Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completel
and execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. The fix is tracked on pull request 5199. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ug has not been fixed. The fix is tracked on pull request 5199. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2w-42mv-cph4 - https://github.com/filebrowser/filebrowser/issues/5199 - https://github.com/GoogleContainerTools/distroless - https://manpages.debian.org/bookworm/util-linux/prlimit.1.en.html
CVE ID: CVE-2025-52904 State: PUBLISHED Published: 2025-06-26T18:21:03.284Z Last Updated: 2025-06-30T16:53:53.379Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: filebrowser Products: filebrowser Problem Types: CWE-77 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker re
ebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations,
rom a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hc8f-m8g5-8362 - https://github.com/filebrowser/filebrowser/issues/5199 - https://github.com/GoogleContainerTools/distroless - https://sloonz.github.io/posts/sandboxing-1
CVE ID: CVE-2025-52905 State: PUBLISHED Published: 2025-09-23T17:53:49.090Z Last Updated: 2025-09-23T18:36:45.425Z Vendors: TOTOLINK Products: X6000R Problem Types: CWE-20 Description: Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html - https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0001/PANW-2025-0001.md
CVE ID: CVE-2025-52906 State: PUBLISHED Published: 2025-09-24T17:44:29.539Z Last Updated: 2025-09-24T18:24:07.786Z Vendors: TOTOLINK Products: X6000R Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1360_B20241207. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html - https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0002/PANW-2025-0002.md
CVE ID: CVE-2025-52907 State: PUBLISHED Published: 2025-09-24T18:12:36.634Z Last Updated: 2025-09-24T18:46:23.907Z Vendors: TOTOLINK Products: X6000R Problem Types: CWE-20 Description: Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B20241207. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/247/ids/36.html - https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/blob/main/2025/PANW-2025-0003/PANW-2025-0003.md
CVE ID: CVE-2025-52910 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-05T14:56:51.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After-Free leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ - https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-52910/
CVE ID: CVE-2025-52913 State: PUBLISHED Published: 2025-08-08T00:00:00.000Z Last Updated: 2025-08-12T03:55:14.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advi
nrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0007
CVE ID: CVE-2025-52914 State: PUBLISHED Published: 2025-08-08T00:00:00.000Z Last Updated: 2025-08-08T17:55:00.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-20
/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0008
CVE ID: CVE-2025-52915 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:46:10.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications. Additional Analyst Notes: - CISA ADP Vulnrichm
l of service by disrupting critical third-party services or applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://k7computing.com - https://support.k7computing.com/index.php?/solutions/view-article/Advisory-issued-on-2nd-Sep-2025
CVE ID: CVE-2025-52916 State: PUBLISHED Published: 2025-06-21T00:00:00.000Z Last Updated: 2025-07-28T13:13:38.211Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Yealink Products: RPS Problem Types: CWE-307 Description: Yealink RPS before 2025-06-04 lacks SN verification attempt limits, enabling brute-force enumeration (last five digits). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yealink.com/en/trust-center/security-advisories/b8dc062eaa8d4f59 - https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9 - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/06/25/yealink-voip-phones-ins
d6a27da76bd06a9c9 - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/
CVE ID: CVE-2025-52917 State: PUBLISHED Published: 2025-06-21T00:00:00.000Z Last Updated: 2025-07-28T13:14:28.758Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Yealink Products: RPS Problem Types: CWE-770 Description: The Yealink RPS API before 2025-05-26 lacks rate limiting, potentially enabling information disclosure via excessive requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9 - https://www.yealink.com/en/trust-center/security-advisories/f8205560a8c7443f - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/06/25/yealink-voip-p
dvisories/f8205560a8c7443f - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/
