Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4326 State: PUBLISHED Published: 2025-05-06T06:00:09.103Z Last Updated: 2025-05-06T13:45:02.425Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: MRCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the component Add Fragment Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307427 - https://vuldb.com/?ctiid.307427 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307427 - https://vuldb.com/?ctiid.307427 - https://vuldb.com/?submit.563549 - https://github.com/bdkuzma/vuln/issues/7
CVE ID: CVE-2025-4327 State: PUBLISHED Published: 2025-05-06T06:31:03.485Z Last Updated: 2025-05-06T14:15:12.444Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: MRCMS Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints might be affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307428 - https://vuldb.com/?ctiid.307428 - https://vuldb.com/
CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307428 - https://vuldb.com/?ctiid.307428 - https://vuldb.com/?submit.563555 - https://github.com/bdkuzma/vuln/issues/8
CVE ID: CVE-2025-4328 State: PUBLISHED Published: 2025-05-06T07:00:07.092Z Last Updated: 2025-05-06T14:14:12.642Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: fp2952 Products: spring-cloud-base Problem Types: CWE-601 Description: A vulnerability was found in fp2952 spring-cloud-base up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa. It has been declared as problematic. Affected by this vulnerability is the function sendBack of the file /spring-cloud-base-master/auth-center/auth-center-provider/src/main/java/com/peng/auth/provider/config/web/MvcController.java of the component HTTP Header Handler. The manipulation of the argument Referer leads to open redirect. The attack can be la
the component HTTP Header Handler. The manipulation of the argument Referer leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307429 - https://vuldb.com/?ctiid.307429 - https://vuldb.com/?submit.564161 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250423-01.md
CVE ID: CVE-2025-4329 State: PUBLISHED Published: 2025-05-06T07:00:08.731Z Last Updated: 2025-05-06T14:11:17.184Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: 74CMS Problem Types: CWE-22 Description: A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/download/index. The manipulation of the argument url leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307430 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307430 - https://vuldb.com/?ctiid.307430 - https://vuldb.com/?submit.564318 - https://github.com/Q16G/cve_detail/blob/main/74cms/fileRead.md
CVE ID: CVE-2025-4330 State: PUBLISHED Published: 2025-06-03T12:58:57.452Z Last Updated: 2025-07-07T17:36:07.725Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Python Software Foundation Products: CPython Problem Types: CWE-22 Description: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://do
CVE ID: CVE-2025-4331 State: PUBLISHED Published: 2025-05-06T07:31:04.308Z Last Updated: 2025-05-20T14:29:49.775Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Student Clearance System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Online Student Clearance System 1.0. This vulnerability affects unknown code of the file /Admin/login.php. The manipulation of the argument id/username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307432 - https://vuldb.com/?ctiid.307432 - https://vuldb.com/?submit.564329 - https://github.com/cybersharmaji/Online-Student-Clearance-System/blob/main/sql_injection_time.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-4332 State: PUBLISHED Published: 2025-05-06T07:31:07.749Z Last Updated: 2025-06-05T05:29:07.681Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Company Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /visitor-detail.php. The manipulation of the argument editid/remark leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307436 - https://vuldb.com/?ctiid.307436 - https://vuldb.com/?submit.564339 - https://vuldb.com/?submit.564729 - https://vuldb.com/?submit.568338 - https://vuldb.com/?submit.590559 - https://github.com/ctf2868/pjwww/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4333 State: PUBLISHED Published: 2025-05-06T08:00:05.951Z Last Updated: 2025-05-06T13:54:28.758Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: feng_ha_ha, megagao Products: ssm-erp, production_ssm Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFile of the file src/main/java/com/megagao/production/ssm/service/impl/FileServiceImpl.java. The manipulation of the argument uploadFile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be
stricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307437 - https://vuldb.com/?ctiid.307437 - https://vuldb.com/?submit.564591 - https://github.com/Hao-Ni/CVE/issues/1
CVE ID: CVE-2025-4334 State: PUBLISHED Published: 2025-06-26T02:06:34.765Z Last Updated: 2025-06-27T14:51:55.539Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nmedia Products: Simple User Registration Problem Types: CWE-269 Description: The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/
administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c211e0c0-3086-43d2-853c-489f9c42b0ab?source=cve - https://plugins.trac.wordpress.org/browser/wp-registration/trunk/inc/classes/class.register.php#L135
CVE ID: CVE-2025-4335 State: PUBLISHED Published: 2025-05-07T01:43:08.149Z Last Updated: 2025-05-07T14:03:12.337Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n3wnormal Products: Woocommerce Multiple Addresses Problem Types: CWE-269 Description: The Woocommerce Multiple Addresses plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.7.1. This is due to insufficient restrictions on user meta that can be updated through the save_multiple_shipping_addresses() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator
authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95e74e70-9dc9-4e63-b371-fd2a38692907?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-multiple-addresses/trunk/class-woocommerce-multiple-addresses.php#L522
CVE ID: CVE-2025-4336 State: PUBLISHED Published: 2025-05-24T03:37:32.435Z Last Updated: 2025-05-24T10:01:00.297Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emagicone Products: eMagicOne Store Manager for WooCommerce Problem Types: CWE-434 Description: The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable by unauthenticat
s on the affected site's server which may make remote code execution possible. This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5323dbb7-3893-4b43-838b-6326505b2fb7?source=cve - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/smconnector.php#L35-36 - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php - https://plugins.trac.wordpress.org/browser/store
-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php - https://plugins.trac.wordpress.org/browser/store-manager-connector/trunk/classes/class-emosmcwoocommerceoverrider.php#L441 - https://ryankozak.com/posts/cve-2025-4336 - https://github.com/d0n601/CVE-2025-4336
