Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1143 State: PUBLISHED Published: 2025-02-11T03:17:22.510Z Last Updated: 2025-02-18T18:00:30.733Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Billion Electric Products: M100, M150, M120N, M500 Problem Types: CWE-798 Description: Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html - https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html
CVE ID: CVE-2025-1144 State: PUBLISHED Published: 2025-02-11T03:21:09.269Z Last Updated: 2025-08-26T19:48:05.401Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Quanxun Products: School Affairs System Problem Types: CWE-497 Description: School Affairs System from Quanxun has an Exposure of Sensitive Information, allowing unauthenticated attackers to view specific pages and obtain database information as well as plaintext administrator credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8415-853e0-1.html - https://www.twcert.org.tw/en/cp-139-8416-b6cba-2.html
CVE ID: CVE-2025-1145 State: PUBLISHED Published: 2025-02-11T03:28:31.981Z Last Updated: 2025-02-18T17:54:32.362Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: NetVision Information Products: ISOinsight Problem Types: CWE-79 Description: NetVision Information ISOinsight has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8417-ea1ea-1.html - https://www.twcert.org.tw/en/cp-139-8418-40958-2.html
CVE ID: CVE-2025-1146 State: PUBLISHED Published: 2025-02-12T18:27:35.458Z Last Updated: 2025-02-12T19:40:41.867Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CrowdStrike Products: Falcon sensor for Linux, Falcon Kubernetes Admission Controller, Falcon Container Sensor Problem Types: CWE-296 Description: CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incor
es Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above. CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as pa
process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. Windows and Mac sensors are not affected by this. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.crowdstrike.com/security-advisories/cve-2025-1146/
CVE ID: CVE-2025-1147 State: PUBLISHED Published: 2025-02-10T13:31:07.649Z Last Updated: 2025-04-04T23:03:08.236Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public
ity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.295051 - https://vuldb.com/?ctiid.295051 - https://vuldb.com/?submit.485254 - https://sourceware.org/bugzilla/show_bug.cgi?id=32556 - https://sourceware.org/bugzilla/attachment.cgi?id=15881 - https://www.gnu.org/
CVE ID: CVE-2025-1148 State: PUBLISHED Published: 2025-02-10T14:00:12.091Z Last Updated: 2025-04-04T23:03:09.361Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-401, CWE-404 Description: A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch
known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.295052 - https://vuldb.com/?ctiid.295052 - https://vuldb.com/?submit.485747 - https://sourceware.org/bugzilla/show_bug.cgi?id=32576 - https://sourceware.org/bugzilla/attachment.cgi?id=15887 - https://www.gnu.
urceware.org/bugzilla/show_bug.cgi?id=32576 - https://sourceware.org/bugzilla/attachment.cgi?id=15887 - https://www.gnu.org/
CVE ID: CVE-2025-1149 State: PUBLISHED Published: 2025-02-10T14:31:07.377Z Last Updated: 2025-02-10T14:47:56.144Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-401, CWE-404 Description: A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a
lity is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295053 - https://vuldb.com/?ctiid.295053 - https://sourceware.org/bugzilla/show_bug.cgi?id=32576 - https://sourceware.org/bugzilla/attachment.cgi?id=15887 - https://www.gnu.org/
CVE ID: CVE-2025-1150 State: PUBLISHED Published: 2025-02-10T16:31:07.343Z Last Updated: 2025-02-12T15:46:25.151Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-401, CWE-404 Description: A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch t
ears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295054 - https://vuldb.com/?ctiid.295054 - https://sourceware.org/bugzilla/show_bug.cgi?id=32576 - https://sourceware.org/bugzilla/attachment.cgi?id=15887 - https://www.gnu.org/
CVE ID: CVE-2025-1151 State: PUBLISHED Published: 2025-02-10T17:00:10.236Z Last Updated: 2025-02-12T15:47:36.167Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-401, CWE-404 Description: A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this i
ifficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295055 - https://vuldb.com/?ctiid.295055 - https://sourceware.org/bugzilla/show_bug.cgi?id=32576 - https://sourceware.org/bugzilla/attachment.cgi?id=15887 - https://www.gnu.org/
CVE ID: CVE-2025-1152 State: PUBLISHED Published: 2025-02-10T18:00:09.779Z Last Updated: 2025-02-12T15:48:17.157Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-401, CWE-404 Description: A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this is
fficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295056 - https://vuldb.com/?ctiid.295056 - https://sourceware.org/bugzilla/show_bug.cgi?id=32576 - https://sourceware.org/bugzilla/attachment.cgi?id=15887 - https://www.gnu.org/
CVE ID: CVE-2025-1153 State: PUBLISHED Published: 2025-02-10T19:00:13.010Z Last Updated: 2025-04-04T23:03:10.496Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: GNU Products: Binutils Problem Types: CWE-119 Description: A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a
t. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.295057 - https://vuldb.com/?ctiid.295057 - https://vuldb.com/?submit.489991 - https://sourceware.org/bugzilla/show_bug.cgi?id=32603 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150 - https://www.gnu.org/
