Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
I command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ricardojoserf/emqx-RCE - https://docs.emqx.com/en/emqx/latest/dashboard/introduction.html - https://docs.emqx.com/en/emqx/latest/deploy/install-docker.html
CVE ID: CVE-2025-52159 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T20:17:37.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in default configuration of PPress 0.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/quarter77/PPress-CMS-session-forgery-SSTI-vulnerability-leads-to-remote-command-execution - https://github.com/quarter77/PPress-CMS_vulnerability_chain_details/blob/main/CVE-2025-52159%20Details.md
CVE ID: CVE-2025-52161 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T17:40:34.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://scholl.com - http://weblication.com - https://herolab.usd.de/security-advisories/usd-2025-0031/
CVE ID: CVE-2025-52162 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:36:08.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agorum.com - https://herolab.usd.de/security-advisories/usd-2025-0024/
CVE ID: CVE-2025-52163 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:44:14.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agorum.com - https://herolab.usd.de/security-advisories/usd-2025-0025/
CVE ID: CVE-2025-52164 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:38:51.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agorum.com - https://herolab.usd.de/security-advisories/usd-2025-0023/
CVE ID: CVE-2025-52166 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:40:37.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agorum.com - https://herolab.usd.de/usd-2025-0028/
CVE ID: CVE-2025-52168 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:37:30.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agorum.com - https://herolab.usd.de/security-advisories/usd-2025-0022/
CVE ID: CVE-2025-52169 State: PUBLISHED Published: 2025-07-18T00:00:00.000Z Last Updated: 2025-07-18T18:47:11.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://agorum.com - https://herolab.usd.de/security-advisories/usd-2025-0026/
CVE ID: CVE-2025-52179 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-11-03T20:36:53.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zucchetti.it/ - https://gist.github.com/alex-xor/8d0f9f456e6840a955889305ea789ef8
CVE ID: CVE-2025-52180 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-31T19:32:37.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zucchetti.it/ - https://gist.github.com/alex-xor/8d0f9f456e6840a955889305ea789ef8
CVE ID: CVE-2025-52184 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T16:17:40.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/gmrvh/947e517f263245b13abcc63226907f4f - https://gist.github.com/gmrvh/eeb6aa8b379c7ad3860d78ee054f6123
CVE ID: CVE-2025-52186 State: PUBLISHED Published: 2025-11-13T00:00:00.000Z Last Updated: 2025-11-13T17:18:04.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/3165242 - https://github.com/lichess-org/lila/commit/11b4c0fb00f0ffd8232346f839627005459c8f0
tps://hackerone.com/reports/3165242 - https://github.com/lichess-org/lila/commit/11b4c0fb00f0ffd8232346f839627005459c8f05c
CVE ID: CVE-2025-52187 State: PUBLISHED Published: 2025-07-30T00:00:00.000Z Last Updated: 2025-11-03T20:05:46.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my_profile_update_form1.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/GetProjectsIdea/Create-School-Management-System-with-PHP-MySQL - https://medium.com/@sanjay70023/cve-2025-52187-stored-xss-in-school-management-system-php-mysql-79cadcd6340f
CVE ID: CVE-2025-52194 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:56:46.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libsndfile/libsndfile/issues/1082 - https://github.com/libsndfile - https://bushido-sec.com/index.php/2025/08/08/libsndfile-buffe
e/libsndfile/issues/1082 - https://github.com/libsndfile - https://bushido-sec.com/index.php/2025/08/08/libsndfile-buffer-overflow/
CVE ID: CVE-2025-52203 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T17:27:13.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are subsequently stored in the database. When a legitimate user logs in and is redirected to the Dashboard panel "automatically upon authentication the malicious script executes in the user's browser context. Additional Analyst Not
l "automatically upon authentication the malicious script executes in the user's browser context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/devaslanphp/project-management/releases - https://github.com/ischyr/research-and-development/tree/main/CVE-2025-52203
CVE ID: CVE-2025-52207 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T18:35:52.191Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: MIKO Products: MikoPBX Problem Types: CWE-23 Description: PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mikopbx.com/ - https://github.com/mikopbx/Core/commit/3ee785429d3f1b33c9ab387ef4221127c9b8c5f3
CVE ID: CVE-2025-52217 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:16:00.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selectzero.io/change-log/
CVE ID: CVE-2025-52218 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-27T14:12:55.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allows attackers to inject arbitrary text or limited HTML into the login page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selectzero.io/change-log/
CVE ID: CVE-2025-52219 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-26T16:07:34.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary external links via HTML Injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://selectzero.io/change-log/
CVE ID: CVE-2025-52237 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-05T20:48:22.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://sscms.com - https://gist.github.com/CTRLCCT/c9b5aab78a179a2d92a41889a588c933
CVE ID: CVE-2025-52239 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-04T19:31:04.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://shenzhen.com - http://zkeacms.com - https://github.com/CTRLCCT/BoolSpideer/blob/main/cve2.md
