Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-209 Description: Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53803
CVE ID: CVE-2025-53804 State: PUBLISHED Published: 2025-09-09T17:01:13.470Z Last Updated: 2025-11-21T18:18:24.544Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-200 Description: Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53804
CVE ID: CVE-2025-53805 State: PUBLISHED Published: 2025-09-09T17:01:13.983Z Last Updated: 2025-11-21T18:18:25.187Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-125 Description: Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ws an unauthorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53805
CVE ID: CVE-2025-53806 State: PUBLISHED Published: 2025-09-09T17:01:14.583Z Last Updated: 2025-11-21T18:18:25.868Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Se
vice Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-126, CWE-125 Description: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53806
CVE ID: CVE-2025-53807 State: PUBLISHED Published: 2025-09-09T17:01:15.192Z Last Updated: 2025-11-21T18:18:26.333Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared
dows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-362, CWE-416 Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53807
CVE ID: CVE-2025-53808 State: PUBLISHED Published: 2025-09-09T17:01:15.772Z Last Updated: 2025-11-21T18:18:26.910Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-843 Description: Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges
atible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53808
CVE ID: CVE-2025-53809 State: PUBLISHED Published: 2025-09-09T17:01:16.552Z Last Updated: 2025-11-21T18:18:27.402Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-20 Description: Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53809
CVE ID: CVE-2025-53810 State: PUBLISHED Published: 2025-09-09T17:01:17.070Z Last Updated: 2025-11-21T18:18:28.281Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wi
atible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53810
CVE ID: CVE-2025-53811 State: PUBLISHED Published: 2025-08-26T12:22:55.182Z Last Updated: 2025-08-26T14:06:08.863Z Vendors: Mosh-Pro Products: Mosh-Pro Problem Types: CWE-276 Description: The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent. This issue was
rompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent. This issue was detected in 1.3.2 version of Mosh-Pro. Since authors did not respond to messages from CNA, patching status is unknown. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/tcc-bypass/ - https://moshpro.app/
CVE ID: CVE-2025-53813 State: PUBLISHED Published: 2025-08-26T12:22:57.545Z Last Updated: 2025-08-26T13:59:53.451Z Vendors: Nozbe Products: Nozbe Problem Types: CWE-276 Description: The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2025.11 of Nozbe. Additional Analyst Notes: - CISA
system prompt asking for permission. This issue was fixed in version 2025.11 of Nozbe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/08/tcc-bypass/ - https://nozbe.com/
CVE ID: CVE-2025-53814 State: PUBLISHED Published: 2025-10-28T13:45:38.831Z Last Updated: 2025-11-03T17:44:59.975Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GCC Productions Inc. Products: Fade In Problem Types: CWE-416 Description: A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .xml file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2252
CVE ID: CVE-2025-53816 State: PUBLISHED Published: 2025-07-17T18:09:58.480Z Last Updated: 2025-11-04T21:12:37.201Z Vendors: ipavlov Products: 7-Zip Problem Types: CWE-122 Description: 7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2025-058_7-Zip/ - https://www.openwall.com/lists/oss-security/2025/07/18/1
CVE ID: CVE-2025-53817 State: PUBLISHED Published: 2025-07-17T18:12:24.553Z Last Updated: 2025-11-04T21:12:38.546Z Vendors: ipavlov Products: 7-Zip Problem Types: CWE-476 Description: 7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2025-059_7-Zip/ - https://www.openwall.com/lists/oss-security/2025/07/18/2
CVE ID: CVE-2025-53818 State: PUBLISHED Published: 2025-07-14T20:30:29.550Z Last Updated: 2025-07-15T19:50:34.781Z Vendors: Sunwood-ai-labs Products: github-kanban-mcp-server Problem Types: CWE-78 Description: GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vu
`add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vulnerable API if concatenated with untrusted user input. As of time of publication, no known patches are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/security/advisories/GHSA-6jx8-rcjx-vmwf - https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/main/src/handlers/comment-handlers.ts#L8 - https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/main/src/handlers/tool-handlers.ts#L79 - https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/v0.4.0/src/handlers
