Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5015 State: PUBLISHED Published: 2025-06-25T16:23:54.248Z Last Updated: 2025-06-25T20:09:56.654Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Parsons Products: Parsons Utility Enterprise Data Management, AclaraONE Utility Portal Problem Types: CWE-79 Description: A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-06
CVE ID: CVE-2025-5016 State: PUBLISHED Published: 2025-05-31T03:26:42.241Z Last Updated: 2025-06-02T15:50:21.107Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Relevanssi, msaari Products: Relevanssi – A Better Search (Pro), Relevanssi – A Better Search Problem Types: CWE-79 Description: The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute when
ng. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb2ade3-d5ce-4459-ab83-e28cd4c84922?source=cve - https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.24.5/lib/excerpts-highlights.php#L418
CVE ID: CVE-2025-5018 State: PUBLISHED Published: 2025-06-06T06:42:51.453Z Last Updated: 2025-06-06T16:09:10.713Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: hivesupport Products: Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress Problem Types: CWE-862 Description: The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read an
including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and overwrite the site’s OpenAI API key and inspection data or modify AI-chat prompts and behavior. This vulnerability is potentially a duplicate of CVE-2025-32208 or/and CVE-2025-32242. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95c8722e-07c3-4728-8723-4d4a6188fe5e?source=cve - https://wordpress.org/plugins/hive-support/#developers - https://plugins.trac.wordpress.org/browser/hive-support/tags/1.2.4/backend/class-hive-support-ajax.php#L9
CVE ID: CVE-2025-5019 State: PUBLISHED Published: 2025-06-06T06:42:49.240Z Last Updated: 2025-06-06T16:09:39.910Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: hivesupport Products: Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress Problem Types: CWE-352 Description: The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure t
tion on the hs_update_ai_chat_settings() function. This makes it possible for unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and to potentially redirect notifications or leak data to attacker-controlled endpoints via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50542e5e-da66-4223-a6bf-dc9381687ddd?source=cve - https://plugins.trac.wordpress.org/browser/hive-support/tags/1.2.4/backend/class-hive-support-chat-ajax.php#L146 - https://wordpress.org/plugins/hive-
.org/browser/hive-support/tags/1.2.4/backend/class-hive-support-chat-ajax.php#L146 - https://wordpress.org/plugins/hive-support/#developers - https://plugins.trac.wordpress.org/browser/hive-support/tags/1.2.4/backend/class-hive-support-chat-ajax.php#L9
CVE ID: CVE-2025-5020 State: PUBLISHED Published: 2025-05-21T17:18:08.510Z Last Updated: 2025-05-21T19:00:28.104Z Vendors: Mozilla Products: Firefox for iOS Problem Types: Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses Description: Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client This vulnerability affects Firefox for iOS < 139. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1951558 - https://www.mozill
Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1951558 - https://www.mozilla.org/security/advisories/mfsa2025-39/
CVE ID: CVE-2025-5022 State: PUBLISHED Published: 2025-07-10T08:33:47.296Z Last Updated: 2025-09-19T00:10:09.996Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Mitsubishi Electric Corporation Products: PV-DR004J, PV-DR004JA Problem Types: CWE-521 Description: Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to derive the password from the SSID. In addition, if the product is configured to enable the individual air c
lay unit) to derive the password from the SSID. In addition, if the product is configured to enable the individual air conditioner control function, an attacker who has access to the Wi-Fi communication between the units by exploiting this vulnerability may be able to execute ECHONET Lite commands to perform operations such as turning the air conditioner on or off and changing the set temperature. The individual air conditioner control function is available only in display unit version 02.00.01 or later and measurement unit version 02.03.01 or later. The affected products discontinued in 2015, support ended in 2020. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
iscontinued in 2015, support ended in 2020. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-007_en.pdf - https://jvn.jp/vu/JVNVU90283680/