CVE ID: CVE-2025-52263 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T15:56:53.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.starcharge.com/product/artemis/ - https://github.com/HaToan/CVEs/blob/main/starcharge/README.md
CVE ID: CVE-2025-52264 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-30T14:14:22.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.starcharge.com/product/artemis/ - https://github.com/HaToan/CVEs/blob/main/starcharge/README.md
CVE ID: CVE-2025-52268 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T19:46:32.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.starcharge.com/product/artemis/ - https://github.com/HaToan/CVEs/blob/main/starcharge/README.md
CVE ID: CVE-2025-52277 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:46:22.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://yeswiki.com - https://github.com/nakkouchtarek/CVE/tree/main/CVE-2025-52277
CVE ID: CVE-2025-52284 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-09-15T14:48:12.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/setNtpCfg-20e8aff2dc8b80a3afafef36b48f7496 - https://github.com/w0rkd4tt/Totolink
CVE ID: CVE-2025-52287 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T18:54:14.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChangeYourWay/post/blob/main/ELite - https://gist.github.com/ChangeYourWay/5bf54a234611f14fba1af03ad91e62f8
CVE ID: CVE-2025-52288 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T20:45:05.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in Open5GS thru 2.7.5 allowing attackers to cause a denial of service or other unspecified impacts via repeated UE connect and disconnect message sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/3862 - https://github.com/open5gs/open5gs/issues/3862#issuecomment-2853458783 - https://github.com/open5gs/
en5gs/issues/3862 - https://github.com/open5gs/open5gs/issues/3862#issuecomment-2853458783 - https://github.com/open5gs/open5gs/issues/3862#issue-3006335547 - https://github.com/matejGradisar/open5gs/commit/5467da9763c300520f56bfbe0a7f5a7f980ec2f6 - https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-52288
CVE ID: CVE-2025-52289 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T15:48:06.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/magnussolution/magnusbilling7/commit/f886330e9e9216a3830775610a4a83f970c08e8d - https://github.com/Madhav-Bhardwaj/CVE-2025-52289
CVE ID: CVE-2025-52294 State: PUBLISHED Published: 2025-07-01T00:00:00.000Z Last Updated: 2025-07-01T19:55:20.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/3K4kt713
CVE ID: CVE-2025-52322 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:46:16.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), using the IP address of a legitimate UE in the PDN Address Allocation (PAA) field Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/discussions/3919 - https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-52322
CVE ID: CVE-2025-52327 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-04T16:54:51.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://restaurant.com - https://code-projects.org/real-estate-property-management-system-php-source-code/ - https://gist.github.com/babapihai/d604a43d884a9e20c234f33865584db4
CVE ID: CVE-2025-52331 State: PUBLISHED Published: 2025-11-12T00:00:00.000Z Last Updated: 2025-11-12T21:34:37.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report. Additional Analyst Notes: - CI
ction is required. User must use the "generate report" functionality and open the report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rarlab.com/rarnew.htm - https://gist.github.com/MarcinB44/2150484497c4b34aedf682c9091b14fa - https://www.win-rar.com/whatsnew.html
CVE ID: CVE-2025-52335 State: PUBLISHED Published: 2025-08-14T00:00:00.000Z Last Updated: 2025-08-15T16:38:18.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://eyoucms.com - https://sour-burglar-bfe.notion.site/CVE-2025-52335-24e2b2fd021080da9667e7608c801180
CVE ID: CVE-2025-52337 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T20:11:35.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5.0.9.7000 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/434.html - https://nvd.nist.gov/vuln/detail/CVE-2022-22947 - https://github.com/TrustStackSecurity/Advisories/blob/main/CVE-2025-52337/README.md
CVE ID: CVE-2025-52338 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T20:09:50.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/522.html - https://cwe.mitre.org/data/definitions/521.html - https://www.logicdata.com/products/webstore-for-erp-ecommerce-integration/ - https://github.com/TrustStackSecurity/Advisories/tree/main/CVE-2025-52338
CVE ID: CVE-2025-52344 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T17:50:40.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the Group name and Project Description input fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.explorance.com/products/blue - https://gist.github.com/SaraAlsaif/f363b307f29c865d499678eca3106b43
CVE ID: CVE-2025-52351 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T20:02:42.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL (e.g., https://domain.com/activate=xyz). This practice can result in password exposure via browser history, proxy logs, referrer headers, and email caching. The vulnerability impacts user credential confidentiality during initial onboarding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
confidentiality during initial onboarding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aikaan.io - https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve3-activation-link-password.md
CVE ID: CVE-2025-52352 State: PUBLISHED Published: 2025-08-21T00:00:00.000Z Last Updated: 2025-08-21T19:56:40.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to register accounts via APIs even when the feature is disabled. This leads to authentication bypass and unauthorized access to admin portals, violating intended access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ed access to admin portals, violating intended access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aikaan.io - https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve4-signup-api-bypass.md
CVE ID: CVE-2025-52353 State: PUBLISHED Published: 2025-08-26T00:00:00.000Z Last Updated: 2025-08-28T16:31:44.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension. Additional Analyst