Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-45753 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-22T13:26:12.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import functionality in the Module Import feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.simonjuguna.com/cve-2025-45753-authenticated-remote-code-execution-vulnerability-in-vtiger-open-source-edition-v8-3-0/
CVE ID: CVE-2025-45754 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:40:42.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by creating a document with an XSS payload as the document name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.simonjuguna.com/cve-2025-45754-stored-cross-site-scripting-xss-vulnerability-in-seeddms-v6-0-32/
CVE ID: CVE-2025-45755 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T20:00:34.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in Vtiger CRM Open Source Edition v8.3.0, exploitable via the Services Import feature. An attacker can craft a malicious CSV file containing an XSS payload, mapped to the Service Name field. When the file is uploaded, the application improperly sanitizes user input, leading to persistent script execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vtiger.com/open-source-crm/ - https://www.simonjuguna.com/cve-2025-45755-stored-cross
ichment: References: - https://www.vtiger.com/open-source-crm/ - https://www.simonjuguna.com/cve-2025-45755-stored-cross-site-scripting-xss-vulnerability-in-vtiger-open-source-edition-v8-3-0/
CVE ID: CVE-2025-45764 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-26T18:51:17.741Z Severity: LOW (CVSS 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: jsrsasign project Products: jsrsasign Problem Types: CWE-326 Description: jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for key lengths in specific applications that use a library, and should not be assigned to the default key lengths in a library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this
eview under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/ZupeiNie/2250cf1758771d56272dc326ce066202 - https://github.com/kjur/jsrsasign/issues/634
CVE ID: CVE-2025-45765 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-12T14:10:04.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jwt/ruby-jwt/issues/668 - https://gist.github.com/ZupeiNie/c621253068ce5b64911629534879e8f9
CVE ID: CVE-2025-45766 State: PUBLISHED Published: 2025-08-06T00:00:00.000Z Last Updated: 2025-08-17T03:57:24.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pocoproject - https://github.com/pocoproject/poco - https://gist.github.com/ZupeiNie/9de26
erences: - https://github.com/pocoproject - https://github.com/pocoproject/poco - https://gist.github.com/ZupeiNie/9de26f17a5e135b50fa388999e912c42
CVE ID: CVE-2025-45767 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-21T15:27:28.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standards" does not reflect guidance in a final publication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/panva - https://github.com/panva/jose - https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d - https://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d?permalink_comment_id=5711572#gistcomment-5711572 - https
tps://gist.github.com/ZupeiNie/705a606fbb99f3bb8c9b51e5bc13c91d?permalink_comment_id=5711572#gistcomment-5711572 - https://github.com/panva/jose/discussions/813 - https://github.com/panva/jose/blob/1e36dd29e76511e06737e5d5d500d81e01a9c3d2/src/lib/check_key_length.ts#L6-L7
CVE ID: CVE-2025-45768 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-08-14T16:01:20.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jpadilla - https://github.com/jpadilla/pyjwt - https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569
CVE ID: CVE-2025-45769 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-08-17T03:59:12.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/firebase/php-jwt - https://github.com/firebase - https://gist.github.com/ZupeiNie/83756316c4c24
es: - https://github.com/firebase/php-jwt - https://github.com/firebase - https://gist.github.com/ZupeiNie/83756316c4c24fe97a50176a92608db3
CVE ID: CVE-2025-45770 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-08-17T04:00:19.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant to recommend an outcome for this CVE Record. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lcobucci - https://github.com/lcobucci/jwt - https://gist.github.com/ZupeiNie/cd88c827eef11a1618f8ba
https://github.com/lcobucci - https://github.com/lcobucci/jwt - https://gist.github.com/ZupeiNie/cd88c827eef11a1618f8baacccd240fb
CVE ID: CVE-2025-45777 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T14:20:51.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.chavaramatrimony.com/register-free - https://github.com/edwin-0990/CVE_ID/tree/main/CVE-2025-45777
CVE ID: CVE-2025-45778 State: PUBLISHED Published: 2025-08-01T00:00:00.000Z Last Updated: 2025-08-01T18:03:49.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://language.com - https://packetstorm.news/files/id/206262
CVE ID: CVE-2025-45779 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:01.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tendacn.com/us/download/detail-3782.html - https://github.com/sunyou-iot/iot-vul/blob/main/TendaAC10/CVE-2025-45779/README.md
CVE ID: CVE-2025-45784 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-18T14:25:38.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially leading to unauthorized access to device functions or user accounts. This vulnerability exists due to insecure storage of sensitive information in the firmware binary. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
storage of sensitive information in the firmware binary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://cybermaya.in/posts/Post-37/
CVE ID: CVE-2025-45786 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-18T14:56:37.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: Real Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://updategadh.com/free-projects/real-estate-management/ - https://gist.github.com/0xKunAlx0/a80bc7ec5acb2f19daa36257fedbcf11
CVE ID: CVE-2025-45787 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:18:16.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/tree/main/ToTolink/A3100R-1
CVE ID: CVE-2025-45788 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:19:56.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3100R-2/README.md
CVE ID: CVE-2025-45789 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:14:45.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3100R-3/README.md
