Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2719 State: PUBLISHED Published: 2025-04-10T07:02:39.962Z Last Updated: 2025-04-10T13:36:01.911Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: hasthemes Products: Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) Problem Types: CWE-862 Description: The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authentica
missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39336115-5993-49e1-b810-80a712e8e42b?source=cve - https://plugins.trac.wordpress.org/browser/swatchly/tags/1.2.8/includes/Admin/Notices.php#L59
CVE ID: CVE-2025-2720 State: REJECTED Published: 2025-03-24T23:31:06.804Z Last Updated: 2025-03-27T06:03:42.304Z Description: No description available.
CVE ID: CVE-2025-2721 State: REJECTED Published: 2025-03-25T00:00:10.522Z Last Updated: 2025-04-22T12:25:20.242Z Description: No description available.
CVE ID: CVE-2025-2722 State: REJECTED Published: 2025-03-25T00:31:03.859Z Last Updated: 2025-04-22T12:25:34.147Z Description: No description available.
CVE ID: CVE-2025-2723 State: REJECTED Published: 2025-03-25T01:00:06.666Z Last Updated: 2025-04-22T12:25:37.918Z Description: No description available.
CVE ID: CVE-2025-2724 State: REJECTED Published: 2025-03-25T01:31:04.182Z Last Updated: 2025-04-22T12:25:39.888Z Description: No description available.
CVE ID: CVE-2025-2725 State: PUBLISHED Published: 2025-03-25T02:00:09.925Z Last Updated: 2025-04-11T20:05:07.420Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The e
t Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300745 - https://vuldb.com/?ctiid.300745 - https://vuldb.com/?submit.520390 - https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_1.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2726 State: PUBLISHED Published: 2025-03-25T02:00:11.956Z Last Updated: 2025-04-11T20:05:24.806Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack. Th
equest Handler. The manipulation leads to command injection. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300746 - https://vuldb.com/?ctiid.300746 - https://vuldb.com/?submit.520393 - https://github.com/ZIKH26/CVE-information/blob/master/H3C/Vulnerability%20Information_2.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2727 State: PUBLISHED Published: 2025-03-25T02:31:03.932Z Last Updated: 2025-04-11T20:05:34.164Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX30 Pro Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected compon
succeed. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300747 - https://vuldb.com/?ctiid.300747 - https://vuldb.com/?submit.520394 - https://github.com/ggstrunk/CVE/blob/main/wizard_getNetworkStatus.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2728 State: PUBLISHED Published: 2025-03-25T02:31:05.468Z Last Updated: 2025-04-11T20:05:30.107Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX30 Pro, Magic NX400 Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in H3C Magic NX30 Pro and Magic NX400 up to V100R014 and classified as critical. This vulnerability affects unknown code of the file /api/wizard/getNetworkConf. The manipulation leads to command injection. The attack needs to be approached within the local network. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300748 - https://vuldb.com/?ctiid.300748 - https://vuldb.com/?submit.520462 - https://github.com/RK1Y8/cve_cve/blob/main/h3c.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2729 State: PUBLISHED Published: 2025-03-25T03:00:09.183Z Last Updated: 2025-04-11T20:05:39.701Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit h
andler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300749 - https://vuldb.com/?ctiid.300749 - https://vuldb.com/?submit.520494 - https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_1.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2730 State: PUBLISHED Published: 2025-03-25T03:00:11.804Z Last Updated: 2025-04-11T20:05:51.630Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit
ler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300750 - https://vuldb.com/?ctiid.300750 - https://vuldb.com/?submit.520495 - https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_2.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2731 State: PUBLISHED Published: 2025-03-25T03:31:04.477Z Last Updated: 2025-04-11T20:05:56.808Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/wizard/getDualbandSync of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the lo
ponent HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300751 - https://vuldb.com/?ctiid.300751 - https://vuldb.com/?submit.520497 - https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_3.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2732 State: PUBLISHED Published: 2025-03-25T04:00:07.714Z Last Updated: 2025-04-11T20:05:45.701Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/wizard/getWifiNeighbour of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local
