Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-57087 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:44:41.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode parameter in the werlessAdvancedSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/W30E/werlessAdvancedSet.md
CVE ID: CVE-2025-57104 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T18:53:05.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teampel.com/ - https://gist.github.com/H-kiss-me/430ebedb3e6c2675d37dc1e211b78728
CVE ID: CVE-2025-57105 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:08:12.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - http://di-7400.com - https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B - https://github.com/xyh4ck/iot_poc
CVE ID: CVE-2025-57106 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T18:15:02.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.kitware.com/vtk/vtk/-/issues/19733 - https://gitlab.kitware.com/vtk/vtk/-/issues/19734
CVE ID: CVE-2025-57107 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T18:06:36.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.kitware.com/vtk/vtk/-/issues/19732
CVE ID: CVE-2025-57108 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T19:07:13.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.kitware.com/vtk/vtk/-/issues/19736
CVE ID: CVE-2025-57109 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T20:56:40.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.kitware.com/vtk/vtk/-/issues/19735
CVE ID: CVE-2025-57117 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-16T17:28:28.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the department.php page by injecting a malicious payload into the Department Name field under Add Department. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://employee.com - https://www.sourcecodester.com/ - https://github.com/Jazeye/CVE/blob/main/CVE-2025-57117/README.md
CVE ID: CVE-2025-57118 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-16T17:27:31.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/danielmiessler/SecLists/blob/master/Usernames/Names/names.txt - https://github.com/Jazeye/CVE/tree/main/CVE-2025-57118
CVE ID: CVE-2025-57119 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-17T13:45:35.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com - http://online.com - https://github.com/danielmiessler/SecLists/blob/master/Usernames/cirt-default-usernames.txt - https://github.com/Jazeye/CVE/blob/main/CVE-2025-57119/README.md
CVE ID: CVE-2025-57130 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T16:20:49.984Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://zwiicms.com - https://blog.nivel4.com/noticias/cve-2025-57130-
lyst Notes: - CISA ADP Vulnrichment: References: - http://zwiicms.com - https://blog.nivel4.com/noticias/cve-2025-57130-especialistas-de-nivel4-identifican-falla-de-alta-severidad-en-gestor-de-contenidos
CVE ID: CVE-2025-57140 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T13:34:19.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ruisibi/rsbi-pom - https://github.com/line2222/vuln/issues/5
CVE ID: CVE-2025-57141 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T15:10:17.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ruisibi/rsbi-os - https://github.com/line2222/vuln/issues/2
CVE ID: CVE-2025-57145 State: PUBLISHED Published: 2025-09-16T00:00:00.000Z Last Updated: 2025-09-16T18:32:52.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the backend and executed when a user or administrator accesses the affected report page. This allows attackers to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims bro
to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - http://auto.com - https://github.com/nandanacp/CVE-Collection/blob/main/CVE-2025-57145/README.md
CVE ID: CVE-2025-57146 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-04T14:31:58.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-12536/a7b1b87ee99576c
CVE ID: CVE-2025-57147 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T17:24:39.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-12556/5435bb675762866
CVE ID: CVE-2025-57148 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T17:31:06.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-12496/7fdf159633a77d1
CVE ID: CVE-2025-57149 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T15:00:23.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-12476/312c6ba68f555ca
CVE ID: CVE-2025-57150 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T14:57:34.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-12756/8bc08c993926810
CVE ID: CVE-2025-57151 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T14:44:31.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doc.clickup.com/3897127/p/h/3pxt7-12776/9223d87ec68de28
CVE ID: CVE-2025-57164 State: PUBLISHED Published: 2025-10-17T00:00:00.000Z Last Updated: 2025-10-17T19:31:49.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FlowiseAI/Flowise - https://github.com/FlowiseAI/Flowise/blob/main/packages/components/nodes/vectorstores/Supabase/Supabase.ts#L237 - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-7944-7c6r-55vv
CVE ID: CVE-2025-57174 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T18:44:44.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions. The rfpiped service listening on TCP port 555 which uses static AES encryption keys hardcoded in the binary. These keys are identical across all devices, allowing attackers to craft encrypted packets that execute arbitrary commands without authentication. This is a failed patch for CVE-2017-7318. This issue may affect other Etherhaul series devices with shared firmware.
