in itsourcecode Online Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /members/compose_msg.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
n made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324788 - https://vuldb.com/?ctiid.324788 - https://vuldb.com/?submit.652167 - https://github.com/S77code/CVE1/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-10668 State: PUBLISHED Published: 2025-09-18T13:32:07.040Z Last Updated: 2025-09-18T13:41:36.072Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Discussion Forum Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in itsourcecode Online Discussion Forum 1.0. This affects an unknown part of the file /members/compose_msg_admin.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324789 -
blicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324789 - https://vuldb.com/?ctiid.324789 - https://vuldb.com/?submit.652176 - https://github.com/S77code/CVE1/issues/3 - https://itsourcecode.com/
CVE ID: CVE-2025-10669 State: PUBLISHED Published: 2025-09-18T13:32:09.467Z Last Updated: 2025-09-18T13:40:39.251Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Airsonic-Advanced Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in Airsonic-Advanced up to 10.6.0. This vulnerability affects unknown code of the component Playlist Upload Handler. Performing manipulation results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324790 - https://vuldb.com/?ctiid.324790 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.324790 - https://vuldb.com/?ctiid.324790 - https://vuldb.com/?submit.652356 - https://github.com/mikecole-mg/security_findings/blob/main/airsonic-advanced/airsonic-rce.md