Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3648 State: PUBLISHED Published: 2025-07-08T16:07:11.803Z Last Updated: 2025-08-19T18:37:03.796Z Vendors: ServiceNow Products: Now Platform Problem Types: CWE-1220 Description: A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Que
cing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the KB Articles in the References section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567 - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494 - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712
CVE ID: CVE-2025-3649 State: PUBLISHED Published: 2025-05-12T06:00:03.668Z Last Updated: 2025-05-12T17:03:04.531Z Vendors: Unknown Products: LightPress Lightbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/37fb7f3b-1766-4c2c-9b78-f77f15a04476/
CVE ID: CVE-2025-3650 State: PUBLISHED Published: 2025-09-12T06:00:03.695Z Last Updated: 2025-09-12T16:29:28.056Z Vendors: Unknown Products: jQuery Colorbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5afdd448-0f7e-409e-a47b-8e5c5b707639/
CVE ID: CVE-2025-3651 State: PUBLISHED Published: 2025-04-17T14:58:00.520Z Last Updated: 2025-04-17T19:10:42.989Z Vendors: iManage Products: Work Desktop for Mac Problem Types: CWE-346, CWE-668 Description: Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier allows attackers to execute arbitrary commands via unauthorized access to the Agent service. This has been remediated in Work Desktop for Mac version 10.8.2.33. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.imanage.com/security/CVE-2025-3651.html
CVE ID: CVE-2025-3659 State: PUBLISHED Published: 2025-05-12T20:40:03.567Z Last Updated: 2025-05-12T22:06:36.712Z Vendors: Digi International Products: Digi PortServer TS, Digi One SP/Digi One SP IA/Digi One IA, Digi One IAP Problem Types: CWE-287 Description: Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to and including 82000747_AA, build date 06/17/2022 * Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774_Z, build date 10/19/2020 * Digi One IAP – prior to and including 82000770 Z, build date 10/19/2020 A specially crafted POST request to the device’s web interface
prior to and including 82000770 Z, build date 10/19/2020 A specially crafted POST request to the device’s web interface may allow an unauthenticated attacker to modify configuration settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hub.digi.com/support/products/infrastructure-management/digi-portserver-ts/ - https://hub.digi.com/support/products/infrastructure-management/digi-one-sp-ia/ - https://hub.digi.com/support/products/infrastructure-management/digi-one-iap-haz/ - https://www.digi.com/getattachment/Resources/Security/Alerts/Improper-authentication-handling-for-Digi-PortServ/improper-authentication-handling.pdf
CVE ID: CVE-2025-3661 State: PUBLISHED Published: 2025-04-19T09:23:02.626Z Last Updated: 2025-04-21T15:01:19.739Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bobbingwide Products: SB Chart block Problem Types: CWE-79 Description: The SB Chart block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6afe4b6-c38c-46fa-82d5-95cb35c2c30f?source=cve - https://plugins.trac.wordpress.org/browser/sb-chart-block/trunk/sb-chart-block.php#L104 - https://wordpress.org/plugins/sb-chart-block/#developers - https://plugins.trac.wordpress.org/changeset/3276462/
CVE ID: CVE-2025-3662 State: PUBLISHED Published: 2025-06-03T06:00:17.231Z Last Updated: 2025-06-03T15:28:29.716Z Vendors: Unknown Products: FancyBox for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4cda12f0-3c23-44ad-80ea-db2443ebcf82/
CVE ID: CVE-2025-3663 State: PUBLISHED Published: 2025-04-16T02:31:06.295Z Last Updated: 2025-04-16T13:28:44.938Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component Password Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about t
initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304841 - https://vuldb.com/?ctiid.304841 - https://vuldb.com/?submit.551295 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setWiFiEasyCfg-1cb53a41781f809f807efe1284f5eb1a?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3664 State: PUBLISHED Published: 2025-04-16T03:00:17.236Z Last Updated: 2025-04-16T13:27:06.131Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additi
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304842 - https://vuldb.com/?ctiid.304842 - https://vuldb.com/?submit.551296 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setWiFiEasyGuestCfg-1cb53a41781f805f9ee3f1b2d362d3f2?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3665 State: PUBLISHED Published: 2025-04-16T03:00:20.945Z Last Updated: 2025-04-17T13:56:27.556Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A
ed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304843 - https://vuldb.com/?ctiid.304843 - https://vuldb.com/?submit.551297 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setSmartQosCfg-1cb53a41781f80ce9b7aca2c6ff9bea4?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3666 State: PUBLISHED Published: 2025-04-16T03:31:07.271Z Last Updated: 2025-04-16T13:27:42.335Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as critical. Affected by this issue is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304844 - https://vuldb.com/?ctiid.304844 - https://vuldb.com/?submit.551298 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setDdnsCfg-1cb53a41781f8001b9c0f345a120e2e7?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3667 State: PUBLISHED Published: 2025-04-16T04:31:07.231Z Last Updated: 2025-04-16T13:26:34.052Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304845 - https://vuldb.com/?ctiid.304845 - https://vuldb.com/?submit.551299 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setUPnPCfg-1cb53a41781f802b8b16f973366ee5e3?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3668 State: PUBLISHED Published: 2025-04-16T04:31:10.713Z Last Updated: 2025-04-16T13:25:19.147Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. This vulnerability affects the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addit
