Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ld/ImageCarouselChild.php#L507 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/ScrollImage/ScrollImage.php#L388 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/LogoGridChild/LogoGridChild.php#L193 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/LogoCarouselChild/LogoCarouselChild.php#L177 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/InfoBox/InfoBox.php#L852 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/InfoCard/InfoCard.php#L688 - https://plugins.trac.wordpress.org/browser/ad
addons-for-divi/trunk/includes/modules/divi-4/InfoCard/InfoCard.php#L688 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/InlineNotice/InlineNotice.php#L486 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/Review/Review.php#L703 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/FlipBox/FlipBox.php#L1053 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/Testimonial/Testimonial.php#L1147 - https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/GradientHeading/GradientHeading.php#L344 - https://wor
rdpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/GradientHeading/GradientHeading.php#L344 - https://wordpress.org/plugins/addons-for-divi/#developers - https://plugins.trac.wordpress.org/changeset/3230743/
CVE ID: CVE-2025-0354 State: PUBLISHED Published: 2025-01-15T07:21:41.810Z Last Updated: 2025-04-03T15:38:02.872Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: NEC Corporation Products: WG2600HS, WG2600HP4, WG2600HM4, WG2600HS2, WX3000HP, WX4200D5 Problem Types: CWE-79 Description: Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
ws a attacker to inject an arbitrary script via the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv25-003_en.html
CVE ID: CVE-2025-0355 State: PUBLISHED Published: 2025-01-15T07:23:39.481Z Last Updated: 2025-01-21T03:34:13.440Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NEC Corporation Products: WG2600HS, WF1200CR, WG1200CR, GB1200PE, WG2600HP4, WG2600HM4, WG2600HS2, WX3000HP, WX4200D5 Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX42
2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv25-003_en.html
CVE ID: CVE-2025-0356 State: PUBLISHED Published: 2025-01-15T07:24:25.831Z Last Updated: 2025-04-03T15:36:59.555Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: NEC Corporation Products: WX1500HP, WX3600HP Problem Types: CWE-78 Description: NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv25-003_en.html
CVE ID: CVE-2025-0357 State: PUBLISHED Published: 2025-01-25T01:44:36.912Z Last Updated: 2025-01-27T15:34:55.093Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Iqonic Design Products: WPBookit Problem Types: CWE-434 Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19bf7a68-e76d-4740-9f35-b6084094f59b?source=cve - https://documentation.iqonic.design/wpbookit/versions/change-log
CVE ID: CVE-2025-0358 State: PUBLISHED Published: 2025-06-02T07:39:50.165Z Last Updated: 2025-06-02T12:59:42.360Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-269 Description: During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/35/90/85/cve-2025-0358pdf-en-US-483809.pdf
CVE ID: CVE-2025-0359 State: PUBLISHED Published: 2025-03-04T05:21:34.944Z Last Updated: 2025-03-28T07:03:53.756Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-863 Description: During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/68/08/c5/cve-2025-0359pdf-en-US-466885.pdf
CVE ID: CVE-2025-0360 State: PUBLISHED Published: 2025-03-04T05:24:00.720Z Last Updated: 2025-03-26T12:09:06.856Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-863 Description: During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/b1/fe/46/cve-2025-0360pdf-en-US-466887.pdf
CVE ID: CVE-2025-0361 State: PUBLISHED Published: 2025-04-08T05:38:02.631Z Last Updated: 2025-04-08T14:50:47.286Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-203 Description: During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/f4/9b/13/cve-2025-0361pdf-en-US-474511.pdf
CVE ID: CVE-2025-0362 State: PUBLISHED Published: 2025-04-10T14:31:17.009Z Last Updated: 2025-04-10T14:56:33.843Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1021 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/512425 - https://hackerone.com/reports/2926425
CVE ID: CVE-2025-0364 State: PUBLISHED Published: 2025-02-04T17:51:18.472Z Last Updated: 2025-11-19T20:30:32.900Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BigAntSoft Products: BigAnt Server Problem Types: CWE-288 Description: BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration mechanism. Once an administrator, the attacker can upload and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution. Addition
load and execute arbitrary PHP code using the "Cloud Storage Addin," leading to unauthenticated code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/advisories/big-ant-upload-rce
CVE ID: CVE-2025-0365 State: PUBLISHED Published: 2025-02-01T05:30:37.677Z Last Updated: 2025-02-03T16:37:53.139Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-22 Description: The Jupiter X Core plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.8.7 via the inline SVG feature. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-
ensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3bc5ef7-6825-463f-a3ce-d6ab1fc0e030?source=cve - https://plugins.trac.wordpress.org/changeset/3231122/jupiterx-core/trunk/includes/extensions/raven/includes/modules/inline-svg/widgets/inline-svg.php
CVE ID: CVE-2025-0366 State: PUBLISHED Published: 2025-02-01T05:30:37.253Z Last Updated: 2025-02-03T16:37:59.793Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-98 Description: The Jupiter X Core plugin for WordPress is vulnerable to Local File Inclusion to Remote Code Execution in all versions up to, and including, 4.8.7 via the get_svg() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive
er, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. In this specific case, an attacker can create a form that allows SVG uploads, upload an SVG file with malicious content and then include the SVG file in a post to achieve remote code execution. This means it is relatively easy to gain remote code execution as a contributor-level user and above by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a20dc1d-eb7c-47ac-ad9a-ec4c0d5db62e?source=cve - https://plugins.trac.wordpress.org/changeset/3231122/jupiterx-core/
id/1a20dc1d-eb7c-47ac-ad9a-ec4c0d5db62e?source=cve - https://plugins.trac.wordpress.org/changeset/3231122/jupiterx-core/trunk/includes/extensions/raven/includes/modules/video/widgets/video.php - https://plugins.trac.wordpress.org/changeset/3231122/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/ajax-handler.php
