Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332464 - https://vuldb.com/?ctiid.332464 - https://vuldb.com/?submit.684785 - https://github.com/Bixintiao/cve/issues/1 - https://codeastro.com/
CVE ID: CVE-2025-13174 State: PUBLISHED Published: 2025-11-14T18:32:06.004Z Last Updated: 2025-11-14T18:57:17.553Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: rachelos Products: WeRSS we-mp-rss Problem Types: CWE-918 Description: A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hook_url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst
k may be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332465 - https://vuldb.com/?ctiid.332465 - https://vuldb.com/?submit.684803 - https://www.notion.so/SSRF-vulnerability-in-WeRSS-WebHook-module-29bea92a3c4180a192b5caa9078bfb18
CVE ID: CVE-2025-13177 State: PUBLISHED Published: 2025-11-14T19:02:07.421Z Last Updated: 2025-11-17T20:41:11.611Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Bdtask, CodeCanyon Products: SalesERP Problem Types: CWE-352, CWE-862 Description: A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332467 - htt
respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332467 - https://vuldb.com/?ctiid.332467 - https://vuldb.com/?submit.684819 - https://github.com/4m3rr0r/PoCVulDb/issues/1
CVE ID: CVE-2025-13178 State: PUBLISHED Published: 2025-11-14T19:02:10.138Z Last Updated: 2025-11-14T21:40:01.378Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Bdtask, CodeCanyon Products: SalesERP Problem Types: CWE-80, CWE-74 Description: A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the component User Profile Handler. This manipulation of the argument first_name/last_name causes basic cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not
otely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332468 - https://vuldb.com/?ctiid.332468 - https://vuldb.com/?submit.684820 - https://github.com/4m3rr0r/PoCVulDb/issues/2
CVE ID: CVE-2025-13179 State: PUBLISHED Published: 2025-11-14T19:32:06.566Z Last Updated: 2025-11-14T21:24:22.760Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Bdtask, CodeCanyon Products: Wholesale Inventory Control and Inventory Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown processing. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this di
from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332469 - https://vuldb.com/?ctiid.332469 - https://vuldb.com/?submit.684823 - https://github.com/4m3rr0r/PoCVulDb/issues/3
CVE ID: CVE-2025-13180 State: PUBLISHED Published: 2025-11-14T19:32:09.422Z Last Updated: 2025-11-14T21:22:51.553Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Bdtask, CodeCanyon Products: Wholesale Inventory Control and Inventory Management System Problem Types: CWE-80, CWE-74 Description: A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an unknown function of the file /edit_profile. Performing manipulation of the argument first_name/last_name results in basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be
sic cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332470 - https://vuldb.com/?ctiid.332470 - https://vuldb.com/?submit.684824 - https://github.com/4m3rr0r/PoCVulDb/issues/4
CVE ID: CVE-2025-13181 State: PUBLISHED Published: 2025-11-14T20:02:05.900Z Last Updated: 2025-11-14T21:23:50.197Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: pojoin Products: h3blog Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332471 - https://vuldb.com/?ctiid.3
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332471 - https://vuldb.com/?ctiid.332471 - https://vuldb.com/?submit.684887 - https://github.com/caigo8/CVE-md/blob/main/h3blog/xss4.md - https://github.com/caigo8/CVE-md/blob/main/h3blog/xss4.md#vulnerability-reproduction
CVE ID: CVE-2025-13182 State: PUBLISHED Published: 2025-11-14T20:32:06.064Z Last Updated: 2025-11-14T21:21:47.272Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: pojoin Products: h3blog Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332472 - https://vuldb.com/?ctiid.332472 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332472 - https://vuldb.com/?ctiid.332472 - https://vuldb.com/?submit.685520 - https://github.com/caigo8/CVE-md/blob/main/h3blog/xss3.md - https://github.com/caigo8/CVE-md/blob/main/h3blog/xss3.md#vulnerability-reproduction
CVE ID: CVE-2025-13185 State: PUBLISHED Published: 2025-11-14T21:02:06.306Z Last Updated: 2025-11-14T21:20:33.280Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Bdtask, CodeCanyon Products: News365 Problem Types: CWE-434, CWE-284 Description: A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. This affects an unknown function of the file /admin/dashboard/profile. The manipulation of the argument profile_image/banner_image results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any
sed to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332473 - https://vuldb.com/?ctiid.332473 - https://vuldb.com/?submit.685028 - https://github.com/4m3rr0r/PoCVulDb/issues/5
