Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-50172 State: PUBLISHED Published: 2025-08-12T17:10:08.401Z Last Updated: 2025-11-10T00:12:13.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-770 Description: Allocation of resources without limits
Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-770 Description: Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50172
CVE ID: CVE-2025-50173 State: PUBLISHED Published: 2025-08-12T17:10:08.976Z Last Updated: 2025-11-10T00:12:13.628Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Multimedia Redirection Installer, Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Versi
tion (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-1390 Description: Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. Additional Analy
: Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50173
CVE ID: CVE-2025-50174 State: PUBLISHED Published: 2025-10-14T17:00:07.552Z Last Updated: 2025-11-22T04:08:16.842Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-416 Description: Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50174
CVE ID: CVE-2025-50175 State: PUBLISHED Published: 2025-10-14T17:00:56.629Z Last Updated: 2025-11-22T04:09:03.239Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 11 Version 25H2 Problem Types: CWE-416 Description: Use after free
indows 11 Version 24H2, Windows Server 2025, Windows 11 Version 25H2 Problem Types: CWE-416 Description: Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50175
CVE ID: CVE-2025-50176 State: PUBLISHED Published: 2025-08-12T17:10:09.560Z Last Updated: 2025-11-10T00:12:14.172Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows Server 2022, Windows 11 version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025 Problem Types: CWE-843, CWE-122 Description: Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vu
sion') in Graphics Kernel allows an authorized attacker to execute code locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50176
CVE ID: CVE-2025-50177 State: PUBLISHED Published: 2025-08-12T17:10:10.219Z Last Updated: 2025-11-10T00:12:14.798Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2025 (Server Core installation), Windows 11 version 22H3, Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Wind
indows 11 Version 24H2, Windows Server 2025, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) Problem Types: CWE-416, CWE-362 Description: Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP V
s Message Queuing allows an unauthorized attacker to execute code over a network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50177
CVE ID: CVE-2025-50178 State: PUBLISHED Published: 2025-06-25T15:12:24.751Z Last Updated: 2025-06-25T15:20:43.040Z Vendors: JuliaWeb Products: GitForge.jl Problem Types: CWE-20, CWE-22 Description: GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functions. In the `GitForge.get_repo` function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like `../` in the input to access any other endpoints on api.github.com that were not intend
add path traversal patterns like `../` in the input to access any other endpoints on api.github.com that were not intended. Version 0.4.3 contains a patch for the issue. No known workarounds are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JuliaWeb/GitForge.jl/security/advisories/GHSA-g2xx-229f-3qjm - https://github.com/JuliaWeb/GitForge.jl/pull/50
CVE ID: CVE-2025-50179 State: PUBLISHED Published: 2025-06-25T15:48:24.488Z Last Updated: 2025-06-25T16:00:32.891Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Enalean Products: tuleap Problem Types: CWE-352 Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issu
responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-rxpm-g7gw-4mrv - https://github.com/Enalean/tuleap/commit/0f9aab6e3640e892c74c9dfc90ad65fd3aff499e - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0f9aab6e3640e892c74c9dfc90ad65fd3aff499e - https://tuleap.net/plugins/tracker/?aid=43357
CVE ID: CVE-2025-50181 State: PUBLISHED Published: 2025-06-19T01:08:00.340Z Last Updated: 2025-06-23T16:46:13.820Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: urllib3 Products: urllib3 Problem Types: CWE-601 Description: urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been
en redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v - https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
CVE ID: CVE-2025-50182 State: PUBLISHED Published: 2025-06-19T01:42:44.921Z Last Updated: 2025-06-30T19:02:41.510Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: urllib3 Products: urllib3 Problem Types: CWE-601 Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but
ed to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5 - https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f
CVE ID: CVE-2025-50183 State: PUBLISHED Published: 2025-06-19T02:20:32.618Z Last Updated: 2025-06-23T16:57:37.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: OpenListTeam Products: OpenList Problem Types: CWE-79 Description: OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4. Additional Analyst Notes: - CISA ADP Vu
o a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-2hw3-h8qx-hqqp - https://github.com/OpenListTeam/OpenList-Frontend/commit/7b5ed20c608c7b9b36d1950a386678e0a89f8175
CVE ID: CVE-2025-50184 State: PUBLISHED Published: 2025-07-26T03:27:05.690Z Last Updated: 2025-07-28T15:58:17.489Z Vendors: dbgate Products: dbgate Problem Types: CWE-29 Description: DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be manipulated to access arbitrary files on the system. By supplying a crafted path to the file parameter, an attacker can read files outside the upload directory, potentially exposing sensitive system-level data. This is
