Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-29006 State: PUBLISHED Published: 2025-06-06T12:54:26.887Z Last Updated: 2025-06-06T15:04:00.829Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: centangle Products: Direct Checkout for WooCommerce Lite Problem Types: CWE-862 Description: Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Direct Checkout for WooCommerce Lite: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-direct-checkout-lite/vulnerability/wordpress-direct-checkout
ces: - https://patchstack.com/database/wordpress/plugin/woo-direct-checkout-lite/vulnerability/wordpress-direct-checkout-for-woocommerce-lite-1-0-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-29007 State: PUBLISHED Published: 2025-07-04T08:42:18.029Z Last Updated: 2025-07-08T17:38:39.090Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: LMSACE Products: LMSACE Connect Problem Types: CWE-862 Description: Missing Authorization vulnerability in LMSACE LMSACE Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LMSACE Connect: from n/a through 3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lmsace-connect/vulnerability/wordpress-lmsace-connect-plugin-3-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-29008 State: PUBLISHED Published: 2025-06-06T12:54:26.435Z Last Updated: 2025-06-06T15:06:21.242Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ShawonPro Products: SocialMark Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark allows Server Side Request Forgery. This issue affects SocialMark: from n/a through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/socialmark/vulnerability/wordpress-socialmark-2-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-29009 State: PUBLISHED Published: 2025-07-16T11:28:10.176Z Last Updated: 2025-07-16T13:44:52.390Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Webkul Products: Medical Prescription Attachment Plugin for WooCommerce Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medical Prescription Attachment Plugin for WooCommerce allows Upload a Web Shell to a Web Server. This issue affects Medical Prescription Attachment Plugin for WooCommerce: from n/a through 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/medical-pre
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/medical-prescription-attachment-plugin-for-woocommerce/vulnerability/wordpress-medical-prescription-attachment-plugin-for-woocommerce-1-2-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-29010 State: PUBLISHED Published: 2025-06-06T12:54:25.981Z Last Updated: 2025-06-06T15:06:44.311Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: eleopard Products: Behance Portfolio Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in eleopard Behance Portfolio Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Behance Portfolio Manager: from n/a through 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-1-7-
om/database/wordpress/plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-1-7-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-29011 State: PUBLISHED Published: 2025-06-06T12:54:25.496Z Last Updated: 2025-06-06T15:07:05.825Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CHR Designer Products: YouTube Simple Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer YouTube Simple Gallery allows Stored XSS. This issue affects YouTube Simple Gallery: from n/a through 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/youtube-simple-gallery/vulnerability/wordpress-youtube-simple-gallery-2-2-0-cross-si
stack.com/database/wordpress/plugin/youtube-simple-gallery/vulnerability/wordpress-youtube-simple-gallery-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-29012 State: PUBLISHED Published: 2025-07-04T08:42:18.959Z Last Updated: 2025-07-08T14:06:21.045Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: kamleshyadav Products: CF7 7 Mailchimp Add-on Problem Types: CWE-862 Description: Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 7 Mailchimp Add-on: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-mailchimp-addon/vulnerability/wordpress-cf7-7-mailchimp-add-on-plugin-2-2-broken-access-co
database/wordpress/plugin/cf7-mailchimp-addon/vulnerability/wordpress-cf7-7-mailchimp-add-on-plugin-2-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-29013 State: PUBLISHED Published: 2025-06-06T12:54:25.042Z Last Updated: 2025-06-06T16:24:34.138Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: faaiq Products: Custom Category/Post Type Post order Problem Types: CWE-862 Description: Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Custom Category/Post Type Post order: from n/a through 1.5.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-post-order-category/vulnerability/wordpress-custom-catego
ces: - https://patchstack.com/database/wordpress/plugin/custom-post-order-category/vulnerability/wordpress-custom-category-post-type-post-order-1-5-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-29014 State: PUBLISHED Published: 2025-08-14T10:34:31.546Z Last Updated: 2025-08-14T19:44:04.844Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ZoomIt Products: FoodMenu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects FoodMenu: from n/a through 1.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dzs-restaurantmenu/vulnerability/wordpress-foodmenu-1-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-29015 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T14:08:59.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cvedetails.com/vulnerability-list/opxss-1/cross-site-scripting.html - https://github.com/b1tm4r/CVE-2025-29015
CVE ID: CVE-2025-29017 State: PUBLISHED Published: 2025-04-10T00:00:00.000Z Last Updated: 2025-04-10T14:28:39.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/b1tm4r/CVE-2025-29017
CVE ID: CVE-2025-29018 State: PUBLISHED Published: 2025-04-09T00:00:00.000Z Last Updated: 2025-04-10T15:55:51.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking System 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/b1tm4r/CVE-2025-29018
CVE ID: CVE-2025-29029 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-18T18:07:19.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WhereisDoujo/CVE/issues/2
CVE ID: CVE-2025-29030 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:40:56.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WhereisDoujo/CVE/issues/3
CVE ID: CVE-2025-29031 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:40:35.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WhereisDoujo/CVE/issues/5
CVE ID: CVE-2025-29032 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:39:43.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WhereisDoujo/CVE/issues/6
CVE ID: CVE-2025-29033 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-04T20:24:02.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nikolas-ch/CVEs/tree/main/Bamboohr_25.0210.170831-83b08dd/OpenRedirect
