Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3795 State: PUBLISHED Published: 2025-04-18T20:00:10.780Z Last Updated: 2025-04-18T20:34:00.287Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: DaiCuo Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimization Settings Section. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305648 - https://vuldb.com/?ctiid.305648 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305648 - https://vuldb.com/?ctiid.305648 - https://vuldb.com/?submit.554639 - https://github.com/daicuo/cms/issues/1
CVE ID: CVE-2025-3796 State: PUBLISHED Published: 2025-04-18T21:00:11.403Z Last Updated: 2025-04-21T14:26:44.936Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Men Salon Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/contact-us.php. The manipulation of the argument pagetitle/pagedes/email/mobnumber/timing leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305649 - https://vuldb.com/?ctiid.305649 - https://vuldb.com/?submit.554659 - https://github.com/yaklang/IRifyScanResult/blob/main/Men-Salon-Management-System/sql_inject_in_contact_us.md - https://phpgurukul.com/
CVE ID: CVE-2025-3797 State: PUBLISHED Published: 2025-04-19T07:00:12.724Z Last Updated: 2025-04-21T02:36:52.642Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: SeaCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305650 - https://vuldb.com/?ctiid.305650 - https://vuldb.
: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305650 - https://vuldb.com/?ctiid.305650 - https://vuldb.com/?submit.554660 - https://github.com/FSRM1/CVE/blob/main/seacms_sql2.md
CVE ID: CVE-2025-3798 State: PUBLISHED Published: 2025-04-19T10:00:07.289Z Last Updated: 2025-04-21T14:09:39.127Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: WCMS Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php of the component Advertisement Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305651 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305651 - https://vuldb.com/?ctiid.305651 - https://vuldb.com/?submit.554696 - https://github.com/IceFoxH/VULN/issues/16
CVE ID: CVE-2025-3799 State: PUBLISHED Published: 2025-04-19T10:31:04.389Z Last Updated: 2025-04-21T14:06:30.812Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: WCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in WCMS 11. Affected is an unknown function of the file app/controllers/AnonymousController.php. The manipulation of the argument email/username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305652 - https://vuldb.com/?ctiid.305652 - https://vuldb.com/?submit.554697 - https://github.com/IceFoxH/VULN/issues/15
CVE ID: CVE-2025-3800 State: PUBLISHED Published: 2025-04-19T11:31:04.458Z Last Updated: 2025-04-21T14:00:24.613Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: n/a Products: WCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in WCMS 11 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/controllers/AnonymousController.php. The manipulation of the argument mobile_phone leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
e used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305653 - https://vuldb.com/?ctiid.305653 - https://vuldb.com/?submit.554698 - https://github.com/IceFoxH/VULN/issues/14
CVE ID: CVE-2025-3801 State: PUBLISHED Published: 2025-04-19T14:00:11.397Z Last Updated: 2025-04-21T13:53:30.617Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: songquanpeng Products: one-api Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305655 - https://vuldb.com/?ctiid.305655 - https://vuldb.com/?submit.554702 - https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md
CVE ID: CVE-2025-3802 State: PUBLISHED Published: 2025-04-19T14:31:05.921Z Last Updated: 2025-04-21T14:58:30.910Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W12, i24 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been declared as critical. This vulnerability affects the function cgiPingSet of the file /bin/httpd. The manipulation of the argument pingIP leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305656
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305656 - https://vuldb.com/?ctiid.305656 - https://vuldb.com/?submit.554746 - https://github.com/02Tn/vul/issues/2 - https://www.tenda.com.cn/
CVE ID: CVE-2025-3803 State: PUBLISHED Published: 2025-04-19T15:00:15.751Z Last Updated: 2025-04-21T02:34:15.662Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W12, i24 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). It has been rated as critical. This issue affects the function cgiSysScheduleRebootSet of the file /bin/httpd. The manipulation of the argument rebootDate leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305657 - https://vuldb.com/?ctiid.305657 - https://vuldb.com/?submit.554756 - https://github.com/02Tn/vul/issues/3 - https://www.tenda.com.cn/
CVE ID: CVE-2025-3804 State: PUBLISHED Published: 2025-04-19T15:31:04.195Z Last Updated: 2025-04-21T11:28:31.903Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: thautwarm Products: vscode-diana Problem Types: CWE-74, CWE-707 Description: A vulnerability classified as critical has been found in thautwarm vscode-diana 0.0.1. Affected is an unknown function of the file Gen.py of the component Jinja2 Template Handler. The manipulation leads to injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305658 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305658 - https://vuldb.com/?ctiid.305658 - https://vuldb.com/?submit.554779 - https://github.com/thautwarm/vscode-diana/issues/1 - https://github.com/thautwarm/vscode-diana/issues/1#issue-2982880456
CVE ID: CVE-2025-3805 State: PUBLISHED Published: 2025-04-19T16:00:10.163Z Last Updated: 2025-04-21T11:28:39.888Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: sarrionandia Products: tournatrack Problem Types: CWE-74, CWE-707 Description: A vulnerability classified as critical was found in sarrionandia tournatrack up to 4c13a23f43da5317eea4614870a7a8510fc540ec. Affected by this vulnerability is an unknown functionality of the file check_id.py of the component Jinja2 Template Handler. The manipulation of the argument ID leads to injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Th
It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305659 - https://vuldb.com/?ctiid.305659 - https://vuldb.com/?submit.554781 - https://github.com/sarrionandia/tournatrack/issues/86 - https://github.com/sarrionandia/tournatrack/issues/86#issue-2982930491
CVE ID: CVE-2025-3806 State: PUBLISHED Published: 2025-04-19T16:31:04.599Z Last Updated: 2025-04-21T02:28:56.781Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: dazhouda Products: lecms Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in dazhouda lecms up to 3.0.3. Affected by this issue is some unknown functionality of the file /admin of the component Edit Profile Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305660 - htt