CVE ID: CVE-2025-5023 State: PUBLISHED Published: 2025-07-10T08:34:13.758Z Last Updated: 2025-09-19T00:11:19.035Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Mitsubishi Electric Corporation Products: PV-DR004J, PV-DR004JA Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product (measurement unit and display unit) to disclose information such as generated power and electricity sold back to the grid stored in the product,
play unit) to disclose information such as generated power and electricity sold back to the grid stored in the product, tamper with or destroy stored or configured information in the product, or cause a Denial-of-Service (DoS) condition on the product, by using hardcoded user ID and password common to the product series obtained by exploiting CVE-2025-5022. The affected products discontinued in 2015, support ended in 2020. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-007_en.pdf - https://jvn.jp/vu/JVNVU90283680/
CVE ID: CVE-2025-5024 State: PUBLISHED Published: 2025-05-22T14:51:01.110Z Last Updated: 2025-11-20T21:09:47.476Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecom
ons Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support Problem Types: CWE-400 Description: A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which
r can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:10631 - https://access.redhat.com/errata/RHSA-2025:10635 - https://access.redhat.com/errata/RHSA-2025:10742 - https://access.redhat.com/errata/RHSA-2025:11403 - https://access.redhat.com/errata/RHSA-2025:11404 - https://access.redhat.com/errata/RHSA-2025:11405 - https://access.redhat.com/errata/RHSA-2025:11406 - https://access.redhat.com/errata/RHSA-2025
m/errata/RHSA-2025:11405 - https://access.redhat.com/errata/RHSA-2025:11406 - https://access.redhat.com/errata/RHSA-2025:11407 - https://access.redhat.com/errata/RHSA-2025:11408 - https://access.redhat.com/errata/RHSA-2025:11418 - https://access.redhat.com/security/cve/CVE-2025-5024 - https://bugzilla.redhat.com/show_bug.cgi?id=2367717 - https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/merge_requests/321
CVE ID: CVE-2025-5025 State: PUBLISHED Published: 2025-05-28T06:29:51.915Z Last Updated: 2025-05-30T16:19:53.775Z Vendors: curl Products: curl Problem Types: CWE-295 Improper Certificate Validation Description: libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC and HTTP/3. Since pinning makes the transfer succeed if the pin is fine, users could unwittingly connect to an impostor server without noticing. Additional Analyst Notes: - CVE Program Conta
e, users could unwittingly connect to an impostor server without noticing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2025-5025.json - https://curl.se/docs/CVE-2025-5025.html - https://hackerone.com/reports/3153497
CVE ID: CVE-2025-5026 State: REJECTED Published: N/A Last Updated: 2025-06-07T22:16:25.995Z Description: No description available.
CVE ID: CVE-2025-5028 State: PUBLISHED Published: 2025-07-11T06:40:28.636Z Last Updated: 2025-07-11T16:11:55.884Z Vendors: ESET, spol. s.r.o Products: ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security Premium, ESET Security Ultimate, ESET Endpoint Antivirus for Windows, ESET Endpoint Security for Windows, ESET Small Business Security, ESET Safe Server Problem Types: CWE-269 Description: Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.eset.com/en/ca8838-arbitrary-file-deletion-vulnerability-in-e
es: - CISA ADP Vulnrichment: References: - https://support.eset.com/en/ca8838-arbitrary-file-deletion-vulnerability-in-eset-product-installers-on-windows-fixed
CVE ID: CVE-2025-5029 State: PUBLISHED Published: 2025-05-21T14:31:09.477Z Last Updated: 2025-05-21T14:40:03.901Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: Kingdee Products: Cloud Galaxy Private Cloud BBC System Problem Types: CWE-22 Description: A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnerability is the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file fileUpload/deleteFileAction.jhtml of the component File Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit ha
. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309847 - https://vuldb.com/?ctiid.309847 - https://vuldb.com/?submit.570956 - https://wx.mail.qq.com/s?k=nFbp0U0gSX0QVechIO - https://vip.kingdee.com/knowledge/708656434111770368 - https://vip.kingdee.com/school/detail/713028702245944320?productLineId=1&lang=zh-CN
