Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
es function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to read arbitrary files. If allow_url_include is enabled on the server, remote code execution is possible. While the vendor patched this issue in version 6.1.0, the patch caused a fatal error in the vulnerable code, due to a missing class import, so we consider 6.1.2 to be the most complete and best patched version Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/938e5d6b-1ad6-4021-a148-1d1c9e8a0a83?source=cve - https://plugins.trac.word
ordfence.com/threat-intel/vulnerabilities/id/938e5d6b-1ad6-4021-a148-1d1c9e8a0a83?source=cve - https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/app/Services/FormBuilder/EditorShortcodeParser.php#L214 - https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/vendor/wpfluent/framework/src/WPFluent/View/View.php#L7
CVE ID: CVE-2025-9262 State: PUBLISHED Published: 2025-08-20T23:02:07.020Z Last Updated: 2025-08-21T14:47:26.808Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: wong2 Products: mcp-cli Problem Types: CWE-78, CWE-77 Description: A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early ab
xploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320804 - https://vuldb.com/?ctiid.320804 - https://vuldb.com/?submit.631697 - https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e - https://gist.github.com/superboy-zjc/a01bd059c4078249d899f8c70c8feb0e#proof-of-concept
CVE ID: CVE-2025-9263 State: PUBLISHED Published: 2025-08-20T23:02:09.629Z Last Updated: 2025-08-21T14:47:19.732Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Xuxueli Products: xxl-job Problem Types: CWE-99 Description: A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320805 - https://vuldb.com/?ctiid.320805 - https://vuldb.com/?submit.631704 - https://github.com/xuxueli/xxl-job/issues/3772 - https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205
CVE ID: CVE-2025-9264 State: PUBLISHED Published: 2025-08-20T23:32:06.406Z Last Updated: 2025-08-21T14:47:12.747Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Xuxueli Products: xxl-job Problem Types: CWE-99 Description: A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP
ion of the attack is possible. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320806 - https://vuldb.com/?ctiid.320806 - https://vuldb.com/?submit.631728 - https://github.com/xuxueli/xxl-job/issues/3773 - https://github.com/xuxueli/xxl-job/issues/3773#issue-3308389841
CVE ID: CVE-2025-9265 State: PUBLISHED Published: 2025-10-13T06:57:45.195Z Last Updated: 2025-10-14T13:19:43.818Z Vendors: Kiloview Products: NDI Problem Types: CWE-346, CWE-290, CWE-287 Description: A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version later than 2.02.0246 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kiloview.com/en/support/download/n30-firmware-downloadlatest/
CVE ID: CVE-2025-9267 State: PUBLISHED Published: 2025-09-26T12:27:51.651Z Last Updated: 2025-09-29T14:37:53.583Z Vendors: Seagate Products: Toolkit Problem Types: CWE-427, CWE-426 Description: In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relati
he user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relative paths or failing to specify fully qualified paths when invoking system libraries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.seagate.com/product-security/#security-advisories - https://www.seagate.com/support/software/toolkit/
CVE ID: CVE-2025-9269 State: PUBLISHED Published: 2025-09-09T17:21:36.589Z Last Updated: 2025-09-29T15:34:06.094Z Vendors: Lexmark Products: CX, XC, CS, MS, MX, XM, et. al. Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/secur
a device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2025-9273 State: PUBLISHED Published: 2025-09-02T20:00:19.498Z Last Updated: 2025-09-03T15:54:08.453Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: CData Products: API Server Problem Types: CWE-552 Description: CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the usage of MySQL connections. When connecting to a MySQL server, the product enables an option that gives the MySQL server permission to request lo
s. When connecting to a MySQL server, the product enables an option that gives the MySQL server permission to request local files from the MySQL client. An attacker can leverage this vulnerability to disclose information in the context of NETWORK SERVICE. Was ZDI-CAN-23950. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-852/
CVE ID: CVE-2025-9274 State: PUBLISHED Published: 2025-09-02T20:00:30.483Z Last Updated: 2025-09-03T18:06:19.869Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Oxford Instruments Products: Imaris Viewer Problem Types: CWE-824 Description: Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IMS fil
the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21657. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-853/
CVE ID: CVE-2025-9275 State: PUBLISHED Published: 2025-09-02T20:00:41.647Z Last Updated: 2025-09-03T15:34:05.836Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Oxford Instruments Products: Imaris Viewer Problem Types: CWE-787 Description: Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IMS files
he target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21655. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-854/
CVE ID: CVE-2025-9276 State: PUBLISHED Published: 2025-09-02T20:00:51.838Z Last Updated: 2025-09-03T15:32:42.164Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cockroach Labs Products: cockroach-k8s-request-cert Problem Types: CWE-258 Description: Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image. The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the ro
aw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-855/
CVE ID: CVE-2025-9277 State: PUBLISHED Published: 2025-08-26T22:26:50.814Z Last Updated: 2025-08-27T20:43:20.115Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: softaculous Products: SiteSEO – SEO Simplified Problem Types: CWE-79 Description: The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c7cca2-94d2-4a86-bc69-d7b2b0f068ba?source=cve - https://plugins.trac.wordpress.org/browser/siteseo/tags/1.2.6/main/advanced.php#L80
CVE ID: CVE-2025-9286 State: PUBLISHED Published: 2025-10-03T11:17:10.009Z Last Updated: 2025-10-03T18:03:05.831Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: hancock11 Products: Appy Pie Connect for WooCommerce Problem Types: CWE-620 Description: The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access. Additional Analyst Notes: - CISA A