CVE ID: CVE-2025-4337 State: PUBLISHED Published: 2025-05-06T04:24:12.780Z Last Updated: 2025-05-06T14:18:15.629Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: mitchelllevy Products: AHAthat Plugin Problem Types: CWE-352 Description: The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Note
ranted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af15ae80-dbce-4899-9604-82fdca222bf5?source=cve - https://plugins.trac.wordpress.org/browser/ahathat/trunk/includes/class-aha-admin-menu.php#L42
CVE ID: CVE-2025-4338 State: PUBLISHED Published: 2025-05-22T23:00:02.999Z Last Updated: 2025-05-23T13:34:42.688Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Lantronix Products: Device Installer Problem Types: CWE-611 Description: Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain credentials, access these network devices, and modify their configurations. An attacker may also gain access to the host running the Device Installer software or the password hash of the user running the application. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
are or the password hash of the user running the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-142-01 - https://www.lantronix.com/products/lantronix-provisioning-manager/
CVE ID: CVE-2025-4339 State: PUBLISHED Published: 2025-05-13T06:40:56.275Z Last Updated: 2025-05-13T18:59:13.686Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: CodexThemes Products: TheGem Problem Types: CWE-862 Description: The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions up to, and including, 5.10.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary theme options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f2358979-25b9-4c52-88dc-25390be6bd22?source=cve - https://themeforest.net/item/thegem-creative-multipurpose-highperformance-wordpress-theme/16061685 - https://codex-themes.com/thegem/changelog.html
CVE ID: CVE-2025-4340 State: PUBLISHED Published: 2025-05-06T08:00:08.557Z Last Updated: 2025-05-06T13:53:27.958Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DIR-890L, DIR-806A1 Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /htdocs/soap.cgi. The manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: -
d. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307458 - https://vuldb.com/?ctiid.307458 - https://vuldb.com/?submit.556092 - https://github.com/CH13hh/tmp_store_cc/blob/main/tt/1.md - https://www.dlink.com/
CVE ID: CVE-2025-4341 State: PUBLISHED Published: 2025-05-06T08:31:05.193Z Last Updated: 2025-05-06T13:50:37.275Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DIR-880L Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdocs/ssdpcgi of the component Request Header Handler. The manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products tha
hed remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307459 - https://vuldb.com/?ctiid.307459 - https://vuldb.com/?submit.556433 - https://github.com/CH13hh/tmp_store_cc/blob/main/DIR-880L/1.md - https://www.dlink.com/
CVE ID: CVE-2025-4342 State: PUBLISHED Published: 2025-05-06T08:31:07.129Z Last Updated: 2025-05-06T13:49:40.538Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01. Affected by this issue is the function formEasySetupWizard3. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307460 - https://v
he maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307460 - https://vuldb.com/?ctiid.307460 - https://vuldb.com/?submit.558295 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_overflow-formEasySetupWizard3-wan_connected/README.md - https://www.dlink.com/
CVE ID: CVE-2025-4343 State: PUBLISHED Published: 2025-05-06T09:00:06.288Z Last Updated: 2025-05-06T15:04:02.466Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical. This vulnerability affects the function formEasySetupWizard. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307462 - https://vuldb.co
tainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307462 - https://vuldb.com/?ctiid.307462 - https://vuldb.com/?submit.558296 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_overflow-formEasySetupWizard-curTime/README.md - https://www.dlink.com/
CVE ID: CVE-2025-4344 State: PUBLISHED Published: 2025-05-06T09:31:05.281Z Last Updated: 2025-05-06T14:17:23.447Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01. This affects the function formLogin. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307461 - https://vuldb.com/?ctiid.30
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307461 - https://vuldb.com/?ctiid.307461 - https://vuldb.com/?submit.558297 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_overflow-formLogin-curTime/README.md - https://www.dlink.com/
CVE ID: CVE-2025-4345 State: PUBLISHED Published: 2025-05-06T10:00:06.759Z Last Updated: 2025-05-06T15:21:38.935Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical. This issue affects the function formSetLog. The manipulation of the argument host leads to buffer overflow. The attack may be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307463 - https://vuldb.com/?ctiid.307463 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307463 - https://vuldb.com/?ctiid.307463 - https://vuldb.com/?submit.558298 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_overflow-formSetLog-curTime/README.md - https://www.dlink.com/
CVE ID: CVE-2025-4346 State: PUBLISHED Published: 2025-05-06T10:00:08.992Z Last Updated: 2025-05-06T15:16:08.353Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been classified as critical. Affected is the function formSetWAN_Wizard534. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307464 - https://vuldb.com/
iner. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307464 - https://vuldb.com/?ctiid.307464 - https://vuldb.com/?submit.558299 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_overflow-formSetWAN_Wizard534-curTime/README.md - https://www.dlink.com/
CVE ID: CVE-2025-4347 State: PUBLISHED Published: 2025-05-06T10:31:04.720Z Last Updated: 2025-05-06T15:12:32.996Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been declared as critical. Affected by this vulnerability is the function formWlSiteSurvey. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307465 - https://vul
maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307465 - https://vuldb.com/?ctiid.307465 - https://vuldb.com/?submit.558300 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_overflow-formWlSiteSurvey-curTime/README.md - https://www.dlink.com/
CVE ID: CVE-2025-4348 State: PUBLISHED Published: 2025-05-06T11:00:06.944Z Last Updated: 2025-05-06T13:36:45.142Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-600L Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been rated as critical. Affected by this issue is the function formSetWanL2TP. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307466 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.307466 - https://vuldb.com/?ctiid.307466 - https://vuldb.com/?submit.558301 - https://github.com/jylsec/vuldb/blob/main/D-Link/dlink_dir600l/Buffer_ovrflow-formSetWanL2TP-curTime/README.md - https://www.dlink.com/