Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3519 State: PUBLISHED Published: 2025-04-22T08:51:41.681Z Last Updated: 2025-04-22T18:55:44.071Z Vendors: Unblu inc. Products: Unblu Spark Problem Types: CWE-639 Description: An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to replace the file without changing the file name and details or the name of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied
me of the user who uploaded the file. During the upload, file interception and allowed file type rules are still applied correctly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.unblu.com/en/docs/latest/security-bulletins/#UBL-2025-001
CVE ID: CVE-2025-3520 State: PUBLISHED Published: 2025-04-18T01:44:09.879Z Last Updated: 2025-04-18T12:01:38.763Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: wonderboymusic Products: Avatar Problem Types: CWE-22 Description: The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 0.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CI
ily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01769760-5bfe-4352-bc5b-141f078c0b6d?source=cve - https://plugins.trac.wordpress.org/browser/avatar/trunk/avatar.php#L417 - https://wordpress.org/plugins/avatar/
CVE ID: CVE-2025-3521 State: PUBLISHED Published: 2025-05-01T06:40:16.242Z Last Updated: 2025-05-01T16:11:52.605Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpspeedo Products: Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder Problem Types: CWE-80 Description: The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level a
ent input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93b83e65-09d6-4ad5-85f3-d18a9a35f39d?source=cve - https://wordpress.org/plugins/wps-team/
CVE ID: CVE-2025-3522 State: PUBLISHED Published: 2025-04-15T15:06:13.599Z Last Updated: 2025-04-15T19:05:13.896Z Vendors: Mozilla Products: Thunderbird Problem Types: Leak of hashed Window credentials via crafted attachment URL Description: Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and openi
resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1955372 - https://www.mozilla.org/security/advisories/mfsa2025-26/ - https://www.mozilla.org/security/advisories/mfsa2025-27/
CVE ID: CVE-2025-3523 State: PUBLISHED Published: 2025-04-15T15:06:14.164Z Last Updated: 2025-04-15T17:51:38.126Z Vendors: Mozilla Products: Thunderbird Problem Types: User Interface (UI) Misrepresentation of attachment URL Description: When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
underbird < 137.0.2 and Thunderbird < 128.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1958385 - https://www.mozilla.org/security/advisories/mfsa2025-26/ - https://www.mozilla.org/security/advisories/mfsa2025-27/
CVE ID: CVE-2025-3524 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:39.792Z Description: No description available.
CVE ID: CVE-2025-3526 State: PUBLISHED Published: 2025-06-16T14:18:34.913Z Last Updated: 2025-06-16T14:41:32.560Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-400 Description: SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE
Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3526
CVE ID: CVE-2025-3527 State: PUBLISHED Published: 2025-05-17T11:17:16.160Z Last Updated: 2025-05-19T14:57:27.177Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: EventON Products: EventON (Pro) - WordPress Virtual Event Calendar Plugin Problem Types: CWE-862 Description: The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
criber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/549ca9cf-0183-4c19-9bd5-b6d55a69df31?source=cve - https://codecanyon.net/item/eventon-wordpress-event-calendar-plugin/1211017#item-description__change-log
CVE ID: CVE-2025-3528 State: PUBLISHED Published: 2025-05-09T11:58:24.957Z Last Updated: 2025-11-20T07:27:03.189Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: MIRROR-REGISTRY-2.0-RHEL-8, mirror registry for Red Hat OpenShift Problem Types: CWE-276 Description: A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd`. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://acce
ivileges to the root user within that pod. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHBA-2025:9645 - https://access.redhat.com/security/cve/CVE-2025-3528 - https://bugzilla.redhat.com/show_bug.cgi?id=2359143
CVE ID: CVE-2025-3529 State: PUBLISHED Published: 2025-04-23T07:06:49.072Z Last Updated: 2025-04-23T18:22:39.548Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: mra13 Products: WordPress Simple Shopping Cart Problem Types: CWE-201 Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
without paying for it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8fecc015-518f-4aab-a17e-17cf4b8cf123?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/includes/wpsc-shortcodes-related.php#L92 - https://www.tipsandtricks-hq.com/ecommerce/wp-simple-cart-sell-digital-downloads-2468 - https://wordpress.org/plugins/wordpress-simple-paypal-shopping-cart/#developers - https://plugins.trac.wordpress.org/changeset/3275373/
CVE ID: CVE-2025-3530 State: PUBLISHED Published: 2025-04-23T07:06:49.749Z Last Updated: 2025-04-23T16:31:12.480Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: mra13 Products: WordPress Simple Shopping Cart Problem Types: CWE-472 Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unaut
computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a3910b-adc4-4633-a6a1-32ba50894be4?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L171 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L156 - https://plugins.trac.wordpress.org/browser/wordpress-sim
ple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L156 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L165 - https://plugins.trac.wordpress.org/browser/wordpress-simple-paypal-shopping-cart/tags/5.1.2/wp_shopping_cart.php#L261 - https://www.tipsandtricks-hq.com/wordpress-simple-paypal-shopping-cart-plugin-768 - https://plugins.trac.wordpress.org/changeset/3275373/
