Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-45855 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-06-03T18:23:10.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/erupts/erupt - https://www.erupt.xyz/#%21/ - https://gist.github.com/Cafe-Tea/b72d442be434e1dafe7810c938892b06
CVE ID: CVE-2025-45857 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T13:44:41.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.edimax.com/ - https://github.com/Jiangxiazhe/IOT_hack/blob/main/EDIMAX/CV7428NS/1.md
CVE ID: CVE-2025-45858 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-13T18:39:06.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/injection1.md
CVE ID: CVE-2025-45859 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T15:05:40.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/4/overflow.md
CVE ID: CVE-2025-45861 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T13:36:55.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/3/overflow.md
CVE ID: CVE-2025-45862 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-20T18:02:16.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in the formDhcpv6s interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/7/overflow.md
CVE ID: CVE-2025-45863 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T13:31:00.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/5/overflow.md
CVE ID: CVE-2025-45864 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T15:05:25.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in the formDhcpv6s interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/8/overflow.md
CVE ID: CVE-2025-45865 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T13:33:10.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/6/overflow.md
CVE ID: CVE-2025-45866 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T15:05:11.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the formDhcpv6s interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/9/overflow.md
CVE ID: CVE-2025-45867 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T15:04:52.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static_dns1 parameter in the formIpv6Setup interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/258/ids/36.html - https://github.com/Jiangxiazhe/IOT_hack/blob/main/TOTOLINK/A3002R/10/overflow.md
CVE ID: CVE-2025-45872 State: PUBLISHED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-08T14:23:32.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dengxmenglihua/cve/blob/main/ZrLog%20Blog%20System%20SSRF%20%2B%20File%20Overwrite%20Leading%20to%20RCE%20Vulnerability.md
CVE ID: CVE-2025-45878 State: PUBLISHED Published: 2025-06-17T00:00:00.000Z Last Updated: 2025-06-24T20:08:50.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.miliaris.it/ - https://xaliom.blogspot.com/2025/06/cve-2025-45878cve-2025-45879-and-cve.html - https://packetstorm.news/files/cve/CVE-2025-45878
CVE ID: CVE-2025-45879 State: PUBLISHED Published: 2025-06-17T00:00:00.000Z Last Updated: 2025-06-30T15:11:13.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.miliaris.it/ - https://xaliom.blogspot.com/2025/06/cve-2025-45878cve-2025-45879-and-cve.html - https://packetstorm.news/files/cve/CVE-2025-45879
CVE ID: CVE-2025-45880 State: PUBLISHED Published: 2025-06-17T00:00:00.000Z Last Updated: 2025-06-24T20:07:48.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.miliaris.it/ - https://xaliom.blogspot.com/2025/06/cve-2025-45878cve-2025-45879-and-cve.html - https://packetstorm.news/files/cve/CVE-2025-45880
CVE ID: CVE-2025-45885 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T22:08:12.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. Attackers can inject malicious code from the parameter 'emailcont' and use it directly in SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lintian31/vpm-system/blob/main/Vehicle%20parking%20Management%20System.md
CVE ID: CVE-2025-45887 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T22:13:20.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglongcn/yifang/issues/IBZVAG
CVE ID: CVE-2025-45890 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T15:31:42.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SecureCore1/CVE/blob/main/novel-plus/readme.md
CVE ID: CVE-2025-45892 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T20:31:43.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's editor is not properly sanitized or escaped before being rendered. This allows attackers to inject malicious JavaScript code Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opencart.com - https://packetstorm.news/files/id/202886
CVE ID: CVE-2025-45893 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T20:33:12.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opencart.com - https://packetstorm.news/files/id/202886
CVE ID: CVE-2025-45931 State: PUBLISHED Published: 2025-06-30T00:00:00.000Z Last Updated: 2025-06-30T18:38:53.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - http://dir-816-a2.com - https://github.com/Synmac05/CVE-advisories/blob/main/CVE-2025-45931.md
CVE ID: CVE-2025-45938 State: PUBLISHED Published: 2025-07-03T00:00:00.000Z Last Updated: 2025-07-03T14:44:33.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.y-security.de - https://docs.akeles.com/ooo/release-notes-for-4-2-0
CVE ID: CVE-2025-45939 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T14:09:24.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://golive.com - https://golive.apwide.com/doc/latest/server-data-center/2025-06-06
CVE ID: CVE-2025-45947 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-29T13:48:58.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/VasilVK/CVE/blob/main/CVE-2025-45947/README.MD
CVE ID: CVE-2025-45949 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-29T13:47:06.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/VasilVK/CVE/blob/main/CVE-2025-45949/README.MD
CVE ID: CVE-2025-45953 State: PUBLISHED Published: 2025-04-28T00:00:00.000Z Last Updated: 2025-04-29T13:45:31.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/VasilVK/CVE/blob/main/CVE-2025-45953/README.MD
CVE ID: CVE-2025-45956 State: PUBLISHED Published: 2025-04-29T00:00:00.000Z Last Updated: 2025-05-06T15:29:16.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lloydik/CLMS-vulnerabilities/blob/main/SQLi-CLMS-PoC.md
CVE ID: CVE-2025-45959 State: REJECTED Published: N/A Last Updated: 2025-11-03T17:14:46.533Z Description: No description available.
CVE ID: CVE-2025-45960 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T20:26:42.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tawkto.com - https://github.com/pracharapol/CVE-2025-45960
CVE ID: CVE-2025-45968 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-25T14:02:40.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Direct Object Reference (IDOR) vulnerability, which occurs due to a lack of proper authorization checks when accessing objects referenced by this parameter. This allows direct access to other users' data or internal resources without proper permission. Successful exploitation of this flaw may result in the exposure of sensitive information. Additional Analyst Notes: -
. Successful exploitation of this flaw may result in the exposure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@r3dd1t/pedindo-um-lanche-e-possivelemnte-descobrindo-uma-cve-9930b0114e3f
CVE ID: CVE-2025-45984 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T14:15:14.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_routepwd%20Indicates%20the%20unauthorized%20command%20injection/LB-LINK_routepwd%20co
rability/blob/main/LB-LINK/LB-LINK_routepwd%20Indicates%20the%20unauthorized%20command%20injection/LB-LINK_routepwd%20command%20injection.md
CVE ID: CVE-2025-45985 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T14:51:09.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_enable%20Unauthorized%20command%20injection/LB-LINK_enable%20command%20injection.md
CVE ID: CVE-2025-45986 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T14:59:24.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bs_SetMacBlack function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_mac%20Unauthorized%20command%20injection/LB-LINK_mac%20command%20injection.md
CVE ID: CVE-2025-45987 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T15:03:03.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_dns1%20Unauthorized%20command%20injection/The%20LB-LINK_dns1%20command%20is%20used%
nerability/blob/main/LB-LINK/LB-LINK_dns1%20Unauthorized%20command%20injection/The%20LB-LINK_dns1%20command%20is%20used%20to%20inject%20the%20information.md
CVE ID: CVE-2025-45988 State: PUBLISHED Published: 2025-06-13T00:00:00.000Z Last Updated: 2025-06-13T15:06:37.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glkfc/IoT-Vulnerability/blob/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used
/main/LB-LINK/LB-LINK_cmd%20Indicates%20the%20unauthorized%20command%20injection/The%20LB-LINK_cmd%20command%20is%20used%20to%20inject%20information.md
CVE ID: CVE-2025-45994 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-29T15:26:48.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/spoNge369/CVE/blob/main/CVE-2025-45994/README.md - https://arandasoft.com/en/productos/password-recovery/
CVE ID: CVE-2025-45997 State: PUBLISHED Published: 2025-05-28T00:00:00.000Z Last Updated: 2025-05-28T14:35:18.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17883/web-based-product-alert-system.html - https://github.com/litsasuk/CVE-POC/blob/main/CVE-2025-45997.md
CVE ID: CVE-2025-46000 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:28:45.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploading a crafted SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simogeo/Filemanager - https://github.com/simogeo/Filemanager/commit/c75b914 - https://github.com/zakumini/CVE-List/blob/main/CVE-2025-46000/CVE-2025-46000.md
CVE ID: CVE-2025-46001 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-23T15:16:34.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simogeo/Filemanager - https://www.exploit-db.com/exploits/38895 - https://github.com/zakumini/CVE-List/blob/main/CVE-2025-46001/CVE-2025-46001.md
CVE ID: CVE-2025-46002 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:27:13.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simogeo/Filemanager - https://www.exploit-db.com/exploits/38945 - https://github.com/simogeo/Filemanager/releases/tag/v1.7.0 - https://github.com/simogeo/Filemanager/releases/tag/v1.8.0 - https://github.com/simogeo/Filemanager/releases/tag/v2.0.0 - https://github.com/simogeo/Fileman
er/releases/tag/v1.8.0 - https://github.com/simogeo/Filemanager/releases/tag/v2.0.0 - https://github.com/simogeo/Filemanager/releases/tag/v2.1.0 - https://github.com/simogeo/Filemanager/releases/tag/v2.2.0 - https://github.com/simogeo/Filemanager/releases/tag/v2.3.0 - https://github.com/zakumini/CVE-List/blob/main/CVE-2025-46002/CVE-2025-46002.md
CVE ID: CVE-2025-46011 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-09T20:56:28.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kevinroleke/security/tree/main/CVE-2025-46011 - https://github.com/knadh/listmonk/releases/tag/v5.0.0 - https://github.com/knadh/listmonk/commit/4b805f885b9f5a20126ec06f8b59dc448c4af33b - https://github.com/knadh/listmonk/issues/2412 - https://github.com/knadh/listmonk/releases/tag/v4.1.0