Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11487 State: PUBLISHED Published: 2025-10-08T17:32:06.460Z Last Updated: 2025-10-08T19:26:36.812Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Farm Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProduct.php. Performing manipulation of the argument Type results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
n released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327604 - https://vuldb.com/?ctiid.327604 - https://vuldb.com/?submit.667455 - https://github.com/DrNbnonono/CVE/issues/11 - https://www.sourcecodester.com/
CVE ID: CVE-2025-11488 State: PUBLISHED Published: 2025-10-08T18:02:08.607Z Last Updated: 2025-10-08T18:33:08.916Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-852 Problem Types: CWE-77, CWE-74 Description: A weakness has been identified in D-Link DIR-852 up to 20251002. This affects an unknown part of the file /HNAP1/. Executing manipulation can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
ts that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327605 - https://vuldb.com/?ctiid.327605 - https://vuldb.com/?submit.667505 - https://www.yuque.com/jh0ng/vmpda6/cqi681wr7vci6kx9 - https://www.dlink.com/
CVE ID: CVE-2025-11489 State: PUBLISHED Published: 2025-10-08T18:02:11.266Z Last Updated: 2025-10-23T04:26:22.910Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: wonderwhy-er Products: DesktopCommanderMCP Problem Types: CWE-61, CWE-59 Description: A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been d
ent. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: "Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We'll keep this issue open for future consideration if we receive more user demand for improved restrictions." This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes
ions." This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327606 - https://vuldb.com/?ctiid.327606 - https://vuldb.com/?submit.668004 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219#issuecomment-3214114903 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/219#issue-3343862329
CVE ID: CVE-2025-11490 State: PUBLISHED Published: 2025-10-08T18:32:05.161Z Last Updated: 2025-10-23T04:25:58.602Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C) Vendors: wonderwhy-er Products: DesktopCommanderMCP Problem Types: CWE-78, CWE-77 Description: A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is as
The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327609 - https://vuldb.com/?ctiid.327609 - https://vuldb.com/?submit.668005 - https:/
eferences: - https://vuldb.com/?id.327609 - https://vuldb.com/?ctiid.327609 - https://vuldb.com/?submit.668005 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218#issuecomment-3214135034 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218#issue-3343855120
CVE ID: CVE-2025-11491 State: PUBLISHED Published: 2025-10-08T19:02:05.860Z Last Updated: 2025-10-23T04:25:49.508Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: wonderwhy-er Products: DesktopCommanderMCP Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327610 - htt
c and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327610 - https://vuldb.com/?ctiid.327610 - https://vuldb.com/?submit.668006 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217#issue-3343853704
CVE ID: CVE-2025-11492 State: PUBLISHED Published: 2025-10-16T18:59:35.285Z Last Updated: 2025-10-17T03:55:31.431Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ConnectWise Products: Automate Problem Types: CWE-319 Description: In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some communications over the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications. Additional An
er the HTTP channel is updated in the Automate 2025.9 patch to enforce HTTPS for all agent communications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix
CVE ID: CVE-2025-11493 State: PUBLISHED Published: 2025-10-16T19:00:39.119Z Last Updated: 2025-10-17T03:55:32.171Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ConnectWise Products: Automate Problem Types: CWE-494 Description: The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492. Additional Analyst Notes:
imate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.connectwise.com/company/trust/security-bulletins/connectwise-automate-2025.9-security-fix
CVE ID: CVE-2025-11494 State: PUBLISHED Published: 2025-10-08T19:32:07.225Z Last Updated: 2025-10-08T19:42:18.113Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: GNU Products: Binutils Problem Types: CWE-125, CWE-119 Description: A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue. Add
patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327619 - https://vuldb.com/?ctiid.327619 - https://vuldb.com/?submit.668281 - https://sourceware.org/bugzilla/show_bug.cgi?id=33499 - https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2 - https://sourceware.org/bugzilla/attachment.cgi?id=16389 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a - https://www.gnu.org/
CVE ID: CVE-2025-11495 State: PUBLISHED Published: 2025-10-08T20:02:07.807Z Last Updated: 2025-10-08T20:25:19.841Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: GNU Products: Binutils Problem Types: CWE-122, CWE-119 Description: A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deplo
and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327620 - https://vuldb.com/?ctiid.327620 - https://vuldb.com/?submit.668290 - https://sourceware.org/bugzilla/show_bug.cgi?id=33502 - https://sourceware.org/bugzilla/show_bug.cgi?id=33502#c3 - https://sourceware.org/bugzilla/attachment.cgi?id=16393 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 - https://www.gnu.org/
CVE ID: CVE-2025-11497 State: PUBLISHED Published: 2025-10-25T06:49:22.013Z Last Updated: 2025-10-27T15:52:54.338Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: symptote Products: Advanced Database Cleaner Problem Types: CWE-20 Description: The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to missing or incorrect nonce validation on the aDBc_prepare_elements_to_clean() function. This makes it possible for unauthenticated attackers to alter the keep last setting via a forged request granted they can trick a site administrator into performing an action such