CVE ID: CVE-2025-13186 State: PUBLISHED Published: 2025-11-14T21:32:05.698Z Last Updated: 2025-11-17T20:41:49.637Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Bdtask, CodeCanyon Products: Isshue Multi Store eCommerce Shopping Cart Solution Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file /dashboard/Ccustomer/manage_customer. This manipulation of the argument Search causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. Th
ting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332474 - https://vuldb.com/?ctiid.332474 - https://vuldb.com/?submit.685036 - https://github.com/4m3rr0r/PoCVulDb/blob/main/README18.md
CVE ID: CVE-2025-13187 State: PUBLISHED Published: 2025-11-14T22:02:06.229Z Last Updated: 2025-11-17T20:42:25.385Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: Intelbras Products: ICIP Problem Types: CWE-256, CWE-255 Description: A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipulation of the argument NomeUsuario/SenhaAcess leads to unprotected storage of credentials. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
as been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332475 - https://vuldb.com/?ctiid.332475 - https://vuldb.com/?submit.685522 - https://www.notion.so/eldruin/Intelbras-ICIP-Plaintext-Admin-Credentials-Disclosure-29b27474cccb80ff943ff2776d03d7cd
CVE ID: CVE-2025-13188 State: PUBLISHED Published: 2025-11-14T22:32:06.220Z Last Updated: 2025-11-17T20:43:05.895Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:W/RC:UR) Vendors: D-Link Products: DIR-816L Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in D-Link DIR-816L 2_06_b09_beta. Affected by this vulnerability is the function authenticationcgi_main of the file /authentication.cgi. Performing manipulation of the argument Password results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Add
now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332476 - https://vuldb.com/?ctiid.332476 - https://vuldb.com/?submit.685538 - https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(authentication.cgi).pdf - https://www.dlink.com/
CVE ID: CVE-2025-13189 State: PUBLISHED Published: 2025-11-15T06:02:05.687Z Last Updated: 2025-11-17T14:44:50.500Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-816L Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta. This affects the function genacgi_main of the file gena.cgi. The manipulation of the argument SERVER_ID/HTTP_SID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst
ay be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332478 - https://vuldb.com/?ctiid.332478 - https://vuldb.com/?submit.685540 - https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(gena.cgi).pdf - https://www.dlink.com/
CVE ID: CVE-2025-13190 State: PUBLISHED Published: 2025-11-15T06:32:06.207Z Last Updated: 2025-11-17T14:34:16.419Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-816L Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DIR-816L 2_06_b09_beta. This vulnerability affects the function scandir_main of the file /portal/__ajax_exporer.sgi. The manipulation of the argument en results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes:
sed. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332479 - https://vuldb.com/?ctiid.332479 - https://vuldb.com/?submit.685541 - https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(scandir.sgi).pdf - https://www.dlink.com/
CVE ID: CVE-2025-13191 State: PUBLISHED Published: 2025-11-15T07:02:06.314Z Last Updated: 2025-11-17T15:00:24.513Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-816L Problem Types: CWE-121, CWE-119 Description: A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta. This issue affects the function soapcgi_main of the file /soap.cgi. This manipulation causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: R
ly affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332480 - https://vuldb.com/?ctiid.332480 - https://vuldb.com/?submit.685543 - https://github.com/scanleale/IOT_sec/blob/main/DIR-816L%20stack%20overflow(soap.cgi).pdf - https://www.dlink.com/
CVE ID: CVE-2025-13193 State: PUBLISHED Published: 2025-11-17T17:03:48.291Z Last Updated: 2025-11-17T18:40:25.024Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-276 Description: A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
nts. This results in an information disclosure vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-13193 - https://bugzilla.redhat.com/show_bug.cgi?id=2415409
CVE ID: CVE-2025-13196 State: PUBLISHED Published: 2025-11-18T09:27:36.191Z Last Updated: 2025-11-18T21:33:06.846Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Addons for Elementor Problem Types: CWE-79 Description: The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Street Map widget's marker content parameter in all versions up to, and including, 8.3.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the render function. This makes it possible for authenticated attackers, with contributor level access and abo
ibutes in the render function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6a080-260f-4b19-a32c-453d2781389a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3396544%40bdthemes-element-pack-lite&old=3395028%40bdthemes-element-pack-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-13197 State: REJECTED Published: N/A Last Updated: 2025-11-22T22:24:46.568Z Description: No description available.