CVE ID: CVE-2025-5030 State: PUBLISHED Published: 2025-05-21T16:31:04.911Z Last Updated: 2025-05-21T19:51:50.194Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: Ackites Products: KillWxapkg Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be use
ck is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309850 - https://vuldb.com/?ctiid.309850 - https://vuldb.com/?submit.580526 - https://github.com/Ackites/KillWxapkg/issues/85 - https://github.com/Ackites/KillWxapkg/issues/85#issue-3052039180
CVE ID: CVE-2025-5031 State: PUBLISHED Published: 2025-05-21T17:00:06.316Z Last Updated: 2025-05-21T19:52:23.194Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Ackites Products: KillWxapkg Problem Types: CWE-400, CWE-404 Description: A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the component wxapkg File Decompression Handler. The manipulation leads to resource consumption. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Addition
high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309851 - https://vuldb.com/?ctiid.309851 - https://vuldb.com/?submit.580524 - https://github.com/Ackites/KillWxapkg/issues/86 - https://github.com/Ackites/KillWxapkg/issues/86#issue-3053628148
CVE ID: CVE-2025-5032 State: PUBLISHED Published: 2025-05-21T17:00:08.735Z Last Updated: 2025-05-21T19:51:55.426Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Shopping Portal Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/edit-category.php. The manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309852 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309852 - https://vuldb.com/?ctiid.309852 - https://vuldb.com/?submit.580601 - https://github.com/xiaoyuxiaoyuqwq/cve/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-5033 State: PUBLISHED Published: 2025-05-21T17:31:08.169Z Last Updated: 2025-05-21T19:03:16.523Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: XiaoBingby Products: TeaCMS Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/me/teacms/controller/admin/UserManageController/addUser. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.309853 - https://vuldb.com/?ctiid.309853 - https://vuldb.com/?submit.580729 - https://gitee.com/xiaobingby/TeaCMS/issues/IBYRPK
CVE ID: CVE-2025-5034 State: PUBLISHED Published: 2025-06-21T06:00:08.917Z Last Updated: 2025-06-23T20:13:53.719Z Vendors: Unknown Products: wp-file-download Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ebd9aa9f-3da9-4457-922f-975bef6e33f8/
CVE ID: CVE-2025-5035 State: PUBLISHED Published: 2025-06-27T06:00:03.026Z Last Updated: 2025-06-27T14:31:50.266Z Vendors: Unknown Products: Firelight Lightbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5dca30af-4624-4a71-93be-00fa8dc00c97/
CVE ID: CVE-2025-5036 State: PUBLISHED Published: 2025-06-02T16:55:54.002Z Last Updated: 2025-08-19T13:15:04.359Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit Problem Types: CWE-416 Description: A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-adviso
eferences: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0009
CVE ID: CVE-2025-5037 State: PUBLISHED Published: 2025-07-10T11:30:47.004Z Last Updated: 2025-08-19T13:15:53.519Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit Problem Types: CWE-120 Description: A maliciously crafted RFA, RTE, or RVT file, when parsed through Autodesk Revit, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0012
CVE ID: CVE-2025-5038 State: PUBLISHED Published: 2025-07-29T17:51:59.877Z Last Updated: 2025-09-25T18:36:58.792Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Shared Components, AutoCAD, AutoCAD Architecture, AutoCAD Electrical, AutoCAD MAP 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, Civil 3D, Advance Steel Problem Types: CWE-120 Description: A maliciously crafted X_T file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment:
ity to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0015
CVE ID: CVE-2025-5039 State: PUBLISHED Published: 2025-07-24T17:11:14.714Z Last Updated: 2025-08-19T13:17:42.116Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D, AutoCAD MAP 3D, Civil 3D, Advance Steel, RealDWG Problem Types: CWE-426 Description: A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
rrent process due to an untrusted search path being utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0014
CVE ID: CVE-2025-5040 State: PUBLISHED Published: 2025-07-10T11:31:19.454Z Last Updated: 2025-08-19T13:17:58.621Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Revit Problem Types: CWE-122 Description: A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories
ences: - https://www.autodesk.com/products/autodesk-access/overview - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0012