Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-7066 State: PUBLISHED Published: 2025-07-04T12:02:34.287Z Last Updated: 2025-09-16T11:01:26.893Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Jirafeau project Products: Jirafeau Problem Types: CWE-79 Description: Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manip
ee CVE-2022-30110 and CVE-2024-12326), video and audio. However, it was possible to bypass this check by sending a manipulated MIME type containing a comma and an other MIME type like text/html (for example image/png,text/html). Browsers see multiple MIME types and text/html would takes precedence, allowing a possible attacker to do a cross-site scripting attack. The check for MIME types was enhanced to prevent a browser preview when the stored MIME type contains a comma. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/jirafeau/Jirafeau/-/commit/79464ec6276e8eb0e0b0ad597db02b85080d2b63 - https://www.cve.org/CVERecord?id=CVE-2022-30110 - https://www.cve.org
/commit/79464ec6276e8eb0e0b0ad597db02b85080d2b63 - https://www.cve.org/CVERecord?id=CVE-2022-30110 - https://www.cve.org/CVERecord?id=CVE-2024-12326
CVE ID: CVE-2025-7067 State: PUBLISHED Published: 2025-07-04T18:02:05.802Z Last Updated: 2025-07-08T13:57:09.724Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5FS__sinfo_serialize_node_cb of the file src/H5FScache.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314902 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314902 - https://vuldb.com/?ctiid.314902 - https://vuldb.com/?submit.602536 - https://github.com/HDFGroup/hdf5/issues/5577 - https://github.com/user-attachments/files/20623499/hdf5_crash_9.txt
CVE ID: CVE-2025-7068 State: PUBLISHED Published: 2025-07-04T20:32:06.420Z Last Updated: 2025-07-08T13:56:18.646Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-401, CWE-404 Description: A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314903 - https://vuldb.com/?ctiid.314903 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314903 - https://vuldb.com/?ctiid.314903 - https://vuldb.com/?submit.602537 - https://github.com/HDFGroup/hdf5/issues/5578 - https://github.com/user-attachments/files/20623530/hdf5_crash_10.txt
CVE ID: CVE-2025-7069 State: PUBLISHED Published: 2025-07-04T21:02:06.876Z Last Updated: 2025-07-08T13:38:56.989Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: HDF5 Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314904 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314904 - https://vuldb.com/?ctiid.314904 - https://vuldb.com/?submit.602538 - https://github.com/HDFGroup/hdf5/issues/5550 - https://github.com/user-attachments/files/20438481/hdf5_crash_2.txt
CVE ID: CVE-2025-7070 State: PUBLISHED Published: 2025-07-04T21:32:07.349Z Last Updated: 2025-07-08T13:55:13.799Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R) Vendors: IROAD Products: Dashcam Q9 Problem Types: CWE-770, CWE-400 Description: A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MFA Pairing Request Handler. The manipulation leads to allocation of resources. The attack needs to be done within the local network. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes:
network. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314905 - https://vuldb.com/?ctiid.314905 - https://vuldb.com/?submit.603298 - https://github.com/geo-chen/IROAD-V?tab=readme-ov-file#finding-8---mfa-spam-to-induce-device-pairing-fatigue
CVE ID: CVE-2025-7071 State: PUBLISHED Published: 2025-08-29T09:18:06.911Z Last Updated: 2025-08-29T12:07:57.827Z Vendors: Oberon microsystems AG Products: ocrypto Problem Types: CWE-208, CWE-327 Description: Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oberon.ch/security-advisories/cve-2025-7071/
CVE ID: CVE-2025-7074 State: PUBLISHED Published: 2025-07-05T09:02:05.339Z Last Updated: 2025-07-07T16:06:53.818Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: vercel Products: hyper Problem Types: CWE-1333, CWE-400 Description: A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314973 - https://vuldb.com/?ctiid.314973 - https://vuldb.com/?submit.602353 - https://github.com/vercel/hyper/issues/8098
CVE ID: CVE-2025-7075 State: PUBLISHED Published: 2025-07-05T23:32:05.317Z Last Updated: 2025-07-07T16:06:08.987Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R) Vendors: BlackVue Products: Dashcam 590X Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /upload.cgi of the component HTTP Endpoint. The manipulation leads to unrestricted upload. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early abo
thin the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314989 - https://vuldb.com/?ctiid.314989 - https://vuldb.com/?submit.603301 - https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-1-unauthenticated-upload-endpoint-on-http
