Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9364785-1174-46d1-8671-001b755361a6?source=cve - https://plugins.trac.wordpress.org/browser/simple-bar/tags/2.2/subscriber-list-empty.php#L3
CVE ID: CVE-2025-9896 State: PUBLISHED Published: 2025-09-27T06:47:13.427Z Last Updated: 2025-09-29T19:05:06.668Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: funnnny Products: HidePost Problem Types: CWE-352 Description: The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA
y can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a618dbf-1180-4937-8466-5abc784a3365?source=cve - https://plugins.trac.wordpress.org/browser/hidepost/tags/2.3.8/options.php#L7
CVE ID: CVE-2025-9897 State: PUBLISHED Published: 2025-10-03T11:17:23.245Z Last Updated: 2025-10-03T18:26:09.749Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: hovanesvn Products: AP Background Problem Types: CWE-352 Description: The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function. This makes it possible for unauthenticated attackers to create or modify background sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a
liders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f12812-3c14-41c1-b14b-af84f835a773?source=cve - https://plugins.trac.wordpress.org/browser/ap-background/tags/3.8.2/includes/functions.admin.php#L135
CVE ID: CVE-2025-9898 State: PUBLISHED Published: 2025-09-27T06:47:15.058Z Last Updated: 2025-09-29T19:09:56.798Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: compojoom Products: cForms – Light speed fast Form Builder Problem Types: CWE-352 Description: The cForms – Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request granted they can trick a site administrator into performing an act
modify forms and their settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac23bca5-38dd-4460-83ce-5f7fc8a1f6a0?source=cve - https://plugins.trac.wordpress.org/browser/cforms-plugin/trunk/admin/api/form.php#L36
CVE ID: CVE-2025-9899 State: PUBLISHED Published: 2025-09-27T06:47:14.612Z Last Updated: 2025-09-29T19:09:22.649Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: trustreviews Products: Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms Problem Types: CWE-352 Description: The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a for
the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6d22101-06ef-4492-8ba9-8cf2ca1f4474?source=cve - https://plugins.trac.wordpress.org/browser/trust-reviews/trunk/includes/class-feed-serializer.php#L12
CVE ID: CVE-2025-9900 State: PUBLISHED Published: 2025-09-23T16:26:22.846Z Last Updated: 2025-11-24T21:02:44.287Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services
e Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 2, Red Hat Enterprise Linux 6 Problem Types: CWE-123 Description: A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted
Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:17651 - https://access.redhat.com/errata/RHSA-2025:17675 - https://access.redhat
ps://access.redhat.com/errata/RHSA-2025:17651 - https://access.redhat.com/errata/RHSA-2025:17675 - https://access.redhat.com/errata/RHSA-2025:17710 - https://access.redhat.com/errata/RHSA-2025:17738 - https://access.redhat.com/errata/RHSA-2025:17739 - https://access.redhat.com/errata/RHSA-2025:17740 - https://access.redhat.com/errata/RHSA-2025:19113 - https://access.redhat.com/errata/RHSA-2025:19156 - https://access.redhat.com/errata/RHSA-2025:19276 - https://access.redhat.com/errata/RHSA-2025:19906 - https://access.redhat.com/errata/RHSA-2025:19947 - https://access.redhat.com/errata/RHSA-2025:20956 - https://access.redhat.com/errata/RHSA-2025:20998 - https://access.redhat.com/errata/RHSA-20
com/errata/RHSA-2025:20956 - https://access.redhat.com/errata/RHSA-2025:20998 - https://access.redhat.com/errata/RHSA-2025:21060 - https://access.redhat.com/errata/RHSA-2025:21061 - https://access.redhat.com/errata/RHSA-2025:21062 - https://access.redhat.com/errata/RHSA-2025:21407 - https://access.redhat.com/errata/RHSA-2025:21506 - https://access.redhat.com/errata/RHSA-2025:21507 - https://access.redhat.com/errata/RHSA-2025:21508 - https://access.redhat.com/errata/RHSA-2025:21994 - https://access.redhat.com/security/cve/CVE-2025-9900 - https://bugzilla.redhat.com/show_bug.cgi?id=2392784 - https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file - https://git