CVE ID: CVE-2025-13198 State: PUBLISHED Published: 2025-11-15T09:02:07.001Z Last Updated: 2025-11-17T18:53:54.523Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: DouPHP Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in DouPHP up to 1.8 Release 20251022. This impacts an unknown function of the file upload/include/file.class.php. The manipulation of the argument File leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332496 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332496 - https://vuldb.com/?ctiid.332496 - https://vuldb.com/?submit.685544 - https://github.com/electroN1chahaha/My-CVE/issues/1
CVE ID: CVE-2025-13199 State: PUBLISHED Published: 2025-11-15T10:32:05.696Z Last Updated: 2025-11-17T18:54:33.761Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: code-projects Products: Email Logging Interface Problem Types: CWE-24, CWE-23 Description: A vulnerability was found in code-projects Email Logging Interface 2.0. Affected is an unknown function of the file signup.cpp. The manipulation of the argument Username results in path traversal: '../filedir'. The attack is only possible with local access. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332497 - https://vuldb.com/?ctiid.332497 - https://vuldb.com/?submit.685549 - https://github.com/asd1238525/cve/blob/main/Dir1c.md - https://github.com/asd1238525/cve/blob/main/Dir1c.md#poc - https://code-projects.org/
CVE ID: CVE-2025-13200 State: PUBLISHED Published: 2025-11-15T15:32:05.861Z Last Updated: 2025-11-17T14:48:58.059Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: SourceCodester Products: Farm Management System Problem Types: CWE-548, CWE-552 Description: A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation causes exposure of information through directory listing. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332498 - https://vuldb.com/?ctiid.332498 - https://vuldb.com/?submit.685615 - https://github.com/Shaker-Chen/cve/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2025-13201 State: PUBLISHED Published: 2025-11-15T16:02:06.630Z Last Updated: 2025-11-17T14:45:38.581Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Cafe Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.33249
vailable and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332499 - https://vuldb.com/?ctiid.332499 - https://vuldb.com/?submit.685619 - https://github.com/shenxianyuguitian/cafeorder_vuln_SQL/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-13202 State: PUBLISHED Published: 2025-11-15T17:02:05.743Z Last Updated: 2025-11-17T15:02:45.056Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Cafe Ordering System Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /add_to_cart. Performing manipulation of the argument product_name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
en released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332500 - https://vuldb.com/?ctiid.332500 - https://vuldb.com/?submit.685729 - https://github.com/shenxianyuguitian/cafeorder_vuln_XSS/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-13203 State: PUBLISHED Published: 2025-11-15T17:32:05.607Z Last Updated: 2025-11-17T16:04:15.446Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Cafe Ordering System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Simple Cafe Ordering System 1.0. This vulnerability affects unknown code of the file /addmem.php. Executing manipulation of the argument studentnum can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ade available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.332501 - https://vuldb.com/?ctiid.332501 - https://vuldb.com/?submit.686708 - https://github.com/JasonCyberYu/SimpleCafe/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-13204 State: PUBLISHED Published: 2025-11-14T17:02:39.529Z Last Updated: 2025-11-14T20:41:22.990Z Vendors: silentmatt Products: expr-eval Problem Types: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Description: npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.npmjs.com/package/expr-eval-fork - https://github.com/silentmatt/expr-eval - https://gi
hment: References: - https://www.npmjs.com/package/expr-eval-fork - https://github.com/silentmatt/expr-eval - https://github.com/jorenbroekema/expr-eval - https://www.huntr.dev/bounties/1-npm-expr-eval/ - https://github.com/SECCON/SECCON2022_final_CTF/blob/main/jeopardy/web/babybox/solver/solver.py - https://github.com/silentmatt/expr-eval/pull/252/files - https://github.com/vladko312/extras/blob/f549d505af300fd74a01b46fab2102990ff1c14d/expr-eval.py