Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26153 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-18T12:02:40.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messages, which execute when victims, such as administrators, reply to the message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chamilo/chamilo-lms/commit/beb07770d674fcc9db6df0e59aab107678c28682 - https://github.com/chamilo/chamilo-lms/commit/d5c29cf39ac30d7364a52bba4036c3e870412066 - https://gist.github.com/NoSpaceAvailable/234acdf57b5d7b29b2f39090c
lms/commit/d5c29cf39ac30d7364a52bba4036c3e870412066 - https://gist.github.com/NoSpaceAvailable/234acdf57b5d7b29b2f39090c1686bc8
CVE ID: CVE-2025-26156 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T18:29:20.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/README.md
CVE ID: CVE-2025-26157 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T19:22:12.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to execute arbitrary code via the name POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/others/README.md
CVE ID: CVE-2025-26158 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T19:19:36.404Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the manage-employee.php page of Kashipara Online Attendance Management System V1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the department parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rtnthakur/CVE/blob/main/Kashipara/README.md
CVE ID: CVE-2025-26159 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T20:43:07.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags can inject malicious JavaScript code in the name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nasirkhan/laravel-starter - https://godbadtry.github.io/posts/CVE-2025-26159/
CVE ID: CVE-2025-26163 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-19T18:30:14.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: CM Soluces Informatica Ltda Auto Atendimento 1.x.x was discovered to contain a SQL injection via the CPF parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fr1t0viski/PoCs/blob/main/SQL_Injection_AutoAtendimento
CVE ID: CVE-2025-26167 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:50:11.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SpikeReply/advisories/blob/0f15f5aefb959fbaff049da7cc3e36733e25b580/cve/buffalo/cve-2025-26167.md
CVE ID: CVE-2025-26168 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-07T20:16:27.341Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IXON Products: VPN Client Problem Types: CWE-732 Description: IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ixon.cloud/s/article/VPN-Client-installation-an
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ixon.cloud/s/article/VPN-Client-installation-and-uninstallation - https://ixon-cloud.my.salesforce.com/sfc/p/#1t000000vlSF/a/TX000000DQmH/WRGwuYg2iMsKX6NAIK3MygCUOlg0SPQ..YvGWrwfNeM
CVE ID: CVE-2025-26169 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-07T20:15:56.963Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IXON Products: VPN Client Problem Types: CWE-732 Description: IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration file that can be controlled by a low-privileged user. There is a race condition in which a temporary configuration file, in a world-writable directory, can be overwritten. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.ixon.cloud/s/article/VPN-Client-installation-and-unin
lyst Notes: - CISA ADP Vulnrichment: References: - https://support.ixon.cloud/s/article/VPN-Client-installation-and-uninstallation - https://ixon-cloud.my.salesforce.com/sfc/p/#1t000000vlSF/a/TX000000DQmH/WRGwuYg2iMsKX6NAIK3MygCUOlg0SPQ..YvGWrwfNeM
CVE ID: CVE-2025-26182 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-05T18:34:12.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/GSBP0/007355c5f6bd213264ae1c35c347e5cc
CVE ID: CVE-2025-26186 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T17:32:43.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in openSIS v.9.1 allows a remote attacker to execute arbitrary code via the id parameter in Ajax.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.os4ed.com/ - https://github.com/OS4ED/openSIS-Classic/pull/330
CVE ID: CVE-2025-26198 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-20T15:29:58.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete
ggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e - https://github.com/tansique-17/CVE-2025-26198/
CVE ID: CVE-2025-26199 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-20T15:48:36.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative function
iddle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/tansique-17/6e01bb1b8a09ef499a9b8484a8dc2487 - https://github.com/tansique-17/CVE-2025-26199/tree/main
CVE ID: CVE-2025-26200 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-24T16:50:42.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/269 - https://mebroccoli.blogspot.com/2025/02/cve2.html
CVE ID: CVE-2025-26201 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-24T17:15:10.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://greaterwms.com - https://github.com/Elymaro/CVE/blob/main/GreaterWMS/CVE-2025-26201.md - https://github.com/GreaterWMS/GreaterWMS/issues/383
CVE ID: CVE-2025-26202 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-14T19:42:09.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an administrator views the passphrase via the "Click here to display" option on the Status page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/A17-ba/CVE-2025-26202-Details
CVE ID: CVE-2025-26204 State: REJECTED Published: 2025-03-09T00:00:00.000Z Last Updated: 2025-03-09T21:15:36.711Z Description: No description available.
CVE ID: CVE-2025-26205 State: REJECTED Published: 2025-03-09T00:00:00.000Z Last Updated: 2025-03-09T21:14:20.599Z Description: No description available.
CVE ID: CVE-2025-26206 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:51:38.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/selldone/storefront/blob/main/index.html - https://github.com/xibhi/CVE-2025-26206
CVE ID: CVE-2025-26210 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-08T17:39:51.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackmd.io/@MrqrFIlhQFi7vUwkqbrXDw/deepseek - https://youtu.be/IgQwy52FVT4 - https://deepseek.com
CVE ID: CVE-2025-26211 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-27T14:06:29.032Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: GibbonEdu Products: Gibbon Problem Types: CWE-352 Description: Gibbon before 29.0.00 allows CSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GibbonEdu/core/blob/be891ab97b058a933b68354559457c9e310c13b8/modules/Timetable%20Admin/tt_delete.php#L24 - https://github.com/GibbonEdu/core/releases/tag/v29.0.00
CVE ID: CVE-2025-26215 State: REJECTED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-14T16:51:04.734Z Description: No description available.