lic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305660 - https://vuldb.com/?ctiid.305660 - https://vuldb.com/?submit.554977 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms.md
CVE ID: CVE-2025-3807 State: PUBLISHED Published: 2025-04-19T17:00:12.037Z Last Updated: 2025-04-21T02:27:25.454Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zhenfeng13 Products: My-BBS Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/controller/common/UploadController.java of the component Endpoint. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305661 - https://vuldb.com/?ctiid.305661 - https://vuldb.com/?submit.555258 - https://github.com/caigo8/CVE-md/blob/main/My-bbs/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
CVE ID: CVE-2025-3808 State: PUBLISHED Published: 2025-04-19T17:31:04.680Z Last Updated: 2025-04-21T02:25:49.897Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: zhenfeng13 Products: My-BBS Problem Types: CWE-352, CWE-862 Description: A vulnerability has been found in zhenfeng13 My-BBS 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305662 - https://vuldb.com/?ctiid.305662 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305662 - https://vuldb.com/?ctiid.305662 - https://vuldb.com/?submit.555259 - https://github.com/caigo8/CVE-md/blob/main/My-bbs/CSRF.md
CVE ID: CVE-2025-3809 State: PUBLISHED Published: 2025-04-19T05:30:13.857Z Last Updated: 2025-04-21T02:39:05.273Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: qriouslad Products: Debug Log Manager Problem Types: CWE-79 Description: The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ges that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbc3210d-224e-4ed2-ada7-dc17deb17584?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3267252%40debug-log-manager&new=3267252%40debug-log-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3810 State: PUBLISHED Published: 2025-05-09T01:42:34.585Z Last Updated: 2025-05-09T03:42:51.691Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: iqonicdesign Products: WPBookit Problem Types: CWE-639 Description: The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administr
it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54f1ebfb-67f1-461d-91f1-269b0a2c0653?source=cve - https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php
CVE ID: CVE-2025-3811 State: PUBLISHED Published: 2025-05-09T01:42:35.183Z Last Updated: 2025-05-09T03:41:30.139Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: iqonicdesign Products: WPBookit Problem Types: CWE-639 Description: The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and lev
it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a61cce43-0df7-4ca9-8897-24c7d131b505?source=cve - https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php
CVE ID: CVE-2025-3812 State: PUBLISHED Published: 2025-05-17T05:30:34.394Z Last Updated: 2025-05-19T15:40:17.385Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: QuantumCloud Products: WPBot Pro Wordpress Chatbot Problem Types: CWE-73 Description: The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delete_training_file() function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the
level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8fe1609d-17d6-4afe-90b2-5473dc9b6c3b?source=cve - https://www.wpbot.pro/
CVE ID: CVE-2025-3813 State: PUBLISHED Published: 2025-05-31T07:22:12.475Z Last Updated: 2025-06-02T15:48:56.037Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-79 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_elementor_data’ parameter in all versions up to, and including, 1.7.1020 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b957eb0d-882d-4646-ad84-9c64f957be14?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-submissions-cpt.php#L24 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/modules/forms/wpr-submissions-cpt.php#L75 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1021/classes/modules/forms/wpr-submissions-cpt.php?re
plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1021/classes/modules/forms/wpr-submissions-cpt.php?rev=3301438
CVE ID: CVE-2025-3814 State: PUBLISHED Published: 2025-04-22T05:27:24.652Z Last Updated: 2025-04-22T18:58:48.485Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wijnbergdevelopments Products: Tax Switch for WooCommerce Problem Types: CWE-79 Description: The Tax Switch for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class-name’ parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e290f1aa-d20a-4e76-b77b-3e5b79e9d379?source=cve - https://wordpress.org/plugins/tax-switch-for-woocommerce/#developers - https://plugins.trac.wordpress.org/browser/tax-switch-for-woocommerce/tags/1.4.0/includes/class-wdevs-tax-switch-block.php#L112 - https://plugins.trac.wordpress.org/changeset/3277044/
CVE ID: CVE-2025-3815 State: PUBLISHED Published: 2025-05-03T07:22:57.130Z Last Updated: 2025-05-05T14:57:37.323Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devsoftbaltic Products: SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity Problem Types: CWE-79 Description: The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in page
t possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4285590-9c2f-4189-8b47-09378d8a2432?source=cve - https://plugins.trac.wordpress.org/browser/surveyjs/trunk/initializer.php#L165 - https://surveyjs.io/stay-updated/release-notes - https://github.com/surveyjs/surveyjs-wordpress - https://github.com/surveyjs/surveyjs-wordpress/commit/6c332319c82c32d7148f77ed7ee20a9c6a5dc179
CVE ID: CVE-2025-3816 State: PUBLISHED Published: 2025-04-19T18:00:08.256Z Last Updated: 2025-04-21T02:24:11.791Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: westboy Products: CicadasCMS Problem Types: CWE-78, CWE-77 Description: A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305722 - https://vuldb.com/
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305722 - https://vuldb.com/?ctiid.305722 - https://vuldb.com/?submit.555555 - https://github.com/chujianxin0101/vuln/issues/3
CVE ID: CVE-2025-3817 State: PUBLISHED Published: 2025-04-19T19:00:06.000Z Last Updated: 2025-04-21T02:23:03.263Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /oews/classes/Master.php?f=delete_stock. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
s been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305723 - https://vuldb.com/?ctiid.305723 - https://vuldb.com/?submit.555607 - https://github.com/88hsb88/cve/blob/main/sql.md - https://www.sourcecodester.com/