src/handlers/tool-handlers.ts#L79 - https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/v0.4.0/src/handlers/comment-handlers.ts#L8-L23
CVE ID: CVE-2025-53819 State: PUBLISHED Published: 2025-07-14T20:42:12.818Z Last Updated: 2025-07-15T19:50:28.259Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: NixOS Products: nix Problem Types: CWE-271 Description: Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NixOS/nix/security/advisories/GHSA-qc7j-jgf3-qmhg - https://github.com/NixOS/nix/pull/13281 - https://github.com/NixOS/nix/pull/
x/security/advisories/GHSA-qc7j-jgf3-qmhg - https://github.com/NixOS/nix/pull/13281 - https://github.com/NixOS/nix/pull/13455 - https://github.com/NixOS/nix/commit/e2ef2cfcbc83ea01308ee64c38a58707ab23dec3
CVE ID: CVE-2025-53820 State: PUBLISHED Published: 2025-07-14T20:47:33.412Z Last Updated: 2025-07-15T19:50:21.945Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `index.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `erro` parameter. Version 3.4.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment:
the `erro` parameter. Version 3.4.5 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rrm-92jv-xwcv
CVE ID: CVE-2025-53821 State: PUBLISHED Published: 2025-07-14T22:16:30.206Z Last Updated: 2025-07-15T19:50:14.872Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-601 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arbitrary URL via the `nextPage` parameter, leading to an uncontrolled redirection. Version 3.4.5 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
ion. Version 3.4.5 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f5c2-jmm6-v2c5
CVE ID: CVE-2025-53822 State: PUBLISHED Published: 2025-07-14T22:28:54.603Z Last Updated: 2025-07-15T19:50:08.486Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `relatorio_geracao.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `tipo_relatorio` parameter. Version 3.4.5 has a patch for the issue. Additional Analyst Notes: - CISA A
s scripts in the `tipo_relatorio` parameter. Version 3.4.5 has a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f5xr-4g63-pc9r
CVE ID: CVE-2025-53823 State: PUBLISHED Published: 2025-07-14T22:31:26.368Z Last Updated: 2025-07-15T19:50:00.452Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-89 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Versions prior to 3.4.5 have a SQL Injection vulnerability in the endpoint `/WeGIA/html/socio/sistema/processa_deletar_socio.php`, in the `id_socio` parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
availability of stored data. Version 3.4.5 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-p8xr-qg3c-6ww2
CVE ID: CVE-2025-53824 State: PUBLISHED Published: 2025-07-14T22:41:51.377Z Last Updated: 2025-07-15T19:49:53.682Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the editar_permissoes.php endpoint of the WeGIA application prior to version 3.4.4. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. Version 3.4.4 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-86r7-gc8h-63gh
CVE ID: CVE-2025-53825 State: PUBLISHED Published: 2025-07-14T22:44:22.246Z Last Updated: 2025-07-15T19:49:44.231Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Dokploy Products: dokploy Problem Types: CWE-862 Description: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk. Vers
otentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk. Version 0.24.3 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Dokploy/dokploy/security/advisories/GHSA-h67g-mpq5-6ph5 - https://github.com/Dokploy/dokploy/commit/1977235d313824b9764f1a06785fb7f73ab7eba2
CVE ID: CVE-2025-53826 State: PUBLISHED Published: 2025-07-15T18:12:24.289Z Last Updated: 2025-07-15T18:37:40.098Z Vendors: filebrowser Products: filebrowser Problem Types: CWE-305, CWE-385, CWE-613 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7xwp-2cpp-p8r7 - https:
Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7xwp-2cpp-p8r7 - https://github.com/filebrowser/filebrowser/issues/5216
CVE ID: CVE-2025-53832 State: PUBLISHED Published: 2025-07-21T20:18:02.755Z Last Updated: 2025-07-21T20:50:29.802Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: translated Products: lara-mcp Problem Types: CWE-77 Description: Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution unde
enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). This vulnerability is fixed in version 0.0.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7 - https://github.com/translated/lara-mcp/commit/e534ef690adf390e4ac862a200b2a83f6cf45944
CVE ID: CVE-2025-53833 State: PUBLISHED Published: 2025-07-14T22:56:38.957Z Last Updated: 2025-07-15T19:49:32.713Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: saleem-hadad Products: larecipe Problem Types: CWE-1336 Description: LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. U
mands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2 - https://github.com/saleem-hadad/larecipe/pull/390 - https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b