Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-28038 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T19:06:00.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlanIdx parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/RCE1-1ad8e5e2b1a28030a1c8febac89935a0
CVE ID: CVE-2025-28039 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T19:07:31.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileName parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://locrian-lightning-dc7.notion.site/RCE2-1ad8e5e2b1a280fbb0cacc7e758e7299
CVE ID: CVE-2025-28041 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T13:37:17.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/michaelliao/itranswarp/issues/73
CVE ID: CVE-2025-28055 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T14:00:22.162Z Vendors: n/a Products: n/a Problem Types: n/a Description: upset-gal-web v7.1.0 /api/music/v1/cover.ts contains an arbitrary file read vulnerabilit Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shinnku-nikaidou/upset-gal-web/issues/132 - https://gist.github.com/LTLTLXEY/eb5e07436e0fcaca9747cd4467055f14
CVE ID: CVE-2025-28056 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T14:04:17.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: rebuild v3.9.0 through v3.9.3 has a SQL injection vulnerability in /admin/admin-cli/exec component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getrebuild/rebuild/issues/866 - https://gist.github.com/LTLTLXEY/c34dc785fc24f4cbb026e2ef3d7660c4
CVE ID: CVE-2025-28057 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-14T14:12:46.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: owl-admin v3.2.2~ to v4.10.2 is vulnerable to SQL Injection in /admin-api/system/admin_menus/save_order. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slowlyo/owl-admin/issues/182 - https://gist.github.com/LTLTLXEY/8f8ea23290f45fbc5cb2191a39cc74e8
CVE ID: CVE-2025-28059 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T14:28:48.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke associated API tokens, enabling unauthorized access to restricted functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aakashtyal/Residual-Data-Access-Post-User-Deletion-in-Nagios-Network-A
DP Vulnrichment: References: - https://github.com/aakashtyal/Residual-Data-Access-Post-User-Deletion-in-Nagios-Network-Analyzer-Version-2024R1 - https://www.nagios.com/changelog/#network-analyze
CVE ID: CVE-2025-28062 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-13T19:10:01.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/erpnext - https://github.com/Thvt0ne/CVE-2025-28062
CVE ID: CVE-2025-28072 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:41:53.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Pre-School Enrollment System is vulnerable to Directory Traversal in manage-teachers.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baixiaobi/TST/blob/main/README.md
CVE ID: CVE-2025-28073 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-06-07T18:47:04.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phpList/phplist3 - https://github.com/mLniumm/CVE-2025-28073 - https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15 - https://www.phplist.org/newslist/phplist-3-6-15-release-notes/
CVE ID: CVE-2025-28074 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-06-07T14:42:05.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.php - https://github.com/mLniumm/CVE-2025-28074 - https://github.com/phpList/phplist3/com
blob/main/public_html/lists/lt.php - https://github.com/mLniumm/CVE-2025-28074 - https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15 - https://www.phplist.org/newslist/phplist-3-6-15-release-notes/
CVE ID: CVE-2025-28076 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T16:54:18.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows remote authenticated attackers to execute arbitrary SQL commands via the (1) timeago, (2) user, (3) filter, (4) target, (5) p1, (6) p2, (7) p3, (8) p4, (9) p5, (10) p6, (11) p7, (12) p8, (13) p9, (14) p10, (15) p11, (16) p12, (17) p13, (18) p14, (19) p15, (20) p16, (21) p17, (22) p18, (23) p19, or (24) p20 parameter to /api/management/updateihmsettings; the (25) ID, (26) NAME, (27) CPUTHREADNB, (28) RAMCAP, or (29) DISKCAP pa
arameter to /api/management/updateihmsettings; the (25) ID, (26) NAME, (27) CPUTHREADNB, (28) RAMCAP, or (29) DISKCAP parameter to /api/capaplan/savetemplates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2025-28076.md - https://www.easyvirt.com/
CVE ID: CVE-2025-28087 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T20:56:16.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/vxhdpdeavzvtvdqq
CVE ID: CVE-2025-28089 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T20:43:02.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/magicblack/maccms10/releases/tag/v2025.1000.4047 - https://www.yuque.com/morysummer/vx41bz/wzer7qxh0vwrf6zq
CVE ID: CVE-2025-28090 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T19:25:59.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/xo5w1euakvtgenex
CVE ID: CVE-2025-28091 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T20:40:44.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/ax55rxv4u3our1ic
CVE ID: CVE-2025-28092 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T19:16:22.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/stggvmlxs9ewqlvu
CVE ID: CVE-2025-28093 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T19:13:57.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/he2hb8ic8an8h07f
CVE ID: CVE-2025-28094 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T17:13:30.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/echzollcdlmllgqo
CVE ID: CVE-2025-28096 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T16:22:46.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/oqi6pyv26gci6465
CVE ID: CVE-2025-28097 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T15:00:39.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/morysummer/vx41bz/oqi6pyv26gci6465
CVE ID: CVE-2025-28099 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-05-12T14:13:11.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp, Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/fumiao/opencms/issues/IBLJLM - https://gist.github.com/kaoniniang2/e159346725f50d6c44c82214970f02b8
CVE ID: CVE-2025-28100 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-16T14:22:36.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gh3-dk/vul/blob/main/sql%20injection/dingfanzu/dingfanzu-CMS%20operateOrder.php%20id%20SQL-inject.md