o the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304846 - https://vuldb.com/?ctiid.304846 - https://vuldb.com/?submit.551300 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setScheduleCfg-1cb53a41781f8042a841e2e19e010464?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3669 State: PUBLISHED Published: 2025-07-24T09:22:19.735Z Last Updated: 2025-07-24T13:14:37.205Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ullakalim8 Products: Supreme Addons for Beaver Builder – Problem Types: CWE-79 Description: The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/904ba3ec-efde-424c-a50b-2ce71ad91ca5?source=cve - https://wordpress.org/plugins/supreme-addons-for-beaver-builder-lite/#developers - https://plugins.trac.wordpress.org/browser/supreme-addons-for-beaver-builder-lite/tags/1.0.9/modules/QR-Code/QR-Code.php#L102
CVE ID: CVE-2025-3670 State: PUBLISHED Published: 2025-05-02T01:43:36.927Z Last Updated: 2025-05-02T17:24:44.331Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kiwichat Products: KiwiChat NextClient Problem Types: CWE-79 Description: The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
o inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd6f6a2c-59d3-4091-82ac-0edf9f47ef65?source=cve - https://plugins.trac.wordpress.org/browser/kiwichat/trunk/public/index.php#L25 - https://wordpress.org/plugins/kiwichat/#developers
CVE ID: CVE-2025-3671 State: PUBLISHED Published: 2025-08-16T03:38:49.460Z Last Updated: 2025-08-18T19:00:23.122Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: WPGYM - Wordpress Gym Management System Problem Types: CWE-22 Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 67.7.0 via the 'page' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access
arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One in particular reported by the researcher can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd776
Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6536d19f-a042-4404-b0c9-91aacd7768f7?source=cve - https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964
CVE ID: CVE-2025-3673 State: REJECTED Published: N/A Last Updated: 2025-04-23T18:16:30.693Z Description: No description available.
CVE ID: CVE-2025-3674 State: PUBLISHED Published: 2025-04-16T07:00:11.827Z Last Updated: 2025-04-16T13:54:14.666Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304963 - https://vuldb.com/?ctiid.304963 - https://vuldb.com/?submit.551302 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setUrlFilterRules-1cb53a41781f808f9547da7748580914?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3675 State: PUBLISHED Published: 2025-04-16T07:00:16.491Z Last Updated: 2025-04-16T13:28:11.582Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: TOTOLINK Products: A3700R Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304964
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304964 - https://vuldb.com/?ctiid.304964 - https://vuldb.com/?submit.551304 - https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setL2tpServerCfg-1cb53a41781f80319d38dc5a8e9174ae?pvs=4 - https://www.totolink.net/
CVE ID: CVE-2025-3676 State: PUBLISHED Published: 2025-04-16T08:00:06.460Z Last Updated: 2025-04-17T13:56:20.703Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: xxyopen Products: Novel-Plus Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichme
as contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304965 - https://vuldb.com/?ctiid.304965 - https://vuldb.com/?submit.551950 - https://github.com/mapl3miss/novel-SQLi/blob/main/novelCMS-sqli.md
CVE ID: CVE-2025-3677 State: PUBLISHED Published: 2025-04-16T08:31:04.475Z Last Updated: 2025-04-21T11:28:25.222Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: lm-sys Products: fastchat Problem Types: CWE-502, CWE-20 Description: A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserialization. An attack has to be approached locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304966 - https://vuldb.com/?ctiid.304966 - https://vuldb.com/?s
SA ADP Vulnrichment: References: - https://vuldb.com/?id.304966 - https://vuldb.com/?ctiid.304966 - https://vuldb.com/?submit.552755 - https://github.com/lm-sys/FastChat/issues/3713
CVE ID: CVE-2025-3678 State: PUBLISHED Published: 2025-04-16T09:00:11.362Z Last Updated: 2025-04-16T14:39:12.985Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component HELP Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304967 - https://vuldb.com/?ctiid.304967 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304967 - https://vuldb.com/?ctiid.304967 - https://vuldb.com/?submit.552780 - https://fitoxs.com/exploit/exploit-a0667f99e4dc732773f505cdb86fcae1.txt
CVE ID: CVE-2025-3679 State: PUBLISHED Published: 2025-04-16T09:31:04.757Z Last Updated: 2025-04-16T19:28:22.757Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component HOST Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304968 - https://vuldb.com/?ctiid.304968 - https://vuldb
s: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304968 - https://vuldb.com/?ctiid.304968 - https://vuldb.com/?submit.552787 - https://fitoxs.com/exploit/exploit-42ef6503a06aafc10808fa38b9e2e8f7.txt
CVE ID: CVE-2025-3680 State: PUBLISHED Published: 2025-04-16T09:31:05.904Z Last Updated: 2025-04-16T19:27:37.819Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component LANG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304969 - https://vuldb.com/?ctiid.304969
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304969 - https://vuldb.com/?ctiid.304969 - https://vuldb.com/?submit.552788 - https://fitoxs.com/exploit/exploit-4fcbb45637a8c2a83ec4e285bdf44ef4.txt