Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-61102 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T17:05:18.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1aw
- https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61102.md
CVE ID: CVE-2025-61103 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-28T17:11:14.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_lan_adj_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/
471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61103.md
CVE ID: CVE-2025-61104 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-28T17:11:41.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_unknown_tlv function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/B
ps://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61104.md
CVE ID: CVE-2025-61105 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T17:07:38.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/Bug
://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61105.md
CVE ID: CVE-2025-61106 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-28T17:12:10.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1a
- https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61106.md
CVE ID: CVE-2025-61107 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-28T17:13:29.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted LSA Update packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FRRouting/frr/pull/19480 - https://github.com/FRRouting/frr/issues/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.c
/19471 - https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aafc7e6b7c3daf3 - https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61107.md
CVE ID: CVE-2025-61113 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:40:07.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain sensitive user information (such as device identifiers and birthdays) and access private group information, including join credentials. Successful exploitation may result in privacy breaches and unauthorized access to restricted resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/TalkTalk-2619a473ecb28072b600dfcc7791
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/TalkTalk-2619a473ecb28072b600dfcc7791c9d2
CVE ID: CVE-2025-61114 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:46:47.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: 2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first character of the user_token, enabling attackers to brute force tokens and perform unauthorized queries on other user accounts. Successful exploitation could result in privacy breaches and unauthorized access to user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
vacy breaches and unauthorized access to user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/2nd-Line-2629a473ecb280739ecac2d316da666c
CVE ID: CVE-2025-61115 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:42:34.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an improper access control vulnerability in its login mechanism. The application does not properly validate user passwords during authentication, allowing attackers to bypass login checks and obtain valid session identifiers. Successful exploitation could result in unauthorized account access, privacy breaches, and misuse of the platform. Additional Analyst Notes: - CISA
d result in unauthorized account access, privacy breaches, and misuse of the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/ABC-Fine-Wine-Spirits-2629a473ecb2807787e2f2557e504c7d
CVE ID: CVE-2025-61116 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:41:17.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an improper access control vulnerability in its authentication mechanism. The app uses a Base64-encoded email address as the authorization credential, which can be manipulated by attackers to gain unauthorized access to user accounts. Successful exploitation could result in account compromise, privacy breaches, and misuse of the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: R
n account compromise, privacy breaches, and misuse of the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/AdForest-Classified-2629a473ecb2806cb787d3654f3e50b8
CVE ID: CVE-2025-61117 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:44:23.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful exploitation could result in unauthorized account access, privacy breaches, and misuse of the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/Senza-Keto-Fasting-2629a473ecb
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/Senza-Keto-Fasting-2629a473ecb28079bce0dab884d912a2
CVE ID: CVE-2025-61118 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:45:29.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data and groups. Successful exploitation could result in fake account creation, privacy breaches, and misuse of the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/mCarFix-Motori
the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/mCarFix-Motorists-App-2629a473ecb280ac8679c73098423cf0
CVE ID: CVE-2025-61119 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:49:42.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful exploitation could result in privacy breaches, unauthorized group access, and misuse of the platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/Kanova-2629a473ecb2801bac89ce99d
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/Kanova-2629a473ecb2801bac89ce99d0b30df7
CVE ID: CVE-2025-61120 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:52:38.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resources, and predictable verification codes make brute-force account logins feasible. Successful exploitation could result in account compromise, privacy breaches, and abuse of cloud resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/AG-L
use of cloud resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/AG-Life-Logger-2629a473ecb280c693e7d5d4a99de559
CVE ID: CVE-2025-61121 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:53:59.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handling of cloud service credentials may allow attackers to obtain them and carry out unauthorized actions, such as sensitive information disclosure and abuse of cloud resources. Successful exploitation could result in privacy breaches and misuse of the platform infrastructure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ches and misuse of the platform infrastructure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kar1oz.notion.site/Mobile-Scanner-2659a473ecb28058a9f3e06cff61781c
CVE ID: CVE-2025-61128 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:14:00.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow vulnerability in WAVLINK QUANTUM D3G/WL-WN530HG3 firmware M30HG3_V240730, and possibly other wavlink models allows attackers to execute arbitrary code via crafted referrer value POST to login.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/shinobu-alpha/6dd5ad7f83c16360f6564db0bc121e99
CVE ID: CVE-2025-61132 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T16:37:24.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning - https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a74
ost-header/exploiting/password-reset-poisoning - https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/auth/views.py#L131-L148 - https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/templates/auth/email/reset_password.html#L1-L8 - https://drive.google.com/file/d/1FmkctLdOTGMdy6GgLaTzfxemdVDeiA7J/view?usp=sharing - https://gist.github.com/BrookeYangRui/94c3bee0c2cbc1ed81a21d4448550c21
CVE ID: CVE-2025-61136 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T16:35:39.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation of the Host header when Flask's url_for(_external=True) generates reset links without a fixed SERVER_NAME. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning - https://drive.google.com/file/d/15X5L1uEqgWOLrjKqm96cEPAWp2ph0zJp/vie
/host-header/exploiting/password-reset-poisoning - https://drive.google.com/file/d/15X5L1uEqgWOLrjKqm96cEPAWp2ph0zJp/view?usp=sharing - https://github.com/axewater/sharewarez/blob/d04c90b7dc3fbae1596f731d1b168d3fb9fdd2df/modules/routes_login.py#L188-L217 - https://github.com/axewater/sharewarez/blob/d04c90b7dc3fbae1596f731d1b168d3fb9fdd2df/modules/utils_smtp.py#L191-L206 - https://gist.github.com/BrookeYangRui/145e529b5fd4f56af299efde37edf4fa
CVE ID: CVE-2025-61138 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T16:03:38.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Israel0x00/8a81ec98162e9ca8e4a3a6c8b4ef4762
CVE ID: CVE-2025-61141 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T21:02:01.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sqls-server/sqls/ - https://advisory.dw1.io/54/ - https://lukmanern.github.io/CVE-2025-61141.html
CVE ID: CVE-2025-61152 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T14:22:45.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A malicious actor can craft a forged token with arbitrary claims (e.g., is_admin=true) and bypass authentication checks, leading to privilege escalation or unauthorized access in applications that rely on python-jose for token validation. This issue is exploitable unless developers explicitly reject 'alg=none' tokens, which is not enforced by the library. Additional Analyst Notes: - CISA A
developers explicitly reject 'alg=none' tokens, which is not enforced by the library. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pypi.org/project/python-jose - https://github.com/javiermorales36/PoC-for-python-jose-alg-none-JWT-bypass-vulnerability/blob/main/CVE-2025-61152_Security_Advisory.md
CVE ID: CVE-2025-61155 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T14:21:55.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hotta Studio GameDriverX64.sys 7.23.4.7, a signed kernel-mode anti-cheat driver, allows local attackers to cause a denial of service by crashing arbitrary processes via sending crafted IOCTL requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gamedriverx64sys.com - http://hotta.com - https://github.com/pollotherunner/CVE-2025-61155/blob/main/advisory.md
CVE ID: CVE-2025-61156 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-30T14:28:08.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via an insecure IOCTL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://threatfire.informer.com/download/ - https://github.com/D7EAD - https://github.com/D7EAD/CVE-2025-61156
CVE ID: CVE-2025-61161 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T14:24:37.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLL hijacking vulnerability in Evope Collector 1.1.6.9.0 and related components load the wtsapi32.dll library from an uncontrolled search path (C:\ProgramData\Evope). This allows local unprivileged attackers to execute arbitrary code or escalate privileges to SYSTEM by placing a crafted DLL in that location. The vulnerable component is Evope.Service.exe, which runs with SYSTEM privileges and automatically loads the DLL on startup or reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evop
ly loads the DLL on startup or reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.evope.tech/ - https://xavilok.es/dll-hijacking-in-evopeservice--system-to-gui-shell
CVE ID: CVE-2025-61181 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:15:03.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jayfoxaa/yuhang-Zhou/blob/main/upload/readme.md
CVE ID: CVE-2025-61183 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-08T15:54:53.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/webreinvent/vaahcms/issues/301 - https://github.com/thawphone/CVE-2025-61183
CVE ID: CVE-2025-61188 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T20:19:14.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/JeecgBoot/issues/8826
CVE ID: CVE-2025-61189 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-01T20:20:03.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot/JeecgBoot/issues/8827
CVE ID: CVE-2025-61194 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:17:09.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wzy-most/zeyu-Wang/blob/main/sql/readme.md
CVE ID: CVE-2025-61196 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-31T14:42:04.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zsamamah/CVE-2025-61196/blob/main/CVE-2025-61196.md
CVE ID: CVE-2025-61197 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T14:48:16.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote attacker to escalate privileges via the application stores user privilege/role information in client-side browser storage Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.orban.com/ - https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-61197
CVE ID: CVE-2025-61198 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T14:30:54.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 - System version 2.5.26, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.orban.com/ - https://github.com/giulioschiavone/Vulnerability-Research/tree/main/C
lnrichment: References: - https://www.orban.com/ - https://github.com/giulioschiavone/Vulnerability-Research/tree/main/CVE-2025-61198