CVE ID: CVE-2025-28101 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T18:05:58.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other users via supplying a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/flaskBlog/issues/130 - https://gist.github.com/coleak2021/cecfc757bc77038717c3e7b40e2d66ce
CVE ID: CVE-2025-28102 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T18:07:21.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/flaskBlog/issues/130 - https://gist.github.com/coleak2021/edbd6e0766227ee96a7a4601e50773eb
CVE ID: CVE-2025-28103 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-05-12T14:11:20.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/flaskBlog/issues/130 - https://gist.github.com/coleak2021/77895b7a7b335ae17eb57390f4a94917
CVE ID: CVE-2025-28104 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-05-12T15:46:37.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DogukanUrker/flaskBlog/issues/130 - https://gist.github.com/coleak2021/d5fea0f7d32a2de38130da089f4fb735
CVE ID: CVE-2025-28121 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T15:11:41.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing remote attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code-projects.org/online-exam-mastering-system-php/ - https://github.com/pruthuraut/CVE-2025-28121
CVE ID: CVE-2025-28128 State: PUBLISHED Published: 2025-04-25T00:00:00.000Z Last Updated: 2025-04-25T20:25:54.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Mytel Telecom Online Account System v1.0 allows attackers to bypass the OTP verification process via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mytel.com.mm - https://gist.github.com/str4ng3r-0x7/3d9d310cb6cc5af39088ef44289ba588#file-cve-2025-28128
CVE ID: CVE-2025-28129 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T18:22:53.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Hostel Management System 2.1 is vulnerable to clickjacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NullMinds/CVE-Hunting/blob/main/Hostel%20Management%20System%20in%20PHP/Clickjacking.pdf
CVE ID: CVE-2025-28131 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-01T19:47:57.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enabling unauthorized modifications that compromise system integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/#network-analyzer - https://github.com/harshal79/Pr
ISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/#network-analyzer - https://github.com/harshal79/Privilege-Escalation-in-Nagios-Network-Analyzer.git
CVE ID: CVE-2025-28132 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-01T19:49:32.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leading to unauthorized access and account takeover. This occurs due to insufficient session expiration, where session tokens remain valid beyond logout, allowing an attacker to impersonate users and perform actions on their behalf. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/changelog/#network-analyzer - https://github.com/harshal79/Insufficien
ulnrichment: References: - https://www.nagios.com/changelog/#network-analyzer - https://github.com/harshal79/Insufficient-Session-Expiration.git
CVE ID: CVE-2025-28135 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-04-15T13:42:54.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5182_B20201026-19872b8cd95f80808902fac8449fee64 - https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28135.md
CVE ID: CVE-2025-28136 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:28:09.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sudsy-eyeliner-a59.notion.site/BufferOverflow-V4-1-2cu-5137_B20200730-19872b8cd95f80cf8df9f3abcb912554 - https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28136.md
CVE ID: CVE-2025-28137 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T17:35:32.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756?pvs=4 - https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28137.md
CVE ID: CVE-2025-28138 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-04-15T14:12:34.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TOTOLINK A800R V4.1.2cu.5137_B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sudsy-eyeliner-a59.notion.site/RCE2-1ac72b8cd95f8055a76ee0ca262aac1a?pvs=4 - https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28138.md
CVE ID: CVE-2025-28142 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:11:36.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/4 - https://gist.github.com/regainer27/fb033d40b9d0245c36e520eeb34b7e76
CVE ID: CVE-2025-28143 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:10:37.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/5 - https://gist.github.com/regainer27/885505cda80f81069ba39b11f2f996fc
CVE ID: CVE-2025-28144 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:09:39.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/edimax_br-6847_v3-%20peerpin_stack_overflow - https://gist.github.com/regainer27/31a4df78e523635085908ddd4b68d91f
CVE ID: CVE-2025-28145 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T20:12:35.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/2 - https://gist.github.com/regainer27/cee49ede0f576447cc4b1bb078e7a981
CVE ID: CVE-2025-28146 State: PUBLISHED Published: 2025-04-04T00:00:00.000Z Last Updated: 2025-04-15T15:15:25.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/edimax-br-6478ac_v3-br-6478ac_v3_1.0.15/tree/main/3 - https://gist.github.com/regainer27/469a6f2b694a76c3b58249b27fdd0881
CVE ID: CVE-2025-28168 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-08-26T19:27:57.951Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Multi Uploaders Products: Multiple File Upload Problem Types: CWE-602 Description: The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a parameter to bypass extension restrictions and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems. Ad
ns and upload arbitrary files. NOTE: this is a third-party component that is not supplied or supported by OutSystems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.outsystems.com/forge/component-overview/200/multiple-file-upload-o11 - https://gist.github.com/IamLeandrooooo/01090be3023f5e7c7397bb9b1f5505b9
CVE ID: CVE-2025-28169 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-24T13:17:39.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer's cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.byd.com - https://gist.github.com/rainymode/bfd976ecbe0d0b776fd930375156c19c
CVE ID: CVE-2025-28170 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T17:31:16.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://grandstream.com - https://gist.github.com/Exek1el/928ea6fd06d3b48c1c91cfdc30317d8d