ter, an attacker can read files outside the upload directory, potentially exposing sensitive system-level data. This is fixed in version 6.4.3-beta.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dbgate/dbgate/security/advisories/GHSA-2fp9-29gv-p5gm - https://github.com/dbgate/dbgate/commit/18b11df672b5a887bc17a6b9fdd13f9742c8f98e
CVE ID: CVE-2025-50185 State: PUBLISHED Published: 2025-07-26T03:34:43.481Z Last Updated: 2025-07-28T18:55:40.184Z Vendors: dbgate Products: dbgate Problem Types: CWE-29 Description: DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file type. The plugin fails to enforce proper checks on content type and file extension before reading a file. As a result, even sensitive files accessible only to the root user can be read through the application interface. Th
le. As a result, even sensitive files accessible only to the root user can be read through the application interface. There is currently no fix for this issue. ``` POST /runners/load-reader HTTP/1.1 Host: <REPLACE ME> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Referer: <REPLACE ME> Content-Type: application/json Authorization: Bearer <REPLACE ME> Content-Length: 127 Origin: http://192.168.124.119:3000 Connection: keep-alive Cookie: <REPLACE ME> Priority: u=0 Cache-Control: max-age=0 {"functionName":"reader@dbgate-plugin-csv","props":{"fileName":"/etc\/shadow","limitRows":100
0 Cache-Control: max-age=0 {"functionName":"reader@dbgate-plugin-csv","props":{"fileName":"/etc\/shadow","limitRows":100}} ``` The request payload: ![Screenshot From 2025-05-31 22-54-49](https://github.com/user-attachments/assets/28943ad7-14f8-432a-9836-cec5c3593c0a) Lines of the file being returned: ![Screenshot From 2025-05-31 22-55-23](https://github.com/user-attachments/assets/4fae4652-097d-4d39-9f7a-6ce39346ed1d) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dbgate/dbgate/security/advisories/GHSA-7x75-fmx7-q6h9 - https://github.com/dbgate/dbgate/blob/v6.6.0/plugins/dbgate-plugin-csv/src/backend/reader.js#L71-L102
CVE ID: CVE-2025-50200 State: PUBLISHED Published: 2025-06-19T16:14:24.919Z Last Updated: 2025-06-20T17:43:55.579Z Vendors: rabbitmq Products: rabbitmq-server Problem Types: CWE-532 Description: RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8. Additional A
sed to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8
CVE ID: CVE-2025-50201 State: PUBLISHED Published: 2025-06-19T03:34:29.859Z Last Updated: 2025-06-23T17:00:13.496Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-78 Description: WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the
tem. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-52p5-5fmw-9hrf - https://github.com/LabRedesCefetRJ/WeGIA/commit/45f32ad1d52775fc99f3c90075c8136c6d4d1d3d
CVE ID: CVE-2025-50202 State: PUBLISHED Published: 2025-06-18T04:13:01.405Z Last Updated: 2025-06-18T14:00:25.727Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: LycheeOrg Products: Lychee Problem Types: CWE-22 Description: Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, nginx logs, other user's uploaded images, and configuration secrets due to a path traversal exploit in SecurePathController.php. This issue has been patched in version 6.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LycheeOrg/Lychee/security/a
6.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-6rj9-gm78-vhf9 - https://github.com/LycheeOrg/Lychee/commit/ae7270b7b47e4a284ea1f69d260e52d592711072 - https://github.com/LycheeOrg/Lychee/blob/0709f5d984d4df77fc5e23a29a0231437e684e99/app/Http/Controllers/SecurePathController.php#L61
CVE ID: CVE-2025-50213 State: PUBLISHED Published: 2025-06-24T07:06:53.128Z Last Updated: 2025-06-24T18:03:35.296Z Vendors: Apache Software Foundation Products: Apache Airflow Providers Snowflake Problem Types: CWE-75 Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ded to upgrade to version 6.4.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/51734 - https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3
CVE ID: CVE-2025-50233 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T19:23:57.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend template editor. By manipulating the parameter, attackers can perform directory traversal and access sensitive files outside the intended template directory, potentially exposing system configuration, PHP source code, or other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xiaoyangsec/cve -
itive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xiaoyangsec/cve - https://github.com/xiaoyangsec/cve/blob/main/README.md
CVE ID: CVE-2025-50234 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-06T19:19:15.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypte
the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage
s and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting the system's security and stability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xiaoyangsec/mccms/blob/main/MCCMS-SSRF.md
CVE ID: CVE-2025-50240 State: PUBLISHED Published: 2025-07-17T00:00:00.000Z Last Updated: 2025-07-18T14:58:12.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/nbacheng/nbcio-boot/ - https://gist.github.com/Cafe-Tea/88d385c1d297af939bb0089d04d9d158
CVE ID: CVE-2025-50251 State: PUBLISHED Published: 2025-08-13T00:00:00.000Z Last Updated: 2025-08-13T20:31:26.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/52211 - https://packetstorm.news/files/id/190475/
CVE ID: CVE-2025-50255 State: PUBLISHED Published: 2025-09-18T00:00:00.000Z Last Updated: 2025-09-18T17:45:55.554Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/c2at3/cve-2025-50255/-/blob/main/Bypassing_CSRF_Protection_in_Smartvista-BackOffice.pdf
CVE ID: CVE-2025-50258 State: PUBLISHED Published: 2025-07-03T00:00:00.000Z Last Updated: 2025-07-03T13:40:09.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC6_SetSysTimeCfg_timeoverflow/detail.md