CVE ID: CVE-2025-3531 State: PUBLISHED Published: 2025-04-13T05:31:04.976Z Last Updated: 2025-04-14T16:17:44.456Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: YouDianCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes
y be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304569 - https://vuldb.com/?ctiid.304569 - https://vuldb.com/?submit.543080 - https://github.com/zonesec0/findcve/issues/4 - https://github.com/zonesec0/findcve/issues/5
CVE ID: CVE-2025-3532 State: PUBLISHED Published: 2025-04-13T06:00:10.234Z Last Updated: 2025-04-14T16:08:40.888Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: YouDianCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. The manipulation of the argument OrderNumber leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst N
d may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304570 - https://vuldb.com/?ctiid.304570 - https://vuldb.com/?submit.543082 - https://github.com/zonesec0/findcve/issues/6
CVE ID: CVE-2025-3533 State: PUBLISHED Published: 2025-04-13T10:00:12.790Z Last Updated: 2025-04-14T15:57:26.988Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: YouDianCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admin/Default/Channel/index.html.Attackers. The manipulation of the argument Parent leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addi
to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304571 - https://vuldb.com/?ctiid.304571 - https://vuldb.com/?submit.543083 - https://github.com/zonesec0/findcve/issues/7
CVE ID: CVE-2025-3534 State: PUBLISHED Published: 2025-04-13T10:31:04.734Z Last Updated: 2025-04-14T19:33:44.833Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PowerCreator Products: CMS Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PowerCreator CMS 1.0. Affected is an unknown function of the file /OpenPublicCourse.aspx. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichme
as contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304572 - https://vuldb.com/?ctiid.304572 - https://vuldb.com/?submit.543120 - https://github.com/yztale/powercreator/blob/main/README.md
CVE ID: CVE-2025-3535 State: PUBLISHED Published: 2025-04-13T11:00:13.406Z Last Updated: 2025-04-14T19:38:09.252Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: shuanx Products: BurpAPIFinder Problem Types: CWE-404 Description: A vulnerability has been found in shuanx BurpAPIFinder up to 2.0.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file BurpApiFinder.db. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304573 - https://vuldb.com/?ctiid.304573 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304573 - https://vuldb.com/?ctiid.304573 - https://vuldb.com/?submit.545457 - https://github.com/shuanx/BurpAPIFinder/issues/18 - https://github.com/shuanx/BurpAPIFinder/issues/18#issue-2956026808
CVE ID: CVE-2025-3536 State: PUBLISHED Published: 2025-04-13T11:31:06.083Z Last Updated: 2025-04-14T19:39:03.314Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Tutorials-Website Products: Employee Management System Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
unched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304574 - https://vuldb.com/?ctiid.304574 - https://vuldb.com/?submit.545810 - https://www.websecurityinsights.my.id/2025/03/tutorials-website-employee-management.html
CVE ID: CVE-2025-3537 State: PUBLISHED Published: 2025-04-13T12:00:14.100Z Last Updated: 2025-04-14T19:20:51.634Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Tutorials-Website Products: Employee Management System Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this dis
ck remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304575 - https://vuldb.com/?ctiid.304575 - https://vuldb.com/?submit.545859 - https://www.websecurityinsights.my.id/2025/03/tutorials-website-employee-management_28.html
CVE ID: CVE-2025-3538 State: PUBLISHED Published: 2025-04-13T18:31:05.124Z Last Updated: 2025-04-14T19:17:28.142Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DI-8100 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304577 - https://vuldb.com/?ctiid.304577 - https://vuldb.com/?submit.524224 - https://github.com/Fizz-L/CVE1/blob/main/DI-8100Command%20execution2.md - https://www.dlink.com/
CVE ID: CVE-2025-3539 State: PUBLISHED Published: 2025-04-13T22:00:13.331Z Last Updated: 2025-04-14T19:15:25.559Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010, Magic BE18000 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local net
HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304578 - https://vuldb.com/?ctiid.304578 - https://vuldb.com/?submit.521814 - https://github.com/isstabber/my_VulnHub/blob/main/h3cNX15/nx15_command_injection.md - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3540 State: PUBLISHED Published: 2025-04-13T22:31:07.248Z Last Updated: 2025-04-14T18:50:15.113Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit h
r. The manipulation leads to command injection. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304579 - https://vuldb.com/?ctiid.304579 - https://vuldb.com/?submit.524734 - https://gist.github.com/mono7s/882650a9a9b54bedc374caf8308efef2 - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
CVE ID: CVE-2025-3541 State: PUBLISHED Published: 2025-04-13T23:00:14.702Z Last Updated: 2025-04-14T18:30:38.306Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: H3C Products: Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this issue is the function FCGI_WizardProtoProcess of the file /api/wizard/getSpecs of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit ha
ndler. The manipulation leads to command injection. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304580 - https://vuldb.com/?ctiid.304580 - https://vuldb.com/?submit.524737 - https://gist.github.com/mono7s/fcbc1f02d69547704cc9027b29e51c73 - https://zhiliao.h3c.com/theme/details/229784 - https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/