of arbitrary users, including administrators, thereby gaining administrative access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/36fb5b8d-1ea4-45c2-8639-b229efdb57db?source=cve - https://plugins.trac.wordpress.org/browser/appy-pie-connect-for-woocommerce/trunk/connect-woocommerce-rest-api.php - https://wordpress.org/plugins/appy-pie-connect-for-woocommerce/
CVE ID: CVE-2025-9287 State: PUBLISHED Published: 2025-08-20T21:43:56.548Z Last Updated: 2025-11-03T18:14:17.043Z Problem Types: CWE-20 Description: Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/browserify/cipher-base/security/advisories/GHSA-cpq7-6gpm-g9rc - https://github.com/browserify/cipher-base/pull/23
CVE ID: CVE-2025-9288 State: PUBLISHED Published: 2025-08-20T21:59:44.728Z Last Updated: 2025-11-03T18:14:17.994Z Problem Types: CWE-20 Description: Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/browserify/sha.js/security/advisories/GHSA-95m3-7q98-8xr5 - https://github.com/browserify/sha.js/pull/78 - https://www.cve.org/CVERecord?id=CVE-2025-9287
CVE ID: CVE-2025-9296 State: PUBLISHED Published: 2025-08-21T11:32:06.019Z Last Updated: 2025-08-21T13:43:32.800Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Emlog Pro Problem Types: CWE-434, CWE-284 Description: A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes
y be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320901 - https://vuldb.com/?ctiid.320901 - https://vuldb.com/?submit.631923 - https://github.com/lan041221/cvec/issues/8
CVE ID: CVE-2025-9297 State: PUBLISHED Published: 2025-08-21T12:02:11.484Z Last Updated: 2025-08-21T13:24:53.066Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: i22 Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. Performing manipulation of the argument Type results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320902 - https://vuldb.com/?ctiid.320902 - https://v
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320902 - https://vuldb.com/?ctiid.320902 - https://vuldb.com/?submit.632332 - https://github.com/davybat/IoT-Vuls/blob/main/tenda/formWeixinAuthInfoGet.md - https://github.com/davybat/IoT-Vuls/blob/main/tenda/formWeixinAuthInfoGet.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-9298 State: PUBLISHED Published: 2025-08-21T12:32:08.707Z Last Updated: 2025-08-21T13:23:24.023Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: M3 Problem Types: CWE-121, CWE-119 Description: A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation of the argument PPPOEPassword can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320903 - https://vuldb.com/?ctiid.320903 - https://vuldb.com/?s
SA ADP Vulnrichment: References: - https://vuldb.com/?id.320903 - https://vuldb.com/?ctiid.320903 - https://vuldb.com/?submit.632335 - https://github.com/davybat/IoT-Vuls/blob/main/tenda/formQuickIndex.md - https://github.com/davybat/IoT-Vuls/blob/main/tenda/formQuickIndex.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-9299 State: PUBLISHED Published: 2025-08-21T12:32:12.049Z Last Updated: 2025-08-21T13:22:06.848Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: M3 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The manipulation of the argument Time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320904 - https://vuldb.com/?ctiid.320904 - https://vuldb.com/?submit.632336 - https://github.com/davybat/IoT-Vuls/blob/main/tenda/formGetMasterPassengerAnalyseData.md - https://github.com/davybat/IoT-Vuls/blob/main/tenda/formGetMasterPassengerAnalyseData.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-9300 State: PUBLISHED Published: 2025-08-21T13:02:08.108Z Last Updated: 2025-08-21T14:46:37.782Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: saitoha Products: libsixel Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying
t has been made public and could be used. The patch is identified as 316c086e79d66b62c0c4bc66229ee894e4fdb7d1. Applying a patch is advised to resolve this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320905 - https://vuldb.com/?ctiid.320905 - https://vuldb.com/?submit.632366 - https://github.com/saitoha/libsixel/issues/200 - https://github.com/saitoha/libsixel/issues/200#issuecomment-3178785635 - https://drive.google.com/file/d/1IIvvRFgUQZcySqeoqXXhsxd0HZCjClJ7/view?usp=sharing - https://github.com/saitoha/libsixel/commit/316c086e79d66b62c0c4bc66229ee894e4fdb7d1
CVE ID: CVE-2025-9301 State: PUBLISHED Published: 2025-08-21T13:32:08.995Z Last Updated: 2025-08-21T13:49:58.107Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: n/a Products: cmake Problem Types: CWE-617 Description: A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue. Additional Analy
me: 37e27f71bc356d880c908040cd0cb68fa2c371b8. It is suggested to install a patch to address this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320906 - https://vuldb.com/?ctiid.320906 - https://vuldb.com/?submit.632369 - https://gitlab.kitware.com/cmake/cmake/-/issues/27135 - https://gitlab.kitware.com/cmake/cmake/-/issues/27135#note_1691629 - https://drive.google.com/file/d/1TerUqQB8_lzJTwIBCBmE94zn7n-gOz4f/view?usp=sharing - https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8
CVE ID: CVE-2025-9302 State: PUBLISHED Published: 2025-08-21T14:02:06.977Z Last Updated: 2025-08-21T14:24:04.582Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: User Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the file /signup.php. Such manipulation of the argument emailid leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320907 - https://vuldb.com/?ctiid.32090
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320907 - https://vuldb.com/?ctiid.320907 - https://vuldb.com/?submit.632395 - https://github.com/chenjunjie3/cve/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-9303 State: PUBLISHED Published: 2025-08-21T14:32:07.463Z Last Updated: 2025-08-21T14:51:50.721Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: A720R Problem Types: CWE-120, CWE-119 Description: A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
e public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320908 - https://vuldb.com/?ctiid.320908 - https://vuldb.com/?submit.632410 - https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md - https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-9304 State: PUBLISHED Published: 2025-08-21T15:02:07.374Z Last Updated: 2025-08-21T19:57:41.321Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Bank Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of the file /bank/show.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https