CVE ID: CVE-2025-45790 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:10:57.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A3100R-4/README.md
CVE ID: CVE-2025-45797 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:05:30.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the NoticeUrl parameter in the setNoticeCfg interface of /lib/cste_modules/system.so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setNoticeCFG-NoticURL-buffer.md
CVE ID: CVE-2025-45798 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:03:02.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the /lib/cste_modules/system.so library, specifically in the processing of the IpTo parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setNoticeCFG-IpTo-command.md
CVE ID: CVE-2025-45800 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-12T15:56:29.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setDeviceName-deviceMac-command.md
CVE ID: CVE-2025-45805 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T18:35:40.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/doctor-appointment-management-system-using-php-and-mysql - https://github.com/mhsinj/CVE-2025-45805
CVE ID: CVE-2025-45809 State: PUBLISHED Published: 2025-07-03T00:00:00.000Z Last Updated: 2025-07-03T18:49:42.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: BerriAI litellm v1.65.4 was discovered to contain a SQL injection vulnerability via the /key/block endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shadia0/Patienc/blob/main/litellm/SQL_injection.md
CVE ID: CVE-2025-45813 State: PUBLISHED Published: 2025-07-02T00:00:00.000Z Last Updated: 2025-07-02T18:25:37.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.enensys.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-45813
CVE ID: CVE-2025-45814 State: PUBLISHED Published: 2025-07-02T00:00:00.000Z Last Updated: 2025-07-02T18:18:31.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://novelsat.com/ - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-45814
CVE ID: CVE-2025-45818 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:33:47.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/item_status.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/280 - https://github.com/christopherralinanggoman/cve-skripsi/blob/main/my_reports/slims-9-bulian-item-status-report.md
CVE ID: CVE-2025-45819 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:40:04.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/281 - https://github.com/christopherralinanggoman/cve-skripsi/blob/main/my_reports/slims-9-bulian-author-report.md
CVE ID: CVE-2025-45820 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:35:00.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/282 - https://github.com/christopherralinanggoman/cve-skripsi/blob/main/my_reports/slims-9-bulian-pop-author-edit-report.md
CVE ID: CVE-2025-45835 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:51.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the environment variable value CONTENT_LENGTH, causing the program to crash and potentially leading to a denial-of-service (DoS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Chinesexilinyu/Netis-WF2880-cgitest.cgi-Null-Pointer-Dereference-Vulnerability/tree/ma
References: - https://github.com/Chinesexilinyu/Netis-WF2880-cgitest.cgi-Null-Pointer-Dereference-Vulnerability/tree/main/1
CVE ID: CVE-2025-45841 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:39:03.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/ - https://github.com/regainer27/CVE-key/blob/main/bo1/README.md - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/225/ids/36.html
CVE ID: CVE-2025-45842 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T12:29:46.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/ - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/225/ids/36.html - https://github.com/regainer27/CVE-key/tree/main/bo3
CVE ID: CVE-2025-45843 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T12:36:56.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net/ - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/225/ids/36.html - https://github.com/regainer27/CVE-key/tree/main/bo2
CVE ID: CVE-2025-45844 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-13T14:13:51.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/225/ids/36.html - https://github.com/regainer27/CVE-key/tree/main/bo6
CVE ID: CVE-2025-45845 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-13T14:24:54.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.net - https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/225/ids/36.html - https://github.com/regainer27/CVE-key/tree/main/bo5
CVE ID: CVE-2025-45846 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-13T14:26:30.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the torrentsindex parameter in the formBTClinetSetting function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/CVE-key/tree/main/ALFA/AIP%20W512/bo4 - https://files.alfa.com.tw/?dir=%5B2%5D%20WiFi%20Home%20Router/AIP-W512
CVE ID: CVE-2025-45847 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-12T18:32:32.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the targetAPMac parameter in the formWsc function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://files.alfa.com.tw/?dir=%5B2%5D%20WiFi%20Home%20Router/AIP-W512 - https://github.com/regainer27/CVE-key/tree/main/ALFA/AIP%20W512/bo1
CVE ID: CVE-2025-45851 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-30T16:25:49.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint /ISAPI/Security/challenge. The vendor has stated that upgrading to V5.7.23_SP2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://crashpark.weebly.com/blog/hikvision-ip-camera-unauthenticated-denial-of-service-dos - https://assets.hikvision.com/prd/public/all/files/202506/releasenote%5CNetwork_Camera-V5.7.23_SP2_Release_Note-E
e-dos - https://assets.hikvision.com/prd/public/all/files/202506/releasenote%5CNetwork_Camera-V5.7.23_SP2_Release_Note-E8.pdf - https://www.hikvision.com/en/support/download/firmware/
CVE ID: CVE-2025-45854 State: PUBLISHED Published: 2025-06-03T00:00:00.000Z Last Updated: 2025-08-26T18:50:36.762Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: JEHc Products: JEHC-BPM Problem Types: CWE-862 Description: /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/jehc/JEHC-BPM - https://gist.github.com/Cafe-Tea/bc14b38f4bfd951de2979a24c3358460 - https://web.archive.org/web/20250604134020/https://gist.github.com/Cafe-Tea/bc14b38f4bfd951de2979a24c3358460/revisions