Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-2584 State: PUBLISHED Published: 2025-03-21T07:31:03.732Z Last Updated: 2025-03-21T12:29:54.383Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: WebAssembly Products: wabt Problem Types: CWE-122, CWE-119 Description: A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public an
y of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300544 - https://vuldb.com/?ctiid.300544 - https://vuldb.com/?submit.515406 - https://github.com/WebAssembly/wabt/issues/2557 - https://github.com/WebAssembly/wabt/issues/2557#issue-2900405517
CVE ID: CVE-2025-2585 State: PUBLISHED Published: 2025-03-21T02:02:22.600Z Last Updated: 2025-03-21T15:37:57.576Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: EBM Technologies Products: EBM Maintenance Center Problem Types: CWE-89 Description: EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10021-8786e-1.html - https://www.twcert.org.tw/en/cp-139-10022-8e28e-2.html
CVE ID: CVE-2025-2586 State: PUBLISHED Published: 2025-03-31T11:33:24.980Z Last Updated: 2025-11-20T07:36:06.922Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: OpenShift Lightspeed Problem Types: CWE-400 Description: A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, R
tential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-2586 - https://bugzilla.redhat.com/show_bug.cgi?id=2353998
CVE ID: CVE-2025-2587 State: PUBLISHED Published: 2025-03-21T12:00:08.867Z Last Updated: 2025-03-21T17:26:41.533Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Jinher Products: OA C6 Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. The manipulation of the argument httpOID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300567 - https://vuldb.com/?ctiid.30056
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300567 - https://vuldb.com/?ctiid.300567 - https://vuldb.com/?submit.516025 - https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E
CVE ID: CVE-2025-2588 State: PUBLISHED Published: 2025-03-21T12:00:10.758Z Last Updated: 2025-03-21T17:24:55.111Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Hercules Products: Augeas Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300568 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300568 - https://vuldb.com/?ctiid.300568 - https://vuldb.com/?submit.517281 - https://github.com/hercules-team/augeas/issues/852 - https://github.com/hercules-team/augeas/issues/852#issue-2905999609
CVE ID: CVE-2025-2589 State: PUBLISHED Published: 2025-03-21T12:31:04.867Z Last Updated: 2025-03-21T17:23:43.618Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: code-projects Products: Human Resource Management System Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file \handler\Account.go. The manipulation of the argument user_cookie leads to improper authorization. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300569 - https://vuldb.com/?ctiid.300569 - https://vuldb.com/?submit.517343 - https://github.com/38279/1/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-2590 State: PUBLISHED Published: 2025-03-21T13:00:08.940Z Last Updated: 2025-03-21T13:29:48.139Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: code-projects Products: Human Resource Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecruitmentById of the file \handler\recruitment.go. The manipulation of the argument c leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
ck remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300570 - https://vuldb.com/?ctiid.300570 - https://vuldb.com/?submit.517344 - https://github.com/38279/1/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-2591 State: PUBLISHED Published: 2025-03-21T13:31:08.439Z Last Updated: 2025-03-21T14:26:30.345Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:N/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-369, CWE-404 Description: A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aa
ed remotely. The exploit has been disclosed to the public and may be used. The patch is identified as ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300574 - https://vuldb.com/?ctiid.300574 - https://vuldb.com/?submit.517781 - https://github.com/assimp/assimp/issues/6009 - https://github.com/assimp/assimp/pull/6047 - https://github.com/assimp/assimp/issues/6009#issue-2877367021 - https://github.com/assimp/assimp/pull/6047/commits/ab66a1674fcfac87aaba4c8b900b315ebc3e7dbd
CVE ID: CVE-2025-2592 State: PUBLISHED Published: 2025-03-21T14:00:18.480Z Last Updated: 2025-03-21T14:25:58.496Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Open Asset Import Library Products: Assimp Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is re
has been disclosed to the public and may be used. The patch is named 2690e354da0c681db000cfd892a55226788f2743. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300575 - https://vuldb.com/?ctiid.300575 - https://vuldb.com/?submit.517782 - https://github.com/assimp/assimp/issues/6010 - https://github.com/assimp/assimp/pull/6052 - https://github.com/assimp/assimp/issues/6010#issue-2877368110 - https://github.com/assimp/assimp/commit/2690e354da0c681db000cfd892a55226788f2743
CVE ID: CVE-2025-2593 State: PUBLISHED Published: 2025-03-21T14:31:04.784Z Last Updated: 2025-03-21T15:19:01.984Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: FastCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/client/article/list. The manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300577 - https://vuldb.com/?ct
d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300577 - https://vuldb.com/?ctiid.300577 - https://vuldb.com/?submit.517926 - https://github.com/IceFoxH/VULN/issues/9 - https://github.com/IceFoxH/VULN/issues/8
CVE ID: CVE-2025-2594 State: PUBLISHED Published: 2025-04-22T06:00:06.896Z Last Updated: 2025-08-27T12:00:51.368Z Vendors: Unknown Products: User Registration & Membership Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1c1be47a-d5c0-4ac1-b9fd-475b382a7d8f/
CVE ID: CVE-2025-2595 State: PUBLISHED Published: 2025-04-23T07:54:00.430Z Last Updated: 2025-04-23T16:27:02.990Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CODESYS Products: CODESYS Visualization Problem Types: CWE-425 Description: An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-027
