Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9132 State: PUBLISHED Published: 2025-08-20T00:41:12.141Z Last Updated: 2025-08-21T13:44:33.225Z Vendors: Google Products: Chrome Problem Types: CWE-787 Description: Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/436181695
CVE ID: CVE-2025-9133 State: PUBLISHED Published: 2025-10-21T01:57:20.265Z Last Updated: 2025-10-22T03:55:27.044Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware Problem Types: CWE-862 Description: A missing authorization vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.40, USG FLEX series firmware versions from V4.50 through V5.40, USG FLEX 50(W) series firmware versions from V4.16 through V5.40, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has c
, and USG20(W)-VPN series firmware versions from V4.16 through V5.40 could allow a semi-authenticated attacker—who has completed only the first stage of the two-factor authentication (2FA) process—to view and download the system configuration from an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-missing-authorization-vulnerabilities-in-zld-firewalls-10-21-2025
CVE ID: CVE-2025-9134 State: PUBLISHED Published: 2025-08-19T10:32:06.355Z Last Updated: 2025-08-19T13:17:45.555Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: AfterShip Products: Package Tracker App Problem Types: CWE-926 Description: A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper export of android application components. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The vendor was contac
. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and replied: "After reviewing your report, we have confirmed that this vulnerability does indeed exist and we are actively working to fix it." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320514 - https://vuldb.com/?ctiid.320514 - https://vuldb.com/?submit.615253 - https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md - https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce
CVE ID: CVE-2025-9135 State: PUBLISHED Published: 2025-08-19T11:02:06.400Z Last Updated: 2025-09-13T15:04:59.517Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: Verkehrsauskunft Österreich Products: SmartRide, cleVVVer, BusBahnBim, Salzburg Verkehr Problem Types: CWE-926 Description: A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is
n improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320515 - https://vuldb.com/?ctiid.320515 - https://vuldb.com/?submit.615276 - https://vuldb.com/?submit.615278 - https://vuldb.com/?submit.628235 - https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md - https
278 - https://vuldb.com/?submit.628235 - https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md - https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce
CVE ID: CVE-2025-9136 State: PUBLISHED Published: 2025-08-19T11:32:08.147Z Last Updated: 2025-08-19T13:15:15.055Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C) Vendors: libretro Products: RetroArch Problem Types: CWE-125, CWE-119 Description: A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.20.0. This affects the function filestream_vscanf of the file libretro-common/streams/file_stream.c. This manipulation causes out-of-bounds read. The attack needs to be launched locally. Upgrading to version 1.21.0 mitigates this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320516 - https://vuldb.com/?ctiid.320516 - https://vuldb.com/?submit.617657 - https://github.com/libretro/RetroArch/pull/17555 - https://github.com/libretro/RetroArch/pull/17555#issuecomment-2651403849 - https://github.com/libretro/RetroArch/pull/17555/commits/6446f045ec7fc6a5cac3e8ec35a2f0a5889c88e8 - https://github.com/libretro/RetroArch/releases/tag/v1.21.0
CVE ID: CVE-2025-9137 State: PUBLISHED Published: 2025-08-19T12:02:06.817Z Last Updated: 2025-08-26T15:09:34.681Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Scada-LTS 2.7.8.1. This impacts an unknown function of the file scheduled_events.shtm. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardle
ks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320517 - https://vuldb.com/?ctiid.320517 - https://vuldb.com/?submit.620487 - https://karinagante.github.io/cve-2025-9137/ -
7 - https://vuldb.com/?ctiid.320517 - https://vuldb.com/?submit.620487 - https://karinagante.github.io/cve-2025-9137/ - https://karinagante.github.io/cve-2025-9137/#proof-of-concept-poc
CVE ID: CVE-2025-9138 State: PUBLISHED Published: 2025-08-19T12:32:06.416Z Last Updated: 2025-08-23T08:11:56.784Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, rega
risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320518 - https://vuldb.com/?ctiid.320518 - https://vuldb.com/?submit.620516 - https://karinagante.github.io/cve-2025-9138
20518 - https://vuldb.com/?ctiid.320518 - https://vuldb.com/?submit.620516 - https://karinagante.github.io/cve-2025-9138/ - https://karinagante.github.io/cve-2025-9138/#proof-of-concept-poc
CVE ID: CVE-2025-9139 State: PUBLISHED Published: 2025-08-19T13:02:06.113Z Last Updated: 2025-08-29T21:05:43.218Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: n/a Products: Scada-LTS Problem Types: CWE-200, CWE-284 Description: A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to b
as been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320519 - https://vuldb.com/?ctiid.320519 - https://vuldb.com/?submit.621062 - https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/%20CVE-2025-9139.md
CVE ID: CVE-2025-9140 State: PUBLISHED Published: 2025-08-19T13:32:06.591Z Last Updated: 2025-08-28T17:15:34.419Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Shanghai Lingdang Information Technology Products: Lingdang CRM Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this issue is some unknown functionality of the file /crm/crmapi/erp/tabdetail_moduleSave.php. The manipulation of the argument getvaluestring leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to versi
It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 8.6.5.4 can resolve this issue. The affected component should be upgraded. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.320520 - https://vuldb.com/?ctiid.320520 - https://vuldb.com/?submit.628087 - https://www.notion.so/SQL2-2459bb66b0a5802ba8e9ca5bc775fc7d?source=copy_link
CVE ID: CVE-2025-9143 State: PUBLISHED Published: 2025-08-19T15:02:06.334Z Last Updated: 2025-08-23T08:11:58.875Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/userList/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320521 - https://vuldb.com/?ctiid.32
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320521 - https://vuldb.com/?ctiid.320521 - https://vuldb.com/?submit.628437 - https://karinagante.github.io/cve-2025-9143/ - https://karinagante.github.io/cve-2025-9143/#proof-of-concept-poc
CVE ID: CVE-2025-9144 State: PUBLISHED Published: 2025-08-19T15:02:08.496Z Last Updated: 2025-08-23T08:12:01.130Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisher_edit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320522 - https://vuldb.com/?ctiid.320522 - https:
st Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320522 - https://vuldb.com/?ctiid.320522 - https://vuldb.com/?submit.628445 - https://karinagante.github.io/cve-2025-9144/ - https://karinagante.github.io/cve-2025-9144/#proof-of-concept-poc
CVE ID: CVE-2025-9145 State: PUBLISHED Published: 2025-08-19T15:32:07.391Z Last Updated: 2025-08-27T16:51:39.509Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file view_edit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320523 -
ublicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320523 - https://vuldb.com/?ctiid.320523 - https://vuldb.com/?submit.628448 - https://karinagante.github.io/cve-2025-9145/ - https://karinagante.github.io/cve-2025-9145/#proof-of-concept-poc
CVE ID: CVE-2025-9146 State: PUBLISHED Published: 2025-08-19T16:02:06.364Z Last Updated: 2025-08-19T19:20:28.216Z Severity: N/A (CVSS 6.8 AV:N/AC:H/Au:M/C:C/I:C/A:C/E:ND/RL:ND/RC:UR) Vendors: Linksys Products: E5600 Problem Types: CWE-327, CWE-310 Description: A flaw has been found in Linksys E5600 1.1.0.26. The affected element is the function verify_gemtek_header of the file checkFw.sh of the component Firmware Handler. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in a
exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320525 - https://vuldb.com/?ctiid.320525 - https://vuldb.com/?submit.628642 - https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Linksys/E5600.md - https://www.linksys.com/
CVE ID: CVE-2025-9147 State: PUBLISHED Published: 2025-08-19T16:32:06.108Z Last Updated: 2025-08-19T19:19:07.220Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: jasonclark Products: getsemantic Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d. The impacted element is an unknown function of the file /index.php. The manipulation of the argument view leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so versio
closed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320526 - https://vuldb.com/?ctiid.320526 - https://vuldb.com/?submit.628786
CVE ID: CVE-2025-9148 State: PUBLISHED Published: 2025-08-19T17:02