Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9846 State: PUBLISHED Published: 2025-09-23T12:31:19.499Z Last Updated: 2025-09-23T13:40:42.165Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TalentSys Consulting Information Technology Industry Inc. Products: Inka.Net Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection.This issue affects Inka.Net: before 6.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0288
CVE ID: CVE-2025-9847 State: PUBLISHED Published: 2025-09-03T01:02:07.659Z Last Updated: 2025-09-03T20:23:04.907Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: ScriptAndTools Products: Real Estate Management System Problem Types: CWE-434, CWE-284 Description: A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php. This manipulation of the argument uimage causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
ilable to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322196 - https://vuldb.com/?ctiid.322196 - https://vuldb.com/?submit.641970 - https://www.websecurityinsights.my.id/2025/08/real-estate-management-system-v-10.html
CVE ID: CVE-2025-9848 State: PUBLISHED Published: 2025-09-03T01:02:10.151Z Last Updated: 2025-09-03T20:16:02.907Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: ScriptAndTools Products: Real Estate Management System Problem Types: CWE-698, CWE-705 Description: A security vulnerability has been detected in ScriptAndTools Real Estate Management System 1.0. The affected element is an unknown function of the file /admin/userlist.php. Such manipulation leads to execution after redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
closed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322197 - https://vuldb.com/?ctiid.322197 - https://vuldb.com/?submit.641980 - https://www.websecurityinsights.my.id/2025/08/real-estate-management-system-v-10-user.html
CVE ID: CVE-2025-9849 State: PUBLISHED Published: 2025-09-06T01:45:17.964Z Last Updated: 2025-09-08T14:05:46.388Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: alimuzzamanalim Products: Html Social share buttons Problem Types: CWE-79 Description: The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d11217ec-55a6-4422-9995-4cc1761d430e?source=cve - https://plugins.trac.wordpress.org/browser/html-social-share-buttons/trunk/html-social-share.php#L304 - https://github.com/alimuzzaman/html-social-share-buttons/blob/a614c9ce5731417edcf01747eacd814c754cc2d4/html-social-share.php#L307 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3355844%40html-social-share-buttons&new=3355
://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3355844%40html-social-share-buttons&new=3355844%40html-social-share-buttons&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2025-9850 State: PUBLISHED Published: 2025-09-11T07:24:51.793Z Last Updated: 2025-09-11T14:40:49.143Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: evenium Products: Evenium Problem Types: CWE-79 Description: The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and including, 1.3.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/394732cc-94b5-4fbf-bd78-da18791724be?source=cve - https://plugins.trac.wordpress.org/browser/evenium/trunk/src/evenium_quicktags.php#L27
CVE ID: CVE-2025-9851 State: PUBLISHED Published: 2025-09-17T01:49:15.904Z Last Updated: 2025-09-19T13:04:32.951Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gentlesource Products: Appointmind Problem Types: CWE-79 Description: The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65d965ac-66ae-4c23-b9c2-335b93a140d9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3359404%40appointmind&new=3359404%40appointmind&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9852 State: PUBLISHED Published: 2025-09-30T03:35:27.088Z Last Updated: 2025-09-30T15:25:17.348Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: momostefan Products: Yoga Schedule Momoyoga Problem Types: CWE-79 Description: The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-schedule' shortcode in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/745da770-dd78-4ffb-ae15-4b90682911e3?source=cve - https://plugins.trac.wordpress.org/browser/momoyoga-integration/tags/2.9.0/momoyoga-schedule.php#L56
CVE ID: CVE-2025-9853 State: PUBLISHED Published: 2025-09-06T02:24:18.938Z Last Updated: 2025-09-08T20:15:20.184Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: optio Products: Optio Dentistry Problem Types: CWE-79 Description: The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fda48e-cd19-469e-8a73-fd933752d03c?source=cve - https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.2/optio-dentistry.php#L92 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3355511%40optio-dentistry&new=3355511%40optio-dentistry&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9854 State: PUBLISHED Published: 2025-10-03T11:17:14.351Z Last Updated: 2025-10-03T14:57:18.633Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: piupiiu Products: A Simple Multilanguage Plugin Problem Types: CWE-79 Description: The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77033d00-f794-4dbe-9454-17c312855491?source=cve - https://plugins.trac.wordpress.org/browser/a-simple-multilanguage/trunk/a-simple-multilang.php#L315
CVE ID: CVE-2025-9855 State: PUBLISHED Published: 2025-09-11T07:25:02.565Z Last Updated: 2025-09-11T14:37:05.715Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zuotian Products: Enhanced BibliPlug Problem Types: CWE-79 Description: The Enhanced BibliPlug plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bibliplug_authors' shortcode in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efd5ce76-2f93-45f9-9822-b0f8b6fcff0b?source=cve - https://plugins.trac.wordpress.org/browser/enhanced-bibliplug/trunk/bibliplug.php#L293