CVE ID: CVE-2025-2596 State: PUBLISHED Published: 2025-03-26T10:51:16.285Z Last Updated: 2025-03-26T17:36:08.128Z Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-613 Description: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17808
CVE ID: CVE-2025-2597 State: PUBLISHED Published: 2025-03-21T11:50:02.392Z Last Updated: 2025-03-21T12:24:15.768Z Vendors: Impact Technologies Products: ITIUM 6050 Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘id_session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-vulnerability-itium-6050
CVE ID: CVE-2025-2598 State: PUBLISHED Published: 2025-03-21T14:14:29.040Z Last Updated: 2025-10-14T18:38:18.174Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: AWS Products: Cloud Development Kit Command Line Interface Problem Types: CWE-497 Description: When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes. Additional Anal
rsion 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aws.amazon.com/security/security-bulletins/AWS-2025-005/ - https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp - https://github.com/aws/aws-cdk/releases/tag/v2.178.2
CVE ID: CVE-2025-2600 State: PUBLISHED Published: 2025-03-26T17:37:39.621Z Last Updated: 2025-08-26T17:43:23.847Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-285 Description: Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24 through 2025.1.25, and all versions up to 2024.3.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0005/
CVE ID: CVE-2025-2601 State: PUBLISHED Published: 2025-03-21T19:31:04.943Z Last Updated: 2025-03-21T19:50:59.211Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file activate_reg.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300585 - https://vuldb.com/?ctiid.300585 - https://vuldb.com/?submit.517959 - https://github.com/Hefei-Coffee/cve/issues/10 - https://www.sourcecodester.com/
CVE ID: CVE-2025-2602 State: PUBLISHED Published: 2025-03-21T19:31:07.388Z Last Updated: 2025-03-21T19:51:44.122Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file deactivate_reg.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300586 - https://vuldb.com/?ctiid.300586 - https://vuldb.com/?submit.517960 - https://github.com/Hefei-Coffee/cve/issues/11 - https://www.sourcecodester.com/
CVE ID: CVE-2025-2603 State: PUBLISHED Published: 2025-03-21T20:00:12.913Z Last Updated: 2025-03-25T15:22:33.413Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the file deactivate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300587 - https://vuldb.com/?ctiid.300587 - https://vuldb.com/?submit.517963 - https://github.com/Hefei-Coffee/cve/issues/12 - https://www.sourcecodester.com/
CVE ID: CVE-2025-2604 State: PUBLISHED Published: 2025-03-21T20:31:05.576Z Last Updated: 2025-03-25T15:13:51.486Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_act.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300588 - https://vuldb.com/?ctiid.300588 - https://vuldb.com/?submit.517965 - https://github.com/Hefei-Coffee/cve/issues/14 - https://www.sourcecodester.com/
CVE ID: CVE-2025-2605 State: PUBLISHED Published: 2025-05-02T12:39:39.979Z Last Updated: 2025-05-17T06:03:36.347Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Honeywell Products: MB-Secure Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hone
this product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.honeywell.com/us/en/product-security#security-notices
CVE ID: CVE-2025-2606 State: PUBLISHED Published: 2025-03-21T21:00:08.730Z Last Updated: 2025-03-25T15:12:58.157Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Church Management Software Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/soulwinning_crud.php. The manipulation of the argument photo/photo1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
ck can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300589 - https://vuldb.com/?ctiid.300589 - https://vuldb.com/?submit.517974 - https://github.com/Hefei-Coffee/cve/issues/15 - https://www.sourcecodester.com/
CVE ID: CVE-2025-2607 State: PUBLISHED Published: 2025-03-21T21:00:10.948Z Last Updated: 2025-03-24T14:31:33.710Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: phplaozhang Products: LzCMS-LaoZhangBoKeXiTong Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/upload/upimage.html of the component HTTP POST Request Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst N
The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300590 - https://vuldb.com/?ctiid.300590 - https://vuldb.com/?submit.518021 - https://github.com/Jingyi-u/lzcms/tree/main
CVE ID: CVE-2025-2608 State: PUBLISHED Published: 2025-03-21T21:31:05.936Z Last Updated: 2025-03-24T14:22:59.877Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PHPGurukul Products: Banquet Booking System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Banquet Booking System 1.2. This affects an unknown part of the file /admin/view-user-queries.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300591 - h
ublic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.300591 - https://vuldb.com/?ctiid.300591 - https://vuldb.com/?submit.518587 - https://github.com/emano888/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-2609 State: PUBLISHED Published: 2025-03-21T22:41:13.784Z Last Updated: 2025-11-22T01:42:35.649Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: MagnusSolution Products: MagnusBilling Problem Types: CWE-79 Description: Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. Additional Analyst Notes
gram files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chocapikk.com/posts/2025/magnusbilling/ - https://github.com/magnussolution/magnusbilling7/commit/f0f083c76157e31149ae58342342fb1bf1629e22 - https://vulncheck.com/advisories/magnusbilling-logs-xss
CVE ID: CVE-2025-2610 State: PUBLISHED Published: 2025-03-21T22:35:17.724Z Last Updated: 2025-11-19T18:34:51.596Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: MagnusSolution Products: MagnusBilling Problem Types: CWE-79 Description: Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chocapikk.com/posts/2025/magnusbilling/ - h
.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chocapikk.com/posts/2025/magnusbilling/ - https://github.com/magnussolution/magnusbilling7/commit/f0f083c76157e31149ae58342342fb1bf1629e22 - https://vulncheck.com/advisories/magnusbilling-alarm-xss