cgi?id=2392784 - https://github.com/SexyShoelessGodofWar/LibTiff-4.7.0-Write-What-Where?tab=readme-ov-file - https://gitlab.com/libtiff/libtiff/-/issues/704 - https://gitlab.com/libtiff/libtiff/-/merge_requests/732 - https://libtiff.gitlab.io/libtiff/releases/v4.7.1.html
CVE ID: CVE-2025-9901 State: PUBLISHED Published: 2025-09-03T12:32:27.414Z Last Updated: 2025-11-20T21:00:37.169Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-524 Description: A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused ac
d on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-9901 - https://bugzilla.redhat.com/show_bug.cgi?id=2392790
CVE ID: CVE-2025-9902 State: PUBLISHED Published: 2025-10-13T13:06:53.001Z Last Updated: 2025-10-21T19:52:18.546Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AKIN Software Computer Import Export Industry and Trade Co. Ltd. Products: QRMenu Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse.This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0333
CVE ID: CVE-2025-9903 State: PUBLISHED Published: 2025-09-29T00:44:55.506Z Last Updated: 2025-09-29T11:56:21.301Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L) Vendors: Canon Inc. Products: Generic Plus PCL6 Printer Driver, Generic Plus UFR II Printer Driver, Generic Plus LIPS4 Printer Driver, Generic Plus LIPSLX Printer Driver, Generic Plus PS Printer Driver Problem Types: CWE-787 Description: Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver Additional Analyst Notes: - CISA ADP Vul
er Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-005/ - https://canon.jp/support/support-info/250925vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers - https://www.canon-europe.com/support/product-security/
CVE ID: CVE-2025-9904 State: PUBLISHED Published: 2025-09-29T00:46:03.660Z Last Updated: 2025-09-29T11:51:13.329Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Canon Inc. Products: Generic Plus PCL6 Printer Driver, Generic Plus UFR II Printer Driver, Generic Plus LIPS4 Printer Driver, Generic Plus LIPSLX Printer Driver, Generic Plus PS Printer Driver Problem Types: CWE-696 Description: Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver Additional Analyst Notes: - CISA ADP
rinter Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2025-005/ - https://canon.jp/support/support-info/250925vulnerability-response - https://www.usa.canon.com/about-us/to-our-customers/cp2025-005-vulnerabilities-remediation-for-certain-printer-drivers-for-production-printers-office-small-office-multifunction-printers-laser-printers - https://www.canon-europe.com/support/product-security/
CVE ID: CVE-2025-9905 State: PUBLISHED Published: 2025-09-19T08:16:44.772Z Last Updated: 2025-09-20T03:55:40.926Z Vendors: Keras-team Products: Keras Problem Types: CWE-913 Description: The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when read
the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives. Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keras-team/keras/pull/21602 - https://github.com/keras-team/keras/security/advisories/GHSA-36rr-ww3j-vrjv
CVE ID: CVE-2025-9906 State: PUBLISHED Published: 2025-09-19T08:15:04.349Z Last Updated: 2025-09-20T03:55:41.698Z Vendors: Keras-team Products: Keras Problem Types: CWE-502 Description: The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arb
ation() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keras-team/keras/pull/21429
CVE ID: CVE-2025-9910 State: PUBLISHED Published: 2025-09-11T05:00:02.071Z Last Updated: 2025-09-11T13:09:13.093Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P) Vendors: n/a Products: jsondiffpatch, org.webjars.npm:jsondiffpatch, org.webjars.bower:jsondiffpatch Problem Types: CWE-79 Description: Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website. Additional Analyst
source for the diff, and the result renderer using the built-in html formatter on a private website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-JSONDIFFPATCH-10369031 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-12549276 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-12549277 - https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14 - https://github.com/benjamine/jsondiffpatch/issues/383 - https://benjamine.github.io/jsondiffpatch/index.html
CVE ID: CVE-2025-9913 State: PUBLISHED Published: 2025-10-06T06:40:49.940Z Last Updated: 2025-10-06T12:23:05.532Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics Problem Types: CWE-79 Description: JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - http
sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-9914 State: PUBLISHED Published: 2025-10-06T06:45:59.874Z Last Updated: 2025-10-06T12:22:47.631Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SICK AG Products: Baggage Analytics, Tire Analytics, Package Analytics, Logistic Diagnostic Analytics Problem Types: CWE-288 Description: The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/specia
t Notes: - CISA ADP Vulnrichment: References: - https://sick.com/psirt - https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf - https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - https://www.first.org/cvss/calculator/3.1 - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json - https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf
CVE ID: CVE-2025-9918 State: PUBLISHED Published: 2025-09-11T07:37:50.010Z Last Updated: 2025-09-11T12:28:15.397Z Vendors: Google Cloud Products: Google SecOps SOAR Problem Types: CWE-22 Description: A Path Traversal vulnerability in the archive extraction component in Google SecOps SOAR Server (versions 6.3.54.0, 6.3.53.2, and all prior versions) allows an authenticated attacker with permissions to import Use Cases to achieve Remote Code Execution (RCE) via uploading a malicious ZIP archive containing path traversal sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.google.com/support/bulletins?gcp-2025-049 - https://cloud.google.com/chronicle/docs/sec
ent: References: - https://cloud.google.com/support/bulletins?gcp-2025-049 - https://cloud.google.com/chronicle/docs/security-bulletins#GCP-2025-049
CVE ID: CVE-2025-9919 State: PUBLISHED Published: 2025-09-03T16:02:09.119Z Last Updated: 2025-09-03T19:12:45.598Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: 1000projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
he exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322320 - https://vuldb.com/?ctiid.322320 - https://vuldb.com/?submit.642412 - https://github.com/ZooNJarway/CVE/issues/3
CVE ID: CVE-2025-9920 State: PUBLISHED Published: 2025-09-03T16:02:12.100Z Last Updated: 2025-09-03T18:32:34.314Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Recruitment Management System Problem Types: CWE-73 Description: A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipulation of the argument page results in file inclusion. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322321 - h
and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322321 - https://vuldb.com/?ctiid.322321 - https://vuldb.com/?submit.642407 - https://github.com/chenjunjie3/cve/issues/7 - https://www.campcodes.com/
CVE ID: CVE-2025-9921 State: PUBLISHED Published: 2025-09-03T17:02:06.950Z Last Updated: 2025-09-03T18:48:53.796Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: POS Pharmacy System Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in code-projects POS Pharmacy System 1.0. Affected is an unknown function of the file /main/products.php. This manipulation of the argument product_code/gen_name/product_name/supplier causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
en made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322322 - https://vuldb.com/?ctiid.322322 - https://vuldb.com/?submit.642420 - https://github.com/chen2496088236/CVE/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-9922 State: PUBLISHED Published: 2025-09-03T17:02:09.587Z Last Updated: 2025-09-03T18:49:42.823Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Sales and Inventory System Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in Campcodes Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Such manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322323 - https://vuldb.com/?ctiid.322323 - https://vuldb.com/?submit.642445 - https://github.com/zzb1388/cve/issues/63 - https://www.campcodes.com/
CVE ID: CVE-2025-9923 State: PUBLISHED Published: 2025-09-03T18:32:06.595Z Last Updated: 2025-09-03T19:51:50.539Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Sales and Inventory System Problem Types: CWE-79, CWE-94 Description: A flaw has been found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /index.php. Executing manipulation of the argument page can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322325 - https://vuldb.com/?ctiid.322325 - https: