Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-40649 State: PUBLISHED Published: 2025-10-07T12:20:56.828Z Last Updated: 2025-10-07T14:19:58.142Z Vendors: BBMRI-ERIC Products: Negotiator Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations/<postUID>/posts'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
o an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator
CVE ID: CVE-2025-40650 State: PUBLISHED Published: 2025-05-26T12:51:32.391Z Last Updated: 2025-05-27T14:08:43.120Z Vendors: Clickedu Products: Clickedu Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) vulnerability in Clickedu. This vulnerability could allow an attacker to retrieve information about student report cards. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-idor-clickedu
CVE ID: CVE-2025-40651 State: PUBLISHED Published: 2025-05-28T13:24:22.092Z Last Updated: 2025-05-28T13:43:05.407Z Vendors: Real Easy Store Products: Real Easy Store Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/avi
user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-real-easy-store
CVE ID: CVE-2025-40652 State: PUBLISHED Published: 2025-05-26T12:52:43.162Z Last Updated: 2025-05-27T14:14:35.256Z Vendors: CoverManager Products: CoverManager Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. This allows an attacker to inject malicious scripts into the application, which are permanently stored on the server. The malicious scripts are executed in the browser of any user visiting the affected page without the user having to take any further action. This can allow the attacker to steal sensitive information, such as session cookies, login credentials, and perform actions on behalf of the affected user. Addi
sitive information, such as session cookies, login credentials, and perform actions on behalf of the affected user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-covermanager
CVE ID: CVE-2025-40653 State: PUBLISHED Published: 2025-05-26T12:54:08.905Z Last Updated: 2025-05-27T13:21:01.672Z Vendors: M3M Products: M3M Printer Server Web Problem Types: CWE-209 Description: User enumeration vulnerability in M3M Printer Server Web. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine whether a username is valid or not, allowing a brute force attack on valid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/user-enumeration-m3m-printer-server-web
CVE ID: CVE-2025-40654 State: PUBLISHED Published: 2025-06-10T10:01:14.010Z Last Updated: 2025-06-10T14:16:13.950Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name and cod parameters in /antbuspre.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40655 State: PUBLISHED Published: 2025-06-10T10:03:24.120Z Last Updated: 2025-06-10T14:13:50.233Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name parameter in /antcatalogue.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40656 State: PUBLISHED Published: 2025-06-10T10:03:49.029Z Last Updated: 2025-06-10T13:06:37.697Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the cod parameter in /administer/node-selection/data.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40657 State: PUBLISHED Published: 2025-06-10T10:04:09.279Z Last Updated: 2025-06-10T19:59:50.416Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-89 Description: A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the codform parameter in /modules/forms/collectform.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40658 State: PUBLISHED Published: 2025-06-10T10:05:46.265Z Last Updated: 2025-06-10T13:04:47.377Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-639 Description: An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelection.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40659 State: PUBLISHED Published: 2025-06-10T10:06:09.181Z Last Updated: 2025-06-10T14:05:38.619Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-639 Description: An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelectionNetworks.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40660 State: PUBLISHED Published: 2025-06-10T10:06:27.167Z Last Updated: 2025-06-10T14:04:26.591Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-639 Description: An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/select node/data.asp?mode=catalogue&id1=1&id2=1session=&cod=1&networks=0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40661 State: PUBLISHED Published: 2025-06-10T10:06:40.672Z Last Updated: 2025-06-10T14:33:03.683Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-639 Description: An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/selection.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40662 State: PUBLISHED Published: 2025-06-10T10:07:32.257Z Last Updated: 2025-06-10T14:30:35.767Z Vendors: Dmacroweb Products: DM Corporative CMS Problem Types: CWE-200 Description: Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a non-existent file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dm-corporative-cms-dmacroweb
