Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7948 State: PUBLISHED Published: 2025-07-22T01:04:32.354Z Last Updated: 2025-07-22T13:27:29.137Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: jshERP Problem Types: CWE-640 Description: A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317089 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317089 - https://vuldb.com/?ctiid.317089 - https://vuldb.com/?submit.619277 - https://github.com/jishenghua/jshERP/issues/123
CVE ID: CVE-2025-7949 State: PUBLISHED Published: 2025-07-22T01:32:06.463Z Last Updated: 2025-07-22T13:25:42.099Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: Sanluan Products: PublicCMS Problem Types: CWE-601 Description: A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named c1e79f124e3
k can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named c1e79f124e3f4c458315d908ed7dee06f9f12a76/f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317095 - https://vuldb.com/?ctiid.317095 - https://vuldb.com/?submit.619278 - https://github.com/sanluan/PublicCMS/issues/87 - https://github.com/sanluan/PublicCMS/commit/c1e79f124e3f4c458315d908ed7dee06f9f12a76
CVE ID: CVE-2025-7950 State: PUBLISHED Published: 2025-07-22T02:02:05.465Z Last Updated: 2025-07-22T18:57:07.431Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Public Chat Room Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Public Chat Room 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317096 - https://vuldb.com/?ctiid.317096 - https://vuldb.com/?submit.619313 - https://github.com/BalanceLee/CVE/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-7951 State: PUBLISHED Published: 2025-07-22T02:32:05.268Z Last Updated: 2025-07-22T18:41:49.972Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Public Chat Room Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in code-projects Public Chat Room 1.0. This affects an unknown part of the file /send_message.php. The manipulation of the argument chat_msg/your_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317097 - https://vuldb.com/?ctiid.317097 - https://vuldb.com/?submit.619358 - https://github.com/BalanceLee/CVE/issues/6 - https://code-projects.org/
CVE ID: CVE-2025-7952 State: PUBLISHED Published: 2025-07-22T03:02:06.302Z Last Updated: 2025-07-22T18:20:24.625Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317098 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317098 - https://vuldb.com/?ctiid.317098 - https://vuldb.com/?submit.619319 - https://github.com/ElvisBlue/Public/blob/main/Vuln/7.md - https://github.com/ElvisBlue/Public/blob/main/Vuln/7.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7953 State: PUBLISHED Published: 2025-07-22T03:32:05.747Z Last Updated: 2025-07-22T18:16:36.659Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: Sanluan Products: PublicCMS Problem Types: CWE-601 Description: A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named f1af17af004ca9345c6fe4d
iated remotely. The exploit has been disclosed to the public and may be used. The patch is named f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317099 - https://vuldb.com/?ctiid.317099 - https://vuldb.com/?submit.619279 - https://github.com/sanluan/PublicCMS/issues/88 - https://github.com/sanluan/PublicCMS/commit/f1af17af004ca9345c6fe4d5936d87d008d26e75
CVE ID: CVE-2025-7954 State: PUBLISHED Published: 2025-08-06T07:16:09.712Z Last Updated: 2025-11-03T20:07:42.751Z Vendors: Shopware Products: Shopware Problem Types: CWE-362 Description: A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/shopware/shopware/issues/11245
CVE ID: CVE-2025-7955 State: PUBLISHED Published: 2025-08-28T05:24:51.344Z Last Updated: 2025-08-28T14:48:48.566Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pbmacintyre Products: RingCentral Communications Plugin – FREE Problem Types: CWE-287 Description: The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
by supplying identical bogus codes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0386ed09-296d-4f33-9fe0-964c0c0a9652?source=cve - https://wordpress.org/plugins/rccp-free/#developers - https://plugins.trac.wordpress.org/browser/rccp-free/tags/1.6.8/ringcentral.php - https://plugins.trac.wordpress.org/changeset/3349361/
CVE ID: CVE-2025-7956 State: PUBLISHED Published: 2025-08-28T05:24:52.304Z Last Updated: 2025-08-28T14:48:35.475Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpdreams Products: Ajax Search Lite – Live Search & Filter Problem Types: CWE-862 Description: The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ent of any protected post in rolling 100‑character windows. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/daa9c3dd-e8cf-4696-bc0c-4088509f89db?source=cve - https://wordpress.org/plugins/ajax-search-lite/#developers - https://plugins.trac.wordpress.org/browser/ajax-search-lite/tags/4.13.1/includes/classes/ajax/class-asl-search.php#L37 - https://plugins.trac.wordpress.org/changeset/3349881/
CVE ID: CVE-2025-7957 State: PUBLISHED Published: 2025-08-23T04:25:49.271Z Last Updated: 2025-08-25T14:40:26.967Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: surror Products: ShortcodeHub – MultiPurpose Shortcode Builder Problem Types: CWE-79 Description: The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_link_target’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3db71e8-1a0c-47d8-babd-a84a25a8b467?source=cve - https://plugins.trac.wordpress.org/browser/shortcodehub/trunk/inc/classes/useful-shortcodes/class-sh-useful-shortcodes-theme.php#L133 - https://wordpress.org/plugins/shortcodehub/#developers
CVE ID: CVE-2025-7959 State: PUBLISHED Published: 2025-07-24T09:22:22.729Z Last Updated: 2025-07-24T13:03:19.510Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: marviorocha Products: Station Pro – Advanced Audio Streaming & Player for WordPress Problem Types: CWE-79 Description: The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4026b41-29c3-4e0a-bf75-ae4ba47edb4f?source=cve - https://plugins.trac.wordpress.org/browser/station-pro/tags/2.4.2/core/inc/player/class-station-player.php#L71 - https://wordpress.org/plugins/station-pro/#developers
