Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-60916 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T15:56:56.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-reflected-dom-based-xss-charge/
CVE ID: CVE-2025-60917 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:34:55.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sec4you-pentest.com/schwachstellen/ - https://www.sec4you-pentest.com/schwachstelle/openatlas-schwachstelle-xss-in-farb-feldern-ort/
CVE ID: CVE-2025-60925 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T16:40:03.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: codeshare v1.0.0 was discovered to contain an information leakage vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@ashutoshhwork/accessing-full-history-of-codeshare-io-users-432315083930 - https://gist.github.com/XERXES-OG/8fa5e75604e1d0c908cff3f85251c6b1
CVE ID: CVE-2025-60932 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:27:20.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step Description, Note Name, and Goal Description parameters. The patched version is PP-Release-6.3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerabilit
alyst Notes: - CISA ADP Vulnrichment: References: - https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-current-goals
CVE ID: CVE-2025-60933 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:25:35.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step Description, Note Name, and Goal Description parameters. The patched version is PP-Release-6.3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability
lyst Notes: - CISA ADP Vulnrichment: References: - https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-future-goals
CVE ID: CVE-2025-60934 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:24:53.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee Notes, title, or description parameters. The patched version is PP-Release-6.3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-employee-notes
CVE ID: CVE-2025-60936 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:31:03.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code that executes when administrators view the application logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emoncms/emoncms/issues/1940
CVE ID: CVE-2025-60938 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T15:41:40.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baud_rate, core, and autoreset within the /admin/upload-custom-firmware endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emoncms/emoncms/issues/1941
CVE ID: CVE-2025-60950 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:55:24.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary code via a crafted SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/issues/101 - https://app.aixblock.io/temp/dbdf9e79_payload1.svg - https://github.com/AIxBlock-2023/awesome-ai-dev-platform-opensource/pull/172/commits/f60975d58215db83d5d111bd50a86e269c228081
CVE ID: CVE-2025-60954 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T20:40:52.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/microweber/microweber - https://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646 - https://github.com/progprnv/CVE-Reports/blob/main/CVE
ttps://gist.github.com/progprnv/feae2b76f2db0cb2ac6e14b1bf7d8646 - https://github.com/progprnv/CVE-Reports/blob/main/CVE-2025-60954
CVE ID: CVE-2025-60956 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T19:27:45.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60957 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T17:39:50.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60958 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T18:06:39.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60959 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:06:48.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60960 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:06:07.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60961 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:05:28.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60962 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:04:53.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information, and possibly other unspecified impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60963 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T20:03:50.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60964 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T17:32:11.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60965 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T17:36:05.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60967 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T18:29:12.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60969 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T19:22:30.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://endrun.com - http://sonoma.com - https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12
CVE ID: CVE-2025-60982 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T18:43:28.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object identifiers in API requests. Attackers can exploit this flaw to view or modify sensitive records without proper authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.educare.school/ - https://gith
thorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.educare.school/ - https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md
CVE ID: CVE-2025-60983 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T18:41:02.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/handyteddy/Security-Advisories/blob/main/Rubikon-XSS.md
CVE ID: CVE-2025-60991 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T18:18:50.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload injected into the cat parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codazon.com - https://github.com/shadowByte1 - https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-60991.md
CVE ID: CVE-2025-61035 State: PUBLISHED Published: 2025-10-22T00:00:00.000Z Last Updated: 2025-10-27T13:33:54.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file, which is created with mode 0777 and 0775 respectively, exposing secrets to other local users. Additionally, the .kimlik file is written without symlink checks, allowing local attackers to overwrite arbitrary files. This can result in information disclosure and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pypi.org/project/seffaflik/ - h
ial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pypi.org/project/seffaflik/ - https://github.com/nurisensoy/seffaflik - https://github.com/nurisensoy/seffaflik/issues/3
CVE ID: CVE-2025-61043 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:11:14.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read vulnerability has been discovered in Monkey's Audio 11.31, specifically in the CAPECharacterHelper::GetUTF16FromUTF8 function. The issue arises from improper handling of the length of the input UTF-8 string, causing the function to read past the memory boundary. This vulnerability may result in a crash or expose sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tzh00203.notion.site/Monkey-s-Audio-Out-of-Bounds-Read-Vulnerability-Report-version-11-31-249b5c52018
erences: - https://tzh00203.notion.site/Monkey-s-Audio-Out-of-Bounds-Read-Vulnerability-Report-version-11-31-249b5c52018a80739852d0d9660994c9?source=copy_link
CVE ID: CVE-2025-61044 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-16T19:49:28.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/2.md
CVE ID: CVE-2025-61045 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-21T20:03:46.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ilovekeer/IOT/blob/main/TOTOLINK/X18/setEasyMeshAgentCfg/1.md
CVE ID: CVE-2025-61080 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-28T20:03:28.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Clear2Pay Bank Visibility Application - Payment Execution 1.10.0.104 via the ID parameter in the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/willyc0de/f05b44696d66b4bc3276234171952bf2
CVE ID: CVE-2025-61084 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-13T13:57:52.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client wi
g occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-61084/README.md
CVE ID: CVE-2025-61087 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-03T19:02:48.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/shuvo-ahmed-sanin/ - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-2025-61087
CVE ID: CVE-2025-61096 State: PUBLISHED Published: 2025-10-02T00:00:00.000Z Last Updated: 2025-10-02T18:10:56.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/shuvo-ahmed-sanin/ - https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-2025-61096
CVE ID: CVE-2025-61099 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T17:08:55.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opaque.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted LS Update packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/pull/19480/commits/0042fbe8ca5aba866b4f0d166e54066bba5ab14e - https://github.com/FRRouting/frr/issues/19471 - https://github.com/s1a
ommits/0042fbe8ca5aba866b4f0d166e54066bba5ab14e - https://github.com/FRRouting/frr/issues/19471 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61099.md
CVE ID: CVE-2025-61100 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T17:08:10.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_opaque.c. This vulnerability allows attackers to cause a Denial of Service (DoS) under specific malformed LSA conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/cda5ddac0940562d1dca7cbef34d0ce5b00f160b - https://git
ssues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/cda5ddac0940562d1dca7cbef34d0ce5b00f160b - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61100.md
CVE ID: CVE-2025-61101 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T17:06:21.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com
9471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61101.md