CVE ID: CVE-2025-52918 State: PUBLISHED Published: 2025-06-21T00:00:00.000Z Last Updated: 2025-07-28T13:15:33.423Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Yealink Products: RPS Problem Types: CWE-863 Description: Yealink RPS before 2025-05-26 does not prevent OpenAPI access by frozen enterprise accounts, allowing unauthorized access to deactivated interfaces. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yealink.com/en/trust-center/security-advisories/1318c5efb82e4526 - https://support.yealink.com/en/portal/knowledge/show?id=646b44278ef325311f38303f - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/
tal/knowledge/show?id=646b44278ef325311f38303f - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/
CVE ID: CVE-2025-52919 State: PUBLISHED Published: 2025-06-21T00:00:00.000Z Last Updated: 2025-07-28T13:16:08.312Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Yealink Products: RPS Problem Types: CWE-295 Description: In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.yealink.com/en/portal/knowledge/show?id=6476e7cd6a27da76bd06a9c9 - https://www.yealink.com/en/trust-center/security-advisories/ecb16a4993014d22 - https://seclists.org/fulldisclosure/2025/Jun/2
://www.yealink.com/en/trust-center/security-advisories/ecb16a4993014d22 - https://seclists.org/fulldisclosure/2025/Jun/20 - https://dnip.ch/2025/06/25/yealink-voip-phones-insecurity-by-design/
CVE ID: CVE-2025-52920 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-23T13:39:55.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: InnoShop Products: InnoShop Problem Types: CWE-425 Description: Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products on the website. To be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use t
be specific, an attacker could view the order details of any order by browsing to /en/account/orders/_ORDER_ID_ or use the address and billing information of other customers by manipulating the shipping_address_id and billing_address_id parameters when making an order (this information is then reflected in the receipt). Additionally, an attacker could delete the reviews of other users by sending a DELETE request to /en/account/reviews/_REVIEW_ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/innocommerce/innoshop - https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f
CVE ID: CVE-2025-52921 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-23T13:51:45.551Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: InnoShop Products: InnoShop Problem Types: CWE-420 Description: In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that uploaded files are image files. The application relies on frontend checks to restrict the administrator from changing the extension of uploade
ge files. The application relies on frontend checks to restrict the administrator from changing the extension of uploaded files to .php. This restriction is easily bypassed with any proxy tool (e.g., BurpSuite). Once the attacker renames the file, and gives it the .php extension, a GET request can be used to trigger the execution of code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/innocommerce/innoshop - https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f
CVE ID: CVE-2025-52922 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-23T13:51:14.993Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: InnoShop Products: InnoShop Problem Types: CWE-23 Description: Innoshop through 0.4.1 allows directory traversal via FileManager API endpoints. An authenticated attacker with access to the admin panel could abuse this to: (1) fully map the filesystem structure via the /api/file_manager/files?base_folder= endpoint, (2) create arbitrary directories on the server via the /api/file_manager/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the
ger/directories endpoint, (3) read arbitrary files from the server by copying the file to a readable location within the application via the /api/file_manager/copy_files endpoint, {4) delete arbitrary files from the server via a DELETE request to /api/file_manager/files, or (5) create arbitrary files on the server by uploading them and then leveraging the /api/file_manager/move_files endpoint to move them anywhere in the filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/innocommerce/innoshop - https://medium.com/@The_Hiker/how-i-found-multiple-cves-in-innoshop-0-4-1-12c8f84ad87f
CVE ID: CVE-2025-52923 State: PUBLISHED Published: 2025-06-22T00:00:00.000Z Last Updated: 2025-06-23T14:02:30.233Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Sangfor Products: aTrust Problem Types: CWE-732 Description: Sangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/r00t7oo2jm/cVetest/blob/main/p0c.sh - https://github.com/r00t7oo2jm/cVetest/blob/main/sangf0r-poc.pdf - https://marketplace.huaweicloud.com/intl/contents/10d76e5f-57b5-4780-9c0c-58af8f7f71e6 - https://community.sangfor.com/forum.php?mod=viewthread&tid=10842