CVE ID: CVE-2025-7961 State: PUBLISHED Published: 2025-08-15T16:43:00.279Z Last Updated: 2025-08-15T17:14:10.611Z Vendors: Wulkano Products: KAP Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/cafrune - https://github.com/wulkano/Kap - http://wulkano.com/ - https://getkap.co/
CVE ID: CVE-2025-7962 State: PUBLISHED Published: 2025-07-21T17:22:12.520Z Last Updated: 2025-11-04T21:14:59.595Z Vendors: Eclipse Foundation Products: Jakarta Mail Problem Types: CWE-147 Description: In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/67
CVE ID: CVE-2025-7965 State: PUBLISHED Published: 2025-08-11T06:00:02.778Z Last Updated: 2025-08-11T14:55:28.005Z Vendors: Unknown Products: CBX Restaurant Booking Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/13e0db0b-87c5-4cf0-b0a6-178bdf96991b/
CVE ID: CVE-2025-7966 State: PUBLISHED Published: 2025-07-24T09:22:16.991Z Last Updated: 2025-07-24T13:36:12.507Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zohaib167 Products: Get Youtube Subs Problem Types: CWE-79 Description: The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘channel', 'layout', and 'subs_count’ parameters in all versions up to, and including, 3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a25728c-3d98-414b-bad0-2c05eb1f4ca2?source=cve - https://plugins.trac.wordpress.org/browser/get-youtube-subs/trunk/includes/youtubesubs-class.php#L142 - https://wordpress.org/plugins/get-youtube-subs/#developers
CVE ID: CVE-2025-7969 State: PUBLISHED Published: 2025-08-21T16:40:05.915Z Last Updated: 2025-09-01T17:19:53.496Z Vendors: markdown-it Products: markdown-it Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs. This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not consider this issue to be a vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/fito - https://github.com/markdown-it/markdow
- CVE Program Container: References: - https://fluidattacks.com/advisories/fito - https://github.com/markdown-it/markdown-it
CVE ID: CVE-2025-7970 State: PUBLISHED Published: 2025-09-09T12:46:36.372Z Last Updated: 2025-09-09T13:35:17.769Z Vendors: Rockwell Automation Products: FactoryTalk Activation Manager Problem Types: CWE-306 Description: A security issue exists within FactoryTalk Activation Manager. An error in the implementation of cryptography within the software could allow attackers to decrypt traffic. This could result in data exposure, session hijacking, or full communication compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1741.html
CVE ID: CVE-2025-7971 State: PUBLISHED Published: 2025-08-14T15:02:05.287Z Last Updated: 2025-08-14T19:50:28.826Z Vendors: Rockwell Automation Products: Studio 5000 Logix Designer® Problem Types: CWE-20 Description: A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1734.html
CVE ID: CVE-2025-7972 State: PUBLISHED Published: 2025-08-14T14:47:46.316Z Last Updated: 2025-08-14T15:08:22.952Z Vendors: Rockwell Automation Products: FactoryTalk® Linx Problem Types: CWE-286 Description: A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1735.html
CVE ID: CVE-2025-7973 State: PUBLISHED Published: 2025-08-14T13:52:53.432Z Last Updated: 2025-08-14T15:05:00.242Z Vendors: Rockwell Automation Products: FactoryTalk® ViewPoint Problem Types: CWE-268 Description: A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack the cscript.exe console window, which runs with SYSTEM privileges. This can be exploited to spawn an elevated command prompt, enabling full privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1738.html
CVE ID: CVE-2025-7974 State: PUBLISHED Published: 2025-09-02T19:46:21.117Z Last Updated: 2025-09-03T20:06:25.162Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: rocket.chat Products: rocket.chat Problem Types: CWE-863 Description: rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An attacker can leverage this vulnerabilit
on TCP port 3000 by default. The issue results from incorrect authorization. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-26517. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-627/
CVE ID: CVE-2025-7975 State: PUBLISHED Published: 2025-09-02T19:47:42.815Z Last Updated: 2025-09-02T20:34:51.366Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Anritsu Products: ShockLine Problem Types: CWE-22 Description: Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper va
a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-26913. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-647/
CVE ID: CVE-2025-7976 State: PUBLISHED Published: 2025-09-02T19:47:57.927Z Last Updated: 2025-09-02T20:34:38.091Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Anritsu Products: ShockLine Problem Types: CWE-502 Description: Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the la
s page or open a malicious file. The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26882. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-648/
CVE ID: CVE-2025-7977 State: PUBLISHED Published: 2025-09-17T20:51:19.510Z Last Updated: 2025-09-18T14:48:52.564Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Cobalt Problem Types: CWE-125 Description: Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of LI files. The issue results from the lack of pr
or open a malicious file. The specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25354. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-629/
CVE ID: CVE-2025-7978 State: PUBLISHED Published: 2025-09-17T20:51:32.524Z Last Updated: 2025-09-18T14:40:12.615Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Graphite Problem Types: CWE-457 Description: Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from th
cious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25459. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-632/
CVE ID: CVE-2025-7979 State: PUBLISHED Published: 2025-09-17T20:51:36.494Z Last Updated: 2025-09-18T14:33:02.708Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashlar-Vellum Products: Graphite Problem Types: CWE-121 Description: Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results fr
malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25463. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-633/