CVE ID: CVE-2025-9857 State: PUBLISHED Published: 2025-09-10T06:38:51.180Z Last Updated: 2025-09-10T15:06:57.065Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: heateor Products: Heateor Login – Social Login Plugin Problem Types: CWE-79 Description: The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heateor_Facebook_Login' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d106d581-d711-44ac-b85a-c43aad727eeb?source=cve - https://plugins.trac.wordpress.org/browser/heateor-login/tags/1.1.9/shortcode.php#L24 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3357088%40heateor-login&new=3357088%40heateor-login&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9858 State: PUBLISHED Published: 2025-10-03T11:17:20.264Z Last Updated: 2025-10-03T13:59:29.893Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mtoolstec Products: Auto Bulb Finder for WordPress Problem Types: CWE-79 Description: The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c141af66-ebf6-4a80-8dfd-47a586342676?source=cve - https://plugins.trac.wordpress.org/browser/auto-bulb-finder-for-wp-wc/tags/2.8.0/includes/blocks/custom-block.php#L45
CVE ID: CVE-2025-9859 State: PUBLISHED Published: 2025-10-03T11:17:18.347Z Last Updated: 2025-10-03T14:04:43.575Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ambitioncloud Products: Fintelligence Calculator Problem Types: CWE-79 Description: The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbe89d0-4b0a-40d6-b1a0-3faf9550ec5c?source=cve - https://plugins.trac.wordpress.org/browser/fintelligence-calculator/tags/1.0.3/src/inc/class-register-shortcodes.php#L93
CVE ID: CVE-2025-9860 State: PUBLISHED Published: 2025-09-11T07:24:56.169Z Last Updated: 2025-09-11T14:39:07.804Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: natata7 Products: Mixtape Problem Types: CWE-79 Description: The Mixtape plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mixtape' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Add
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/863d59d5-ae74-4fc7-82fb-3039743af4b8?source=cve - https://plugins.trac.wordpress.org/browser/mixtape/tags/1.1/src/class-mixtape-front.php#L75
CVE ID: CVE-2025-9861 State: PUBLISHED Published: 2025-09-11T07:24:51.088Z Last Updated: 2025-09-11T14:41:07.861Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: livingos Products: ThemeLoom Widgets Problem Types: CWE-79 Description: The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/327b7a35-59fc-4971-9d3f-10665e1725f7?source=cve - https://plugins.trac.wordpress.org/browser/themeloom-widgets/trunk/show-widgets.php#L402
CVE ID: CVE-2025-9862 State: PUBLISHED Published: 2025-09-17T15:02:01.533Z Last Updated: 2025-09-17T15:42:32.020Z Vendors: Ghost Products: Ghost Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/regida - https://github.com/TryGhost/Ghost - https://github.com/TryGhost/Ghost/releases/tag/v6.0.9 - https://github.com/TryGhost/Ghost/security/advisories/GHSA-f7qg-xj45-w956
CVE ID: CVE-2025-9864 State: REJECTED Published: 2025-09-03T16:17:47.461Z Last Updated: 2025-11-13T17:21:51.881Z Description: No description available.
CVE ID: CVE-2025-9865 State: PUBLISHED Published: 2025-09-03T16:17:47.885Z Last Updated: 2025-09-03T17:13:23.687Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/437147699
CVE ID: CVE-2025-9866 State: PUBLISHED Published: 2025-09-03T16:17:48.331Z Last Updated: 2025-09-04T03:55:43.948Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/379337758
CVE ID: CVE-2025-9867 State: PUBLISHED Published: 2025-09-03T16:17:48.687Z Last Updated: 2025-09-03T17:17:14.116Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/415496161
CVE ID: CVE-2025-9868 State: PUBLISHED Published: 2025-10-08T17:07:45.543Z Last Updated: 2025-10-08T17:23:36.055Z Vendors: Sonatype Products: Nexus Repository Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.sonatype.com/hc/en-us/articles/45363201583635
CVE ID: CVE-2025-9869 State: PUBLISHED Published: 2025-10-29T19:33:09.764Z Last Updated: 2025-10-31T03:55:17.747Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Razer Products: Synapse 3 Problem Types: CWE-59 Description: Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Razer Synapse Service. By creating a symbolic link, an attacker can abuse the
lity. The specific flaw exists within the Razer Synapse Service. By creating a symbolic link, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26374. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-919/
CVE ID: CVE-2025-9870 State: PUBLISHED Published: 2025-10-29T19:34:08.192Z Last Updated: 2025-10-31T03:55:18.777Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Razer Products: Synapse 3 Problem Types: CWE-59 Description: Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Philips HUE module installer. By creating a symbolic link, an atta
is vulnerability. The specific flaw exists within the Philips HUE module installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26375. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-921/
CVE ID: CVE-2025-9871 State: PUBLISHED Published: 2025-10-29T19:33:46.072Z Last Updated: 2025-10-30T14:37:08.224Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Razer Products: Synapse 3 Problem Types: CWE-59 Description: Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abu
bility. The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-920/
CVE ID: CVE-2025-9872 State: PUBLISHED Published: 2025-09-09T15:11:13.957Z Last Updated: 2025-09-10T03:56:11.807Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-434 Description: Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8