CVE ID: CVE-2025-26216 State: REJECTED Published: N/A Last Updated: 2025-03-14T16:48:40.389Z Description: No description available.
CVE ID: CVE-2025-26241 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-05T17:37:09.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket <=1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topic_id" URL parameters combination. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://members.backbox.org/osticket-sql-injection-bypass/
CVE ID: CVE-2025-26258 State: PUBLISHED Published: 2025-09-26T00:00:00.000Z Last Updated: 2025-09-26T20:33:02.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.' Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17847/employee-management-system-using-php-and-mysql-source-code.html - https://github.com/oye-ujjwal/CVEs/blob/main/Employee%20Management%20System%20App/CVE-2025-26258
CVE ID: CVE-2025-26260 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-03-19T18:59:02.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5 - https://github.com/plentico/plenti/releases/tag/v0.7.17 - https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-
lenti/releases/tag/v0.7.17 - https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260 - https://ahmetakan.com/2025/02/14/cve-2025-26260/
CVE ID: CVE-2025-26262 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-06T20:28:12.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and execute arbitrary code via supplying a file that contains a crafted filename. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rfxn/linux-malware-detect - https://github.com/rfxn/linux-malware-detect/blob/master/CHANGELOG
CVE ID: CVE-2025-26263 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-19T13:33:50.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.geovision.com.tw/download/product/GV-ASManager - https://github.com/DRAGOWN/CVE-2025-26263 - https://www.geovision.com.tw/download/product/GV-ASManager%20%28Access%20Control%29
CVE ID: CVE-2025-26264 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-19T13:35:23.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DRAGOWN/CVE-2025-26264 - https://www.geovision.com.tw/download/product/GV-ASManager%20%28Access%20Contro
ps://github.com/DRAGOWN/CVE-2025-26264 - https://www.geovision.com.tw/download/product/GV-ASManager%20%28Access%20Control%29
CVE ID: CVE-2025-26265 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-03-28T15:11:43.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault in openairinterface5g v2.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted UE Context Modification response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eurecom.fr/oai/openairinterface5g - https://www.sigmobile.org/mobicom/2025/ - https://anonymous.4open.science/r/Mobicom-ARCANE-36B7/README.md
CVE ID: CVE-2025-26268 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:12:46.786Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: DragonflyDB Products: Dragonfly Problem Types: CWE-392 Description: DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the scan cursor was not checked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflydb/dragonfly/issues/4466 - https://github.com/dragonflydb/dragonfly/commit/d1fac0f912edb323a2bdd6404c518cda21eac243 - https://github.com/dragonflydb/dragonfly/c
b.com/dragonflydb/dragonfly/commit/d1fac0f912edb323a2bdd6404c518cda21eac243 - https://github.com/dragonflydb/dragonfly/compare/v1.26.4...v1.27.0
CVE ID: CVE-2025-26269 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-23T16:08:25.399Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: DragonflyDB Products: Dragonfly Problem Types: CWE-191 Description: DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that references a large negative integer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflydb/dragonfly/issues/4468 - https://github.com/dragonflydb/dragonfly/commit/4612aec9a78e3f604e6fb19bee51acde89723308 - https://gist.github.com/ankki-zsy
s://github.com/dragonflydb/dragonfly/commit/4612aec9a78e3f604e6fb19bee51acde89723308 - https://gist.github.com/ankki-zsyang/d8215cf6e868d07546eaa5346a884ebd
CVE ID: CVE-2025-26278 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-25T18:50:56.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/tariqhawis/ad92d5e683f3a5d83e0629955ff42ad7 - https://github.com/OrangeShieldInfos/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-26278
CVE ID: CVE-2025-26304 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T20:37:48.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/323
CVE ID: CVE-2025-26305 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T20:40:05.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak has been identified in the parseSWF_SOUNDINFO function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/322
CVE ID: CVE-2025-26306 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-24T17:33:56.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/324
CVE ID: CVE-2025-26307 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T15:04:08.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/325
CVE ID: CVE-2025-26308 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-24T17:26:26.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak has been identified in the parseSWF_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/326
CVE ID: CVE-2025-26309 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T17:39:13.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service via a crafted SWF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/327
CVE ID: CVE-2025-26310 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T17:37:23.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple memory leaks have been identified in the ABC file parsing functions (parseABC_CONSTANT_POOL and `parseABC_FILE) in util/parser.c of libming v0.4.8, which allow attackers to cause a denial of service via a crafted ABC file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/328
CVE ID: CVE-2025-26311 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T21:06:28.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple memory leaks have been identified in the clip actions parsing functions (parseSWF_CLIPACTIONS and parseSWF_CLIPACTIONRECORD) in util/parser.c of libming v0.4.8, which allow attackers to cause a denial of service via a crafted SWF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libming/libming/issues/329
CVE ID: CVE-2025-26312 State: PUBLISHED Published: 2025-03-14T00:00:00.000Z Last Updated: 2025-03-18T14:11:32.183Z Vendors: SendQuick Products: Entera Problem Types: CWE-472 Description: SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@retro.metro/cve-2025-26312-captcha-bypass-vulnerability-in-sendquick-entera-devices-68708e203216 - https://www.sendquick.com/products/sendquick-entera/
CVE ID: CVE-2025-26318 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-08-26T19:34:44.923Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: TSplus Products: TSplus Remote Access Problem Types: CWE-201 Description: hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Frozenka/CVE-2025-26318