CVE ID: CVE-2025-40663 State: PUBLISHED Published: 2025-05-26T12:55:30.974Z Last Updated: 2025-05-27T14:12:00.795Z Vendors: i2A Products: Cronos Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in i2A-Cronos version 23.02.01.17, from i2A. It allows an authenticated attacker to upload a malicious SVG image into the user's personal space in /CronosWeb/Modules/Persons/PersonalDocuments/PersonalDocuments. There is no reported fix at this time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-i2a-cronos-i2a
CVE ID: CVE-2025-40664 State: PUBLISHED Published: 2025-05-26T12:47:09.138Z Last Updated: 2025-05-27T14:23:32.119Z Vendors: TCMAN Products: GIM Problem Types: CWE-306 Description: Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /frmGestionUser.aspx/GetData, /frmGestionUser.aspx/updateUser and /frmGestionUser.aspx/DeleteUser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-0
CVE ID: CVE-2025-40665 State: PUBLISHED Published: 2025-05-26T12:48:08.755Z Last Updated: 2025-05-27T14:23:12.934Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in /GIMWeb/PC/frmCorrectivosList.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-0
CVE ID: CVE-2025-40666 State: PUBLISHED Published: 2025-05-26T12:48:21.940Z Last Updated: 2025-05-27T14:13:29.073Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update and delete databases through ArbolID parameter in/GIMWeb/PC/frmPreventivosList.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-0
CVE ID: CVE-2025-40667 State: PUBLISHED Published: 2025-05-26T12:49:49.315Z Last Updated: 2025-05-27T14:15:27.673Z Vendors: TCMAN Products: GIM Problem Types: CWE-862 Description: Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields hdnReadOnly and hdnUserLogin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcma
- CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-0
CVE ID: CVE-2025-40668 State: PUBLISHED Published: 2025-06-09T12:25:59.654Z Last Updated: 2025-06-09T13:03:21.122Z Vendors: TCMAN Products: GIM Problem Types: CWE-863 Description: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an attacker, with low privilege level, to change the password of other users through a POST request using the parameters idUser, PasswordActual, PasswordNew and PasswordNewRepeat in /PC/WebService.aspx/validateChangePassword%C3%B1a. To exploit the vulnerability the PasswordActual parameter must be empty. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulne
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1
CVE ID: CVE-2025-40669 State: PUBLISHED Published: 2025-06-09T12:26:11.761Z Last Updated: 2025-06-09T13:02:46.021Z Vendors: TCMAN Products: GIM Problem Types: CWE-863 Description: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&amp;Page=-1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1
CVE ID: CVE-2025-40670 State: PUBLISHED Published: 2025-06-09T12:26:28.525Z Last Updated: 2025-06-09T13:01:52.381Z Vendors: TCMAN Products: GIM Problem Types: CWE-863 Description: Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcman-gim-1
CVE ID: CVE-2025-40671 State: PUBLISHED Published: 2025-05-26T09:08:05.238Z Last Updated: 2025-06-04T09:56:16.212Z Vendors: AES Multimedia Products: Gestnet Problem Types: CWE-93 Description: SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘fk_remoto_central’ parameter on the ‘/webservices/articles.php’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-aes-multimedias-gestnet
CVE ID: CVE-2025-40672 State: PUBLISHED Published: 2025-05-26T09:05:40.862Z Last Updated: 2025-06-06T12:00:34.218Z Vendors: Grupo Espiral MS Products: Panloader.exe Problem Types: CWE-732 Description: A Privilege Escalation vulnerability has been found in Panloader component v3.24.0.0 by Espiral MS Group. This vulnerability allows any user to override the file panLoad.exe that will be executed by SYSTEM user via a programmed task. This would allow an attacker to obtain administrator permissions to perform whatever activities he/she wants, shuch as accessing sensitive information, executing code remotely, and even causing a denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnric
ation, executing code remotely, and even causing a denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-proactivanet-espiral-ms-group
CVE ID: CVE-2025-40673 State: PUBLISHED Published: 2025-05-28T10:54:46.595Z Last Updated: 2025-05-28T13:24:05.823Z Vendors: DinoRANK Products: DinoRANK Problem Types: CWE-862 Description: A Missing Authorization vulnerability has been found in DinoRANK. This vulnerability allows an attacker to access invoices of any user via accessing endpoint '/facturas/YYYY-MM/SDRYYMM-XXXXX.pdf' because there is no access control. The pdf filename can be obtained via OSINT, insecure network traffic or brute force. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/missing-authorization-dinorank
CVE ID: CVE-2025-40674 State: PUBLISHED Published: 2025-06-17T08:50:17.363Z Last Updated: 2025-06-17T14:31:48.511Z Vendors: osCommerce Products: osCommerce Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site
st Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-oscommerce
CVE ID: CVE-2025-40675 State: PUBLISHED Published: 2025-06-09T09:42:18.409Z Last Updated: 2025-06-09T17:54:50.032Z Vendors: Bagisto Products: Bagisto Problem Types: CWE-79 Description: A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflect
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-bagisto
CVE ID: CVE-2025-40676 State: PUBLISHED Published: 2025-10-07T12:21:37.629Z Last Updated: 2025-10-07T13:39:45.537Z Vendors: BBMRI-ERIC Products: Negotiator Problem Types: CWE-639 Description: Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in '/api/v3/users/<userID>', which may result in the exposure or alteration of sensitive data Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multip
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator
CVE ID: CVE-2025-40677 State: PUBLISHED Published: 2025-09-18T11:46:31.676Z Last Updated: 2025-09-18T13:28:42.489Z Vendors: Summar Software Products: Portal del Empleado Problem Types: CWE-89 Description: SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-summar-software-employee-portal
CVE ID: CVE-2025-40678 State: PUBLISHED Published: 2025-09-18T11:47:29.812Z Last Updated: 2025-09-18T13:27:07.847Z Vendors: Summar Software Products: Portal del Empleado Problem Types: CWE-434 Description: Unrestricted upload vulnerability for dangerous file types on Summar Software´s Portal del Empleado. This vulnerability allows an attacker to upload a dangerous file type by sending a POST request using the parameter “cctl00$ContentPlaceHolder1$fuAdjunto” in “/MemberPages/ntf_absentismo.aspx”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-summar-software-employee-portal
CVE ID: CVE-2025-40680 State: PUBLISHED Published: 2025-07-24T12:14:20.971Z Last Updated: 2025-07-24T13:01:30.427Z Vendors: Capillary io Products: CapillaryScope Problem Types: CWE-311 Description: Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract these sensitive values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/encryption-sensitive-data-capillaryscope-missing
CVE ID: CVE-2025-40681 State: PUBLISHED Published: 2025-11-13T12:57:00.745Z Last Updated: 2025-11-13T20:22:57.206Z Vendors: xCally Products: Omnichannel Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the victim's browser by sending them a malicious URL using the 'failureMessage' parameter in '/login'. This vulnerability can be exploited to steal sentitive user data, such as session cookies , or to perform actions on behalf of the user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cros
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-xcally-omnichannel
CVE ID: CVE-2025-40682 State: PUBLISHED Published: 2025-07-29T12:10:56.140Z Last Updated: 2025-07-29T13:40:18.561Z Vendors: Human Resource Management System Products: Human Resource Management System Problem Types: CWE-89 Description: SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE ID: CVE-2025-40683 State: PUBLISHED Published: 2025-07-29T12:12:23.418Z Last Updated: 2025-07-29T13:32:29.999Z Vendors: Human Resource Management System Products: Human Resource Management System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccity' parameter in /city.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system
CVE ID: CVE-2025-40684 State: PUBLISHED Published: 2025-07-29T12:12:34.325Z Last Updated: 2025-07-29T13:29:02.394Z Vendors: Human Resource Management System Products: Human Resource Management System Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccountry' parameter in/country.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-human-resource-management-system