n. This is a failed patch for CVE-2017-7318. This issue may affect other Etherhaul series devices with shared firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ceragon.com - http://etherhaul.com - https://semaja2.net/2025/08/02/siklu-eh-unauthenticated-rce/
CVE ID: CVE-2025-57176 State: PUBLISHED Published: 2025-09-15T00:00:00.000Z Last Updated: 2025-09-15T19:14:02.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rfpiped service on TCP port 555 in Ceragon Networks / Siklu Communication EtherHaul series (8010TX and 1200FX tested) Firmware 7.4.0 through 10.7.3 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ceragon.com - http://etherhaul.com
CVE ID: CVE-2025-57197 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-09-30T17:24:05.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the authentication PIN. This allows unauthorized users to change PIN without knowing the original/current PIN. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://payeer.com - https://drive.google.com/drive/folders
itional Analyst Notes: - CISA ADP Vulnrichment: References: - http://payeer.com - https://drive.google.com/drive/folders/1FHn4dFHeJ6W1IKlsB447v_hJoqqF9qgv?usp=sharing - https://payeer.com - https://medium.com/@mhamdanali81/cve-2025-57197-breaking-the-pin-in-payeers-android-app-31e3cdee02ef
CVE ID: CVE-2025-57203 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-24T19:08:03.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feature available to authenticated admin users. The vulnerability resides in the prompt parameter submitted to the /dashboard/user/generator/generate-stream endpoint via a multipart/form-data POST request. Due to insufficient input sanitization, attackers can inject HTML-based JavaScript payloads. This payload is stored and rendered unsanitized in subsequent views, leading to execution in other users' brows
ayloads. This payload is stored and rendered unsanitized in subsequent views, leading to execution in other users' browsers when they access affected content. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially leading to session hijacking, privilege escalation, data exfiltration, or administrative account takeover. The application does not implement a Content Security Policy (CSP) or adequate input filtering to prevent such attacks. A fix should include proper sanitization, output encoding, and strong CSP enforcement to mitigate exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codecanyo
enforcement to mitigate exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codecanyon.net/item/magicai-openai-content-text-image-chat-code-generator-as-saas/45408109
CVE ID: CVE-2025-57204 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-24T14:18:00.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standard POST form. Due to insufficient input sanitization and output encoding, attackers can inject HTML/JS payloads. The payload is stored and subsequently rendered unsanitized in downstream views, leading to JavaScript execution
yloads. The payload is stored and subsequently rendered unsanitized in downstream views, leading to JavaScript execution in other users' browsers when they access the affected product pages. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially enabling session hijacking, privilege escalation within the application, data exfiltration, or administrative account takeover. The application also lacks a restrictive Content Security Policy (CSP), increasing exploitability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codecanyon.net/item/stockyultimate-inventory-management-system-with-pos/31445124 - https:
ichment: References: - https://codecanyon.net/item/stockyultimate-inventory-management-system-with-pos/31445124 - https://grumpz.net/cve-2025-57204-stored-xss-in-stocky-pos-with-inventory-management-and-hrm-ui-lib-50
CVE ID: CVE-2025-57205 State: PUBLISHED Published: 2025-09-22T00:00:00.000Z Last Updated: 2025-09-24T19:06:13.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: iNiLabs School Express (SMS Express) 6.2 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/{id} endpoint (and similarly in Notice and Pages editors). Due to insufficient input sanitization and output encoding, attackers can inject HTML/JS payloads. The payload is saved and later rendered unsanitized, resulting in JavaScript execution in other users' b
ML/JS payloads. The payload is saved and later rendered unsanitized, resulting in JavaScript execution in other users' browsers when they access the affected content. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially leading to session hijacking, privilege escalation, data exfiltration, or administrative account takeover. The application does not enforce a restrictive Content Security Policy (CSP) or adequate filtering to prevent such attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codecanyon.net/item/inilabs-school-management-system-express/11630340 - https://grumpz.net/cve-2025-57205-sto
- https://codecanyon.net/item/inilabs-school-management-system-express/11630340 - https://grumpz.net/cve-2025-57205-stored-xss-in-inilabs-school-express-62-sms-express
CVE ID: CVE-2025-57215 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:17:48.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get_parentControl_list_Info. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenda.com.cn - https://plaid-knot-11b.notion.site/Heap-based-Buffer-Overflow-in-function-get_parentControl_list_Info-via-deviceId-parameter-Remote-at-23eb3e9cce328014a639f619bc14ed90
CVE ID: CVE-2025-57217 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:08:44.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://plaid-knot-11b.notion.site/Stack-Buffer-Overflow-in-login-Auth-via-Password-parameter-Remote-attacker-can-execute-arbitrary-c-23fb3e9cce32800ba969f8b3a9f80bda?source=copy_link
CVE ID: CVE-2025-57218 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:10:03.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://plaid-knot-11b.notion.site/Stack-Buffer-Overflow-in-goform-WifiBasicSet-via-Password-parameter-Remote-attacker-can-execute-ar-23fb3e9cce32807c883fc1b233e09eca?source=copy_link
CVE ID: CVE-2025-57219 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T19:56:47.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privileges or access sensitive components via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://plaid-knot-11b.notion.site/Unauthenticated-Remote-Access-to-ate-Debug-Interface-via-Improper-Access-Controls-in-Tenda-AC10-V4-23fb3e9cce328050a479e44a8c217a72?source=copy_link
CVE ID: CVE-2025-57220 State: PUBLISHED Published: 2025-08-28T00:00:00.000Z Last Updated: 2025-08-28T20:20:21.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileges to root via a crafted UDP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://plaid-knot-11b.notion.site/Unauthenticated-Remote-Root-Shell-via-Input-Validation-Flaw-in-ate-Service-on-Tenda-AC10-V4-0-23fb3e9cce32804d93aad7e79a82a7aa?source=copy_link
CVE ID: CVE-2025-57227 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T20:31:06.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1.5.8.3353 allows attackers to escalate privileges via placing a crafted executable file into a parent folder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51707
CVE ID: CVE-2025-57240 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T20:37:21.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the registration step. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/samllpotato1/xss/blob/main/xss.txt
CVE ID: CVE-2025-57244 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T19:57:23.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolffangsecurity/CVEs/blob/main/Stored%20XSS%20via%20Input%20Fields%20with%20Inconsistent%20Client-Side%20and%20Server-Side%20Validation%20Writeup.md -
Stored%20XSS%20via%20Input%20Fields%20with%20Inconsistent%20Client-Side%20and%20Server-Side%20Validation%20Writeup.md - https://github.com/wolffangsecurity/CVEs/tree/main/CVE-2025-57244