r the keep last setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4635ac-2ce6-4135-8d2b-d03b42860f05?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3382581%40advanced-database-cleaner&new=3382581%40advanced-database-cleaner&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11498 State: PUBLISHED Published: 2025-10-14T12:42:59.143Z Last Updated: 2025-10-14T15:31:36.665Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: B&R Industrial Automation GmbH Products: Automation Runtime Problem Types: CWE-1236 Description: An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV fil
es the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/SA25P003-178b6a20.pdf
CVE ID: CVE-2025-11499 State: PUBLISHED Published: 2025-11-01T06:40:37.314Z Last Updated: 2025-11-03T13:30:46.874Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: essekia Products: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Problem Types: CWE-434 Description: The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the aff
up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2be770c7-7aa2-430b-981d-5d81fe068bef?source=cve - https://plugins.trac.wordpress.org/browser/tablesome/trunk/workflow-library/actions/wp-post-creation.php#L309 - https://plugins.trac.wordpress.org/changeset/3386484/tablesome/trunk/workflow-library
ctions/wp-post-creation.php#L309 - https://plugins.trac.wordpress.org/changeset/3386484/tablesome/trunk/workflow-library/actions/wp-post-creation.php
CVE ID: CVE-2025-11501 State: PUBLISHED Published: 2025-10-15T07:23:56.828Z Last Updated: 2025-10-15T16:09:07.577Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: markomaksym Products: Dynamically Display Posts Problem Types: CWE-89 Description: The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'tax_query' parameter in all versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract se
unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ad5698-4299-48a4-bcc1-5f4436dfab27?source=cve - https://plugins.trac.wordpress.org/browser/dynamically-display-posts/trunk/includes/frontend/classes/database-talk.php#L38
CVE ID: CVE-2025-11502 State: PUBLISHED Published: 2025-11-01T05:40:24.552Z Last Updated: 2025-11-03T13:30:58.163Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: magazine3 Products: Schema & Structured Data for WP & AMP Problem Types: CWE-79 Description: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web s
. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d664d1f9-39b1-424f-a95e-7a480d809c79?source=cve - https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.50/modules/tinymce/register-shortcodes.php#L120 - https://plugins.trac.wordpress.org/changeset/3387089/schema-and-structured-data-for-wp/trunk/modules/tinymce/register-shortcodes.php
CVE ID: CVE-2025-11503 State: PUBLISHED Published: 2025-10-08T20:02:11.395Z Last Updated: 2025-10-08T20:18:35.484Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-services.php. Executing manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
t has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327629 - https://vuldb.com/?ctiid.327629 - https://vuldb.com/?submit.668695 - https://github.com/f000x0/cve/issues/9 - https://phpgurukul.com/
CVE ID: CVE-2025-11504 State: PUBLISHED Published: 2025-10-24T08:23:59.230Z Last Updated: 2025-10-24T12:30:53.238Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: quickcreator Products: Quickcreator – AI Blog Writer Problem Types: CWE-532 Description: The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plugins/quickcreator/dupasrala.txt file. This makes it possible for unauthenticated attackers to view the plugin's API key and subsequently use that to perform actions on the site like creating new posts and injecting XSS payloads. Additional Analyst Notes: - C
se that to perform actions on the site like creating new posts and injecting XSS payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/561f171e-f13e-408b-a63e-bf6a512d4463?source=cve - https://wordpress.org/plugins/quickcreator/
CVE ID: CVE-2025-11505 State: PUBLISHED Published: 2025-10-08T21:32:06.615Z Last Updated: 2025-10-09T14:34:07.646Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The manipulation of the argument delid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327
available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327630 - https://vuldb.com/?ctiid.327630 - https://vuldb.com/?submit.668799 - https://github.com/f000x0/cve/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-11506 State: PUBLISHED Published: 2025-10-08T21:32:10.029Z Last Updated: 2025-10-14T14:19:25.702Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/search-appointment.php. The manipulation of the argument searchdata results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: R
. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327631 - https://vuldb.com/?ctiid.327631 - https://vuldb.com/?submit.668805 - https://github.com/f000x0/cve/issues/11 - https://phpgurukul.com/
CVE ID: CVE-2025-11507 State: PUBLISHED Published: 2025-10-08T22:02:08.281Z Last Updated: 2025-10-14T14:19:13.755Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/search-invoices.php. This manipulation of the argument searchdata causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
een made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327632 - https://vuldb.com/?ctiid.327632 - https://vuldb.com/?submit.668888 - https://github.com/f000x0/cve/issues/13 - https://phpgurukul.com/
CVE ID: CVE-2025-11508 State: PUBLISHED Published: 2025-10-08T22:32:05.095Z Last Updated: 2025-10-14T14:18:37.512Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Voting System Problem Types: CWE-434, CWE-284 Description: A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327633 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327633 - https://vuldb.com/?ctiid.327633 - https://vuldb.com/?submit.669458 - https://github.com/underatted/CVE/issues/13 - https://code-projects.org/
CVE ID: CVE-2025-11509 State: PUBLISHED Published: 2025-10-08T22:32:07.646Z Last Updated: 2025-10-14T14:18:25.472Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: E-Commerce Website Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/product_add.php. Performing manipulation of the argument prod_name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327634 - https://vuldb.com/?ctiid.327
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327634 - https://vuldb.com/?ctiid.327634 - https://vuldb.com/?submit.669485 - https://github.com/Blowingwinds/cve-report/blob/main/cve1/report.md - https://code-projects.org/