CVE ID: CVE-2025-1154 State: PUBLISHED Published: 2025-02-10T19:31:03.874Z Last Updated: 2025-02-12T15:49:46.751Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: xxyopen Products: Novel Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295058 - https://vuldb.com/?ctiid.295058 - https://vuldb.com/?submit.492531 - https://gist.github.com/GSBP0/9d26bf092647018e39eb515fb6c1eb0a
CVE ID: CVE-2025-1155 State: PUBLISHED Published: 2025-02-10T20:00:13.333Z Last Updated: 2025-02-10T20:51:58.656Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Webkul Products: QloApps Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295059 - https://vuldb.com/?ctiid.295059 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295059 - https://vuldb.com/?ctiid.295059 - https://vuldb.com/?submit.492777 - https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main
CVE ID: CVE-2025-1156 State: PUBLISHED Published: 2025-02-10T20:31:04.282Z Last Updated: 2025-02-10T20:50:42.514Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Pix Software Products: Vivaz Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login. The manipulation of the argument usuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnri
or was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295060 - https://vuldb.com/?ctiid.295060 - https://vuldb.com/?submit.493482
CVE ID: CVE-2025-1157 State: PUBLISHED Published: 2025-02-10T21:00:09.012Z Last Updated: 2025-02-10T23:14:16.498Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Allims Products: lab.online Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_recuperar_senha.php. The manipulation of the argument recuperacao leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295061 - https://vuldb.com/?ctiid.295061 - https://vuldb.com/?submit.493492
CVE ID: CVE-2025-1158 State: PUBLISHED Published: 2025-02-10T21:31:04.316Z Last Updated: 2025-02-10T21:59:26.404Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the file addPolicyToSafetyGroup.jsp. The manipulation of the argument safetyGroupId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295062 - https://vuldb.com/?ctiid.295062 - https://vuldb.com/?submit.493644 - https://github.com/Rain1er/report/blob/main/CDG/addPolicyToSafetyGroup.md
CVE ID: CVE-2025-1159 State: PUBLISHED Published: 2025-02-10T22:00:10.406Z Last Updated: 2025-02-11T15:28:53.673Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CampCodes Products: School Management Software Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CampCodes School Management Software 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academic-calendar. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2950
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295063 - https://vuldb.com/?ctiid.295063 - https://vuldb.com/?submit.493687 - https://github.com/KhukuriRimal/Vulnerabilities/blob/main/Stored%20Cross%20Site%20Scripting-%20Teachers%20Account%20Takeover%20Possibility.pdf - https://www.campcodes.com/
CVE ID: CVE-2025-1160 State: PUBLISHED Published: 2025-02-10T22:31:04.690Z Last Updated: 2025-02-18T18:10:11.555Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee Management System Problem Types: CWE-1392 Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295064 - https://vuldb.com/?ctiid.295064 - https://vuldb.com/?submit.493860 - https://gist.github.com/jmx0hxq/0e9cde14b6e9190a7451cd72d7b23bfd - https://www.sourcecodester.com/
CVE ID: CVE-2025-1162 State: PUBLISHED Published: 2025-02-10T23:00:07.040Z Last Updated: 2025-02-18T18:09:42.695Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295065 - http
ic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295065 - https://vuldb.com/?ctiid.295065 - https://vuldb.com/?submit.494007 - https://github.com/J0hnFFFF/j0hn_upload_two/blob/main/web1.pdf - https://code-projects.org/
CVE ID: CVE-2025-1163 State: PUBLISHED Published: 2025-02-10T23:31:04.336Z Last Updated: 2025-02-11T16:06:32.583Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: code-projects Products: Vehicle Parking Management System Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerability affects the function login of the component Authentication. The manipulation of the argument username leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295066 - https://vuldb.com/?ctiid.295066 - https://vuldb.com/?submit.494008 - https://github.com/J0hnFFFF/j0hn_upload_three/blob/main/binary1.pdf - https://code-projects.org/
CVE ID: CVE-2025-1164 State: PUBLISHED Published: 2025-02-11T00:00:06.827Z Last Updated: 2025-02-11T16:04:13.876Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: code-projects Products: Police FIR Record Management System Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as problematic, has been found in code-projects Police FIR Record Management System 1.0. This issue affects some unknown processing of the component Add Record Handler. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes:
equired to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295067 - https://vuldb.com/?ctiid.295067 - https://vuldb.com/?submit.494009 - https://github.com/J0hnFFFF/j0hn_upload_four/blob/main/binary2.pdf - https://code-projects.org/
CVE ID: CVE-2025-1165 State: PUBLISHED Published: 2025-02-11T00:31:04.757Z Last Updated: 2025-02-18T18:08:54.776Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Lumsoft Products: ERP Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295068 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.295068 - https://vuldb.com/?ctiid.295068 - https://vuldb.com/?submit.494516 - https://github.com/Rain1er/report/blob/main/Lserp/fileUpload_1.md