CVE ID: CVE-2025-7076 State: PUBLISHED Published: 2025-07-06T00:02:04.767Z Last Updated: 2025-07-07T16:05:38.975Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:W/RC:R) Vendors: BlackVue Products: Dashcam 590X Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.cgi of the component Configuration Handler. The manipulation leads to improper access controls. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted
tiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314990 - https://vuldb.com/?ctiid.314990 - https://vuldb.com/?submit.603305 - https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-2-unauthenticated-modifications-to-dashcam-configurations
CVE ID: CVE-2025-7077 State: PUBLISHED Published: 2025-07-06T06:32:05.492Z Last Updated: 2025-07-07T16:22:06.588Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Shenzhen Libituo Technology Products: LBT-T300-T310 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical has been found in Shenzhen Libituo Technology LBT-T300-T310 up to 2.2.3.6. This affects the function config_3g_para of the file /appy.cgi. The manipulation of the argument username_3g/password_3g leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as wel
attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314991 - https://vuldb.com/?ctiid.314991 - https://vuldb.com/?submit.603012 - https://github.com/FLY200503/IoT-vul/tree/master/LBT-T300
CVE ID: CVE-2025-7078 State: PUBLISHED Published: 2025-07-06T08:32:05.396Z Last Updated: 2025-07-07T16:21:20.599Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: 07FLYCMS, 07FLY-CMS, 07FlyCRM Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.3.9. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in
product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314992 - https://vuldb.com/?ctiid.314992 - https://vuldb.com/?submit.603552 - https://github.com/Excentique/yuxuan_mei/blob/main/07fly-crm_1.md
CVE ID: CVE-2025-7079 State: PUBLISHED Published: 2025-07-06T12:32:05.291Z Last Updated: 2025-07-07T16:20:48.263Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: mao888 Products: bluebell-plus Problem Types: CWE-259, CWE-255 Description: A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebell_backend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plus leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high
us leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314993 - https://vuldb.com/?ctiid.314993 - https://vuldb.com/?submit.603726 - https://github.com/mao888/bluebell-plus/issues/35
CVE ID: CVE-2025-7080 State: PUBLISHED Published: 2025-07-06T13:02:05.867Z Last Updated: 2025-07-07T14:09:31.086Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Done-0 Products: Jank Problem Types: CWE-259, CWE-255 Description: A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function of the file internal/utils/jwt_utils.go of the component JWT Token Handler. The manipulation of the argument accessSecret/refreshSecret with the input jank-blog-secret/jank-blog-refresh-secret leads to use of hard-coded password. It is possible to launch the attack r
put jank-blog-secret/jank-blog-refresh-secret leads to use of hard-coded password. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314994 - https://vuldb.com/?ctiid.314994 - https://vuldb.com/?submit.603746 - https://github.com/Done-0/Jank/issues/9
CVE ID: CVE-2025-7081 State: PUBLISHED Published: 2025-07-06T13:32:04.709Z Last Updated: 2025-07-07T14:06:39.579Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-78, CWE-77 Description: A vulnerability has been found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this vulnerability is the function formSetWanStatic of the file /goform/formSetWanStatic of the component webs. The manipulation of the argument m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 is directly passed by the attacker/so we can control the m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_s
directly passed by the attacker/so we can control the m_wan_ipaddr/m_wan_netmask/m_wan_gateway/m_wan_staticdns1/m_wan_staticdns2 leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314995 - https://vuldb.com/?ctiid.314995 - https://vuldb.com/?submit.603669 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_1/1.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_1/1.md#poc
CVE ID: CVE-2025-7082 State: PUBLISHED Published: 2025-07-06T14:02:05.329Z Last Updated: 2025-07-07T13:55:21.071Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey of the file /goform/formBSSetSitesurvey of the component webs. The manipulation of the argument wan_ipaddr/wan_netmask/wan_gateway/wl_ssid is directly passed by the attacker/so we can control the wan_ipaddr/wan_netmask/wan_gateway/wl_ssid leads to os command injection. The attack may be launched rem
