Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the attack remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321860 - https://vuldb.com/?ctiid.321860 - https://vuldb.com/?submit.636956 - https://karinagante.github.io/cve-2025-9652/ - https://karinagante.github.io/cve-2025-9652/#proof-of-concept-poc
CVE ID: CVE-2025-9653 State: PUBLISHED Published: 2025-08-29T14:32:08.649Z Last Updated: 2025-08-29T21:04:29.224Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_projeto_cad.php of the component Cadastrar projeto Page. Such manipulation of the argument nome/observacao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrich
the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321861 - https://vuldb.com/?ctiid.321861 - https://vuldb.com/?submit.636957 - https://karinagante.github.io/cve-2025-9653/ - https://karinagante.github.io/cve-2025-9653/#proof-of-concept-poc
CVE ID: CVE-2025-9654 State: PUBLISHED Published: 2025-08-29T15:02:08.254Z Last Updated: 2025-08-29T15:31:42.932Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C) Vendors: AiondaDotCom Products: mcp-ssh Problem Types: CWE-77, CWE-74 Description: A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading to version 1.0.4 and 1.1.0 can resolve this issue. The patch is named cd2566a948b696501abfa6c6b03462cac5fb43d8. It is advisable to upgrade the affected component. Additional An
atch is named cd2566a948b696501abfa6c6b03462cac5fb43d8. It is advisable to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321862 - https://vuldb.com/?ctiid.321862 - https://vuldb.com/?submit.637028 - https://github.com/AiondaDotCom/mcp-ssh/commit/cd2566a948b696501abfa6c6b03462cac5fb43d8 - https://github.com/AiondaDotCom/mcp-ssh/commit/5b9b9c5b28d3f2672f356a790154ed68e17ef453
CVE ID: CVE-2025-9655 State: PUBLISHED Published: 2025-08-29T15:02:10.777Z Last Updated: 2025-08-29T15:29:57.181Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst N
e GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321863 - https://vuldb.com/?ctiid.321863 - https://vuldb.com/?submit.637131 - https://github.com/o2oa/o2oa/issues/172 - https://github.com/o2oa/o2oa/issues/172#issuecomment-3212882108
CVE ID: CVE-2025-9656 State: PUBLISHED Published: 2025-08-29T15:32:07.263Z Last Updated: 2025-08-29T16:01:57.874Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Directory Management System Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in PHPGurukul Directory Management System 2.0. This vulnerability affects unknown code of the file /admin/add-directory.php. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
en disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321864 - https://vuldb.com/?ctiid.321864 - https://vuldb.com/?submit.637137 - https://github.com/xiguala123/myCVE/issues/10 - https://phpgurukul.com/
CVE ID: CVE-2025-9657 State: PUBLISHED Published: 2025-08-29T15:32:09.592Z Last Updated: 2025-08-29T16:01:16.334Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fix
ic and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321865 - https://vuldb.com/?ctiid.321865 - https://vuldb.com/?submit.637218 - https://github.com/o2oa/o2oa/issues/173 - https://github.com/o2oa/o2oa/issues/173#issuecomment-3212881726 - https://github.com/o2oa/o2oa/issues/173#issue-3332925583
CVE ID: CVE-2025-9658 State: PUBLISHED Published: 2025-08-29T16:02:06.156Z Last Updated: 2025-08-29T17:00:59.021Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be
ished and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321866 - https://vuldb.com/?ctiid.321866 - https://vuldb.com/?submit.637221 - https://github.com/o2oa/o2oa/issues/174 - https://github.com/o2oa/o2oa/issues/174#issuecomment-3212881333 - https://github.com/o2oa/o2oa/issues/174#issue-3332928772
CVE ID: CVE-2025-9659 State: PUBLISHED Published: 2025-08-29T16:02:08.344Z Last Updated: 2025-08-29T17:00:05.084Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: n/a Products: O2OA Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in th
ay be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321867 - https://vuldb.com/?ctiid.321867 - https://vuldb.com/?submit.637235 - https://github.com/o2oa/o2oa/issues/175 - https://github.com/o2oa/o2oa/issues/175#issuecomment-3212881171 - https://github.com/o2oa/o2oa/issues/175#issue-3332931249