CVE ID: CVE-2025-0367 State: PUBLISHED Published: 2025-01-30T17:04:49.734Z Last Updated: 2025-02-12T19:51:11.515Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Splunk Products: Splunk Supporting Add-on for Active Directory Problem Types: CWE-1333 Description: In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://advisory.splunk.com/advisories/SVD-2025-0103
CVE ID: CVE-2025-0368 State: PUBLISHED Published: 2025-02-04T06:00:11.421Z Last Updated: 2025-02-04T18:24:52.262Z Vendors: Unknown Products: Banner Garden Plugin for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6a4f7097-082b-4375-9582-945928d765b8/
CVE ID: CVE-2025-0369 State: PUBLISHED Published: 2025-01-18T07:05:10.395Z Last Updated: 2025-01-21T21:20:53.014Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Crocoblock Products: JetEngine Problem Types: CWE-79 Description: The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CI
bitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f27979a8-0e68-4a45-9e3e-3667d88361d8?source=cve - https://crocoblock.com/plugins/jetengine/ - https://crocoblock.com/changelog/
CVE ID: CVE-2025-0370 State: PUBLISHED Published: 2025-03-04T09:22:37.463Z Last Updated: 2025-03-04T14:21:01.026Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75 - https://wordpress.org/plugins/shortcodes-ultimate/#developers - https://plugins.trac.wordpress.org/changeset/3229060/
CVE ID: CVE-2025-0371 State: PUBLISHED Published: 2025-01-21T08:21:51.697Z Last Updated: 2025-01-21T16:36:51.132Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Crocoblock Products: JetElements Problem Types: CWE-79 Description: The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addit
s and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ded2f366-375c-4cf6-9cbd-c969a3b3d6d5?source=cve - https://crocoblock.com/changelog/
CVE ID: CVE-2025-0372 State: PUBLISHED Published: 2025-05-21T17:12:08.134Z Last Updated: 2025-05-21T19:26:16.332Z Vendors: HYPR Products: Passwordless Problem Types: CWE-362 Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue affects HYPR Passwordless: before 10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hypr.com/trust-center/security-advisories
CVE ID: CVE-2025-0373 State: PUBLISHED Published: 2025-01-30T04:48:03.054Z Last Updated: 2025-02-07T17:02:45.863Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-121 Description: On 64-bit systems, the implementation of VOP_VPTOFH() in the cd9660, tarfs and ext2fs filesystems overflows the destination FID buffer by 4 bytes, a stack buffer overflow. A NFS server that exports a cd9660, tarfs, or ext2fs file system can be made to panic by mounting and accessing the export with an NFS client. Further exploitation (e.g., bypassing file permission checking or remote kernel code execution) is potentially possible, though this has not been demonstrated. In particular, release kernels are compi
code execution) is potentially possible, though this has not been demonstrated. In particular, release kernels are compiled with stack protection enabled, and some instances of the overflow are caught by this mechanism, causing a panic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-25:02.fs.asc
CVE ID: CVE-2025-0374 State: PUBLISHED Published: 2025-01-30T04:49:07.687Z Last Updated: 2025-02-07T17:02:52.274Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-732 Description: When etcupdate encounters conflicts while merging files, it saves a version containing conflict markers in /var/db/etcupdate/conflicts. This version does not preserve the mode of the input file, and is world-readable. This applies to files that would normally have restricted visibility, such as /etc/master.passwd. An unprivileged local user may be able to read encrypted root and user passwords from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts wit
s from the temporary master.passwd file created in /var/db/etcupdate/conflicts. This is possible only when conflicts within the password file arise during an update, and the unprotected file is deleted when conflicts are resolved. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-25:03.etcupdate.asc
CVE ID: CVE-2025-0376 State: PUBLISHED Published: 2025-02-12T15:02:22.215Z Last Updated: 2025-02-13T14:14:09.377Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/512603 - https://hackerone.com/reports/2930243
CVE ID: CVE-2025-0377 State: PUBLISHED Published: 2025-01-21T15:23:53.104Z Last Updated: 2025-02-12T20:41:20.897Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: HashiCorp Products: Shared library Problem Types: CWE-59 Description: HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack
CVE ID: CVE-2025-0390 State: PUBLISHED Published: 2025-01-11T07:31:09.281Z Last Updated: 2025-01-13T15:29:52.358Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Guangzhou Huayi Intelligent Technology Products: Jeewms Problem Types: CWE-24, CWE-23 Description: A vulnerability classified as critical was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This vulnerability affects unknown code of the file /wmOmNoticeHController.do. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this is
. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291124 - https://vuldb.com/?ctiid.291124 - https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM
CVE ID: CVE-2025-0391 State: PUBLISHED Published: 2025-01-11T09:00:13.701Z Last Updated: 2025-01-13T15:28:13.215Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Guangzhou Huayi Intelligent Technology Products: Jeewms Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. This issue affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController. java. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version
he attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291125 - https://vuldb.com/?ctiid.291125 - https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKA8
CVE ID: CVE-2025-0392 State: PUBLISHED Published: 2025-01-11T11:00:20.311Z Last Updated: 2025-01-13T15:26:09.650Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Guangzhou Huayi Intelligent Technology Products: Jeewms Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Guangzhou Huayi Intelligent Technology Jeewms up to 20241229. Affected is the function datagridGraph of the file /graphReportController.do. The manipulation of the argument store_code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to addre
k remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 20250101 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.291126 - https://vuldb.com/?ctiid.291126 - https://gitee.com/erzhongxmu/JEEWMS/issues/IBFK93