can control the wan_ipaddr/wan_netmask/wan_gateway/wl_ssid leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314996 - https://vuldb.com/?ctiid.314996 - https://vuldb.com/?submit.603672 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_2/2.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_2/2.md#poc
CVE ID: CVE-2025-7083 State: PUBLISHED Published: 2025-07-06T15:32:05.292Z Last Updated: 2025-07-07T16:04:06.777Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp of the component webs. The manipulation of the argument command leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addition
he public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314997 - https://vuldb.com/?ctiid.314997 - https://vuldb.com/?submit.603673 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_3/3.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_3/3.md#poc
CVE ID: CVE-2025-7084 State: PUBLISHED Published: 2025-07-06T16:02:05.557Z Last Updated: 2025-07-07T16:03:36.843Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. This vulnerability affects the function formWpsStart of the file /goform/formWpsStart of the component webs. The manipulation of the argument pinCode leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not
ploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314998 - https://vuldb.com/?ctiid.314998 - https://vuldb.com/?submit.603674 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_4/4.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_4/4.md#poc
CVE ID: CVE-2025-7085 State: PUBLISHED Published: 2025-07-06T16:32:05.008Z Last Updated: 2025-07-07T16:03:05.839Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Belkin F9K1122 1.00.33. It has been rated as critical. This issue affects the function formiNICWpsStart of the file /goform/formiNICWpsStart of the component webs. The manipulation of the argument pinCode leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not re
it has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314999 - https://vuldb.com/?ctiid.314999 - https://vuldb.com/?submit.603694 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_5/5.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_5/5.md#poc
CVE ID: CVE-2025-7086 State: PUBLISHED Published: 2025-07-06T17:02:08.800Z Last Updated: 2025-07-07T13:51:05.989Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical has been found in Belkin F9K1122 1.00.33. Affected is the function formPPTPSetup of the file /goform/formPPTPSetup of the component webs. The manipulation of the argument pptpUserName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respo
has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315000 - https://vuldb.com/?ctiid.315000 - https://vuldb.com/?submit.603695 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_6/6.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_6/6.md#poc
CVE ID: CVE-2025-7087 State: PUBLISHED Published: 2025-07-06T17:32:05.280Z Last Updated: 2025-07-07T15:48:38.094Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in Belkin F9K1122 1.00.33. Affected by this vulnerability is the function formL2TPSetup of the file /goform/formL2TPSetup of the component webs. The manipulation of the argument L2TPUserName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did n
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315001 - https://vuldb.com/?ctiid.315001 - https://vuldb.com/?submit.603696 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_7/7.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_7/7.md#poc
CVE ID: CVE-2025-7088 State: PUBLISHED Published: 2025-07-06T18:02:06.558Z Last Updated: 2025-07-07T15:47:43.943Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, was found in Belkin F9K1122 1.00.33. This affects the function formPPPoESetup of the file /goform/formPPPoESetup of the component webs. The manipulation of the argument pppUserName leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but di
he exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.315003 - https://vuldb.com/?ctiid.315003 - https://vuldb.com/?submit.603697 - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_8/8.md - https://github.com/wudipjq/my_vuln/blob/main/Belkin/vuln_8/8.md#poc
CVE ID: CVE-2025-7089 State: PUBLISHED Published: 2025-07-06T18:32:04.914Z Last Updated: 2025-07-07T16:02:31.113Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1122 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. This issue affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component webs. The manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not