CVE ID: CVE-2025-9660 State: PUBLISHED Published: 2025-08-29T16:32:06.943Z Last Updated: 2025-08-29T16:59:21.843Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Bakeshop Online Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Bakeshop Online Ordering System 1.0. The impacted element is an unknown function of the file /passwordrecover.php. Performing manipulation of the argument phonenumber results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321868 - https://vuldb.com/?ctiid.321868 - https://vuldb.com/?submit.637236 - https://github.com/daimabiabia/cve/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9662 State: PUBLISHED Published: 2025-08-29T16:32:11.721Z Last Updated: 2025-08-29T16:58:31.195Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Grading System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel. Executing manipulation can lead to sql injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321869
osed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321869 - https://vuldb.com/?ctiid.321869 - https://vuldb.com/?submit.637252 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/ni7wnpx934yx9w9n?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-9663 State: PUBLISHED Published: 2025-08-29T17:02:09.571Z Last Updated: 2025-08-29T17:18:54.561Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Grading System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
y available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321870 - https://vuldb.com/?ctiid.321870 - https://vuldb.com/?submit.637254 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/akbe3fand5braskg?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-9664 State: PUBLISHED Published: 2025-08-29T17:02:14.440Z Last Updated: 2025-08-29T17:16:45.400Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Grading System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321871 - https://vuldb.com/?ctiid.321871 - https://vuldb.com/?submit.637255 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/hg9oefolxkpyof4l?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-9665 State: PUBLISHED Published: 2025-08-29T17:32:09.147Z Last Updated: 2025-08-29T18:11:45.764Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Grading System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_student.php of the component Admin Panel. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
loit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321872 - https://vuldb.com/?ctiid.321872 - https://vuldb.com/?submit.637256 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/lp1lt05iddgaigmv?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-9666 State: PUBLISHED Published: 2025-08-29T18:02:09.505Z Last Updated: 2025-08-29T18:21:23.697Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Grading System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects Simple Grading System 1.0. Affected by this issue is some unknown functionality of the file /delete_student.php of the component Admin Panel. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References
. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321873 - https://vuldb.com/?ctiid.321873 - https://vuldb.com/?submit.637257 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/uqhw0llf4ry9f2kk?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-9667 State: PUBLISHED Published: 2025-08-29T18:32:08.599Z Last Updated: 2025-08-29T19:10:27.465Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Grading System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown part of the file /delete_account.php of the component Admin Panel. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321874 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321874 - https://vuldb.com/?ctiid.321874 - https://vuldb.com/?submit.637258 - https://www.yuque.com/yuqueyonghuexlgkz/zepczx/xg9p65n9pvbpadoz?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-9669 State: PUBLISHED Published: 2025-08-29T19:02:06.121Z Last Updated: 2025-08-29T19:24:04.135Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Jinher Products: OA Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Jinher OA 1.0. This issue affects some unknown processing of the file GetTreeDate.aspx. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321876 - https://vuldb.com/?ctiid.321876 - https://vuldb.com/?subm
ADP Vulnrichment: References: - https://vuldb.com/?id.321876 - https://vuldb.com/?ctiid.321876 - https://vuldb.com/?submit.637413 - https://github.com/1276486/CVE/issues/1
CVE ID: CVE-2025-9670 State: PUBLISHED Published: 2025-08-29T19:02:08.787Z Last Updated: 2025-08-29T19:19:09.813Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: mixmark-io Products: turndown Problem Types: CWE-1333, CWE-400 Description: A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
sed to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321880 - https://vuldb.com/?ctiid.321880 - https://vuldb.com/?submit.637911 - https://github.com/mixmark-io/turndown/issues/501 - https://github.com/mixmark-io/turndown/issues/501#issue-3336342088