CVE ID: CVE-2025-29036 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-04T20:28:54.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sahat/hackathon-starter/issues/1326 - https://github.com/sahat/hackathon-starter/pull/1328 - https://github.com/HypeDuke/vulnerable-research/blob/main/CVE-2025-29036
CVE ID: CVE-2025-29039 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:13:01.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/xyqer1/Dlink-dir-823x-set_ntp-year-CommandInjection - https://gist.github.com/xyqer1/734fd1d93e4c08cea55dcb1e8b189a2b
CVE ID: CVE-2025-29040 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-05-01T18:06:40.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/xyqer1/Dlink-dir-823x-diag_ping-target_addr-CommandInjection - https://gist.github.com/xyqer1/b3bebe4967a3093951273738f0be45ce
CVE ID: CVE-2025-29041 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-05-01T18:08:19.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/xyqer1/Dlink-dir-823x-diag_nslookup-target_addr-CommandInjection - https://gist.github.com/xyqer1/101b7308bdf8618d8be30bd1d09ddd38
CVE ID: CVE-2025-29042 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T15:12:00.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/xyqer1/Dlink-dir-823x-set_prohibiting-macaddr-CommandInjection - https://gist.github.com/xyqer1/841e78a3c4029808dac8c439595a1358
CVE ID: CVE-2025-29043 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T15:13:23.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/xyqer1/Dlink-dir-823x-diag_traceroute-target_addr-CommandInjection - https://gist.github.com/xyqer1/d5a5b18743b7a2fcbc0f93001d8e2ad9
CVE ID: CVE-2025-29044 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T12:42:17.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key value Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/Netgear-R6100-cgiMain-QUERY_STRING-StackOverflow?tab=readme-ov-file - https://gist.github.com/xyqer1/09fe6488a6655776c8c5d33e630a0f2a
CVE ID: CVE-2025-29045 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T12:35:21.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key value Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/ALFA-WiFi-CampPro-APSecurity-newap_text_0 - https://gist.github.com/xyqer1/16f6b44ef062374bc32c12952c7b81f8
CVE ID: CVE-2025-29046 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T12:32:21.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPSMinute3 key value Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/ALFA-WiFi-CampPro-GreenAP-GAPSMinute3 - https://gist.github.com/xyqer1/7f9970240aec0af412caee79271a5be5
CVE ID: CVE-2025-29047 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T12:40:36.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hiddenIndex in the function StorageEditUser Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xyqer1/ALFA-WiFi-CampPro-StorageEditUser-hiddenIndex - https://gist.github.com/xyqer1/74adbc0249eeacf762fb4d33cf93a0f5
CVE ID: CVE-2025-29049 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-01T20:49:01.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/advisories/GHSA-qwj6-q94f-8425 - https://github.com/arnog/mathlive/commit/abc26056fd5e29a99edfa96a0bbe855ea2a8b678
CVE ID: CVE-2025-29058 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-21T02:53:02.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cdn.wjlin0.com/halo-img/74CMSv3.34.0%E5%AD%98%E5%9C%A8%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.zip
CVE ID: CVE-2025-29062 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T15:16:02.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead webservice. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/jichujiliangdanwei/vwbq9e/ux1426h170rhgfn7 - https://www.yuque.com/jichujiliangdanwei/vwbq9e/grfgkm2kvk6btwbp
CVE ID: CVE-2025-29063 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T15:14:55.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yuque.com/jichujiliangdanwei/vwbq9e/ux1426h170rhgfn7 - https://www.yuque.com/jichujiliangdanwei/vwbq9e/grfgkm2kvk6btwbp
CVE ID: CVE-2025-29064 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-07T18:36:12.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kn0sky/cve/blob/main/TOTOLINK%20X18/OS%20Command%20Injection%20setLanguageCfg_lang.md
CVE ID: CVE-2025-29069 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-04T20:30:37.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow vulnerability has been identified in the lcms2-2.16. The vulnerability exists in the UnrollChunkyBytes function in cmspack.c, which is responsible for handling color space transformations. NOTE: this is disputed by the Supplier because the finding identified a bug in a third-party calling program, not in lcms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mm2/Little-CMS/issues/476 - https://github.com/mm2/Little-CMS/issues/476#issuecomment-2696670843 - https://
//github.com/mm2/Little-CMS/issues/476 - https://github.com/mm2/Little-CMS/issues/476#issuecomment-2696670843 - https://github.com/mm2/Little-CMS/issues/476#issuecomment-2770644813
CVE ID: CVE-2025-29070 State: PUBLISHED Published: 2025-04-01T00:00:00.000Z Last Updated: 2025-04-04T20:25:30.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mm2/Little-CMS/issues/475 - https://github.com/mm2/Little-CMS/issues/475#issuecom
ment: References: - https://github.com/mm2/Little-CMS/issues/475 - https://github.com/mm2/Little-CMS/issues/475#issuecomment-2696785063
CVE ID: CVE-2025-29072 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-03-28T15:16:08.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerab
SA ADP Vulnrichment: References: - https://community.starknet.io/t/starknet-security-update-potential-full-node-vulnerability-recap/115314 - https://github.com/NethermindEth/juno/commit/51074875941aa111c5dd2b41f2ec890a4a15b587
CVE ID: CVE-2025-29083 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:34:25.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Plugin_Manager.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fax77829yz/CSZ_CMS-exploit/blob/main/README.md#cve2
CVE ID: CVE-2025-29084 State: PUBLISHED Published: 2025-09-23T00:00:00.000Z Last Updated: 2025-09-24T18:35:12.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrade.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fax77829yz/CSZ_CMS-exploit/blob/main/README.md#cve1
CVE ID: CVE-2025-29085 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T15:11:42.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Cafe-Tea/bcef0d7a2bdb5ec8e0d69de852fdc900
CVE ID: CVE-2025-29087 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-15T15:14:39.726Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: SQLite Products: SQLite Problem Types: CWE-190 Description: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sql
malloc may not allocate enough memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sqlite.org/cves.html - https://gist.github.com/ylwango613/a44a29f1ef074fa783e29f04a0afd62a - https://sqlite.org/releaselog/3_49_1.html