CVE ID: CVE-2025-52924 State: PUBLISHED Published: 2025-07-19T00:00:00.000Z Last Updated: 2025-07-23T15:16:29.582Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: One Identity Products: OneLogin Problem Types: CWE-89 Description: In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://oneidentity.com - https://onelogin.service-now.com/support?id=kb_article&sys_id=59fe4c3c972a2610c90c3b0e6253afef&kb_category=a0d76d70db185340d5505eea4b96199f
CVE ID: CVE-2025-52925 State: PUBLISHED Published: 2025-07-02T00:00:00.000Z Last Updated: 2025-07-02T13:19:27.771Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: OneLogin Products: Active Directory Connector Problem Types: CWE-402 Description: In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://oneidentity.com - https://onelogin.service-now.com/support?id=kb_article&sys_id=b69c9c6c8762e210f7b8a7dd3fbb356e&kb_category=f91821b0db185340d5505eea4b9619f9
CVE ID: CVE-2025-52926 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-06-23T13:16:00.737Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: spytrap-org Products: spytrap-adb Problem Types: CWE-223 Description: In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/spytrap-org/spytrap-adb/pull/65 - https://github.com/spytrap-org/spytrap-adb/commit/277cec542466b75cf5a8c532581243fd4b7b9713 - https://github.com/spytrap-org/spytrap-adb/releases/tag/v0.3.5
CVE ID: CVE-2025-52930 State: PUBLISHED Published: 2025-08-25T14:17:36.760Z Last Updated: 2025-11-03T18:13:08.348Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: SAIL Image Decoding Library Products: SAIL Image Decoding Library Problem Types: CWE-680 Description: A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing the image data from a specially crafted .bmp file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP V
r will need to convince the library to read a file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2221
CVE ID: CVE-2025-52931 State: PUBLISHED Published: 2025-08-11T18:57:00.672Z Last Updated: 2025-08-11T19:36:18.801Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-754 Description: Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-52933 State: REJECTED Published: N/A Last Updated: 2025-07-17T12:57:26.277Z Description: No description available.
CVE ID: CVE-2025-52934 State: REJECTED Published: N/A Last Updated: 2025-06-26T07:51:22.738Z Description: No description available.
CVE ID: CVE-2025-52935 State: PUBLISHED Published: 2025-06-23T09:27:18.355Z Last Updated: 2025-06-23T12:29:54.589Z Vendors: dragonflydb Products: dragonfly Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_struct.C. This issue affects dragonfly: 1.30.1, 1.30.0, 1.28.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dragonflydb/dragonfly/pull/4996 - https://github.com/dragonflydb/dragonfly/commit/473e002c848eb312f23d84114eb4951a7c4af5a1
CVE ID: CVE-2025-52936 State: PUBLISHED Published: 2025-06-23T09:25:41.764Z Last Updated: 2025-11-03T20:06:16.884Z Vendors: yrutschle Products: sslh Problem Types: CWE-59 Description: Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yrutschle/sslh/pull/494
CVE ID: CVE-2025-52937 State: PUBLISHED Published: 2025-06-23T09:26:12.727Z Last Updated: 2025-06-23T13:26:46.248Z Vendors: PointCloudLibrary Products: pcl Description: Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C. This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib (WITH_SYSTEM_ZLIB=FALSE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PointCloudLibrary/pcl/pull/6275 - https://github.com/PointCloudLibrary/pcl/commit/2f9dc390c6769fbd821fafa0e16f4707ed7c5d79
CVE ID: CVE-2025-52938 State: PUBLISHED Published: 2025-06-23T09:26:39.214Z Last Updated: 2025-06-23T12:36:52.166Z Vendors: dail8859 Products: NotepadNext Problem Types: CWE-125 Description: Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dail8859/NotepadNext/pull/756 - https://github.com/dail8859/Note
CISA ADP Vulnrichment: References: - https://github.com/dail8859/NotepadNext/pull/756 - https://github.com/dail8859/NotepadNext/commit/66b8a97d9fdfd2257996875716f39c18d84e004f
CVE ID: CVE-2025-52939 State: PUBLISHED Published: 2025-06-23T09:26:56.917Z Last Updated: 2025-06-23T12:34:13.199Z Vendors: dail8859 Products: NotepadNext Problem Types: CWE-787 Description: Out-of-bounds Write vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files ldebug.C, lvm.C. This issue affects NotepadNext: through v0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dail8859/NotepadNext/pull/757/files - https://github.com/dail8859/NotepadNext/commit/3e928d91b8fc8bb5c77801ee8652f41e98d12571