CVE ID: CVE-2025-9671 State: PUBLISHED Published: 2025-08-29T19:32:07.703Z Last Updated: 2025-08-29T19:47:00.322Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: UAB Products: Paytend App Problem Types: CWE-926 Description: A weakness has been identified in UAB Paytend App up to 2.1.9 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.passport.cash. Executing manipulation can lead to improper export of android application components. The attack needs to be launched locally. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure
ploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321881 - https://vuldb.com/?ctiid.321881 - https://vuldb.com/?submit.637922 - https://github.com/KMov-g/androidapps/blob/main/com.passport.cash.md - https://github.com/KMov-g/androidapps/blob/main/com.passport.cash.md#steps-to-reproduce
CVE ID: CVE-2025-9672 State: PUBLISHED Published: 2025-08-29T20:02:06.578Z Last Updated: 2025-08-29T20:19:41.334Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Rejseplanen App Problem Types: CWE-926 Description: A security vulnerability has been detected in Rejseplanen App up to 8.2.2. Affected is an unknown function of the file AndroidManifest.xml of the component de.hafas.android.rejseplanen. The manipulation leads to improper export of android application components. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did n
The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321882 - https://vuldb.com/?ctiid.321882 - https://vuldb.com/?submit.637924 - https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.rejseplanen.md - https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.rejseplanen.md#steps-to-reproduce
CVE ID: CVE-2025-9673 State: PUBLISHED Published: 2025-08-29T20:02:08.396Z Last Updated: 2025-08-29T20:18:10.056Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Kakao Products: 헤이카카오 Hey Kakao App Problem Types: CWE-926 Description: A vulnerability was detected in Kakao 헤이카카오 Hey Kakao App up to 2.17.4 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.kakao.i.connect. The manipulation results in improper export of android application components. The attack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disc
ack requires a local approach. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321883 - https://vuldb.com/?ctiid.321883 - https://vuldb.com/?submit.637925 - https://github.com/KMov-g/androidapps/blob/main/com.kakao.i.connect.md - https://github.com/KMov-g/androidapps/blob/main/com.kakao.i.connect.md#steps-to-reproduce
CVE ID: CVE-2025-9674 State: PUBLISHED Published: 2025-08-29T20:32:07.088Z Last Updated: 2025-09-03T15:54:53.603Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: Transbyte Products: Scooper News App Problem Types: CWE-926 Description: A flaw has been found in Transbyte Scooper News App up to 1.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.hatsune.eagleee. This manipulation causes improper export of android application components. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did n
l access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321884 - https://vuldb.com/?ctiid.321884 - https://vuldb.com/?submit.638068 - https://github.com/KMov-g/androidapps/blob/main/com.hatsune.eagleee.md - https://github.com/KMov-g/androidapps/blob/main/com.hatsune.eagleee.md#steps-to-reproduce
CVE ID: CVE-2025-9675 State: PUBLISHED Published: 2025-08-29T20:32:09.227Z Last Updated: 2025-09-03T15:54:38.911Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Voice Changer App Problem Types: CWE-926 Description: A vulnerability was determined in Voice Changer App up to 1.1.0. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.tuyangkeji.changevoice. Executing manipulation can lead to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA AD
tack on the local host. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321887 - https://vuldb.com/?ctiid.321887 - https://vuldb.com/?submit.638073 - https://github.com/KMov-g/androidapps/blob/main/com.tuyangkeji.changevoice.md - https://github.com/KMov-g/androidapps/blob/main/com.tuyangkeji.changevoice.md#steps-to-reproduce
CVE ID: CVE-2025-9676 State: PUBLISHED Published: 2025-08-29T21:02:05.597Z Last Updated: 2025-09-03T15:54:23.394Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: NCSOFT Products: Universe App Problem Types: CWE-926 Description: A vulnerability was identified in NCSOFT Universe App up to 1.3.0. Impacted is an unknown function of the file AndroidManifest.xml of the component com.ncsoft.universeapp. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond
xploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.321888 - https://vuldb.com/?ctiid.321888 - https://vuldb.com/?submit.638074 - https://github.com/KMov-g/androidapps/blob/main/com.ncsoft.universeapp.md - https://github.com/KMov-g/androidapps/blob/main/com.ncsoft.universeapp.md#steps-to-reproduce