TTP POST Request Handler. The manipulation leads to command injection. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300752 - https://vuldb.com/?ctiid.300752 - https://vuldb.com/?submit.520499 - https://github.com/Qwen11/CVE_store/blob/main/H3C/vulnerability%20Information_4.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-2733 State: PUBLISHED Published: 2025-03-25T04:31:04.535Z Last Updated: 2025-03-25T13:29:14.439Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: mannaandpoem Products: OpenManus Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addition
he public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300753 - https://vuldb.com/?ctiid.300753 - https://vuldb.com/?submit.520426 - https://magnificent-dill-351.notion.site/Command-Execution-in-Openmanus-2025-3-13-1b6c693918ed80b2826ef6bb385693fa
CVE ID: CVE-2025-2734 State: PUBLISHED Published: 2025-03-25T04:31:07.803Z Last Updated: 2025-03-25T13:28:04.462Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300756 - https://vuldb.com/?ctiid.300756 - https://vuldb.com/?submit.522265 - https://github.com/0xabandon/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2735 State: PUBLISHED Published: 2025-03-25T05:00:09.373Z Last Updated: 2025-03-25T13:16:24.358Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-services.php. The manipulation of the argument sertitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300757 - https://vuldb.com/?ctiid.300757 - https://vuldb.com/?submit.522266 - https://github.com/0xabandon/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-2736 State: PUBLISHED Published: 2025-03-25T05:00:12.295Z Last Updated: 2025-03-31T18:05:57.726Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/bwdates-report-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst
exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300758 - https://vuldb.com/?ctiid.300758 - https://vuldb.com/?submit.522881 - https://github.com/404heihei/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2737 State: PUBLISHED Published: 2025-03-25T05:31:04.840Z Last Updated: 2025-03-31T18:16:59.777Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300759 - https://vuldb.com/?ctiid.300759 - https://vuldb.com/?submit.522898 - https://github.com/X-X-007/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2738 State: PUBLISHED Published: 2025-03-25T06:00:07.373Z Last Updated: 2025-03-31T17:59:20.992Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/manage-scdetails.php. The manipulation of the argument namesc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300760 - https://vuldb.com/?ctiid.300760 - https://vuldb.com/?submit.522931 - https://github.com/X-X-007/cve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-2739 State: PUBLISHED Published: 2025-03-25T06:00:11.189Z Last Updated: 2025-03-31T17:57:32.118Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/manage-services.php. The manipulation of the argument sertitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300761 - https://vuldb.com/?ctiid.300761 - https://vuldb.com/?submit.523400 - https://github.com/silent1189/Phpgurukul-Old-Age-Home-Management-System-V1.0-SQL-injection/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2740 State: PUBLISHED Published: 2025-03-25T06:31:05.651Z Last Updated: 2025-03-25T13:16:18.193Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/eligibility.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300762 - https://vuldb.com/?ctiid.300762 - https://vuldb.com/?submit.524733 - https://github.com/guimo3/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2742 State: PUBLISHED Published: 2025-03-25T06:31:07.259Z Last Updated: 2025-03-25T13:15:33.938Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: zhijiantianya Products: ruoyi-vue-pro Problem Types: CWE-22 Description: A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not r
oit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300844 - https://vuldb.com/?ctiid.300844 - https://vuldb.com/?submit.519691 - https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#5arbitrary-file-deletion-vulnerability---uploadpermanentmaterial
CVE ID: CVE-2025-2743 State: PUBLISHED Published: 2025-03-25T07:00:10.362Z Last Updated: 2025-03-25T13:14:50.779Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: zhijiantianya Products: ruoyi-vue-pro Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contact
e attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300845 - https://vuldb.com/?ctiid.300845 - https://vuldb.com/?submit.519692 - https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#6arbitrary-file-deletion-vulnerability---uploadtemporarymaterial
CVE ID: CVE-2025-2744 State: PUBLISHED Published: 2025-03-25T07:00:11.929Z Last Updated: 2025-03-31T17:56:42.094Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: zhijiantianya Products: ruoyi-vue-pro Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure
ely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300846 - https://vuldb.com/?ctiid.300846 - https://vuldb.com/?submit.519694 - https://github.com/uglory-gll/javasec/blob/main/ruoyi-vue-pro.md#7arbitrary-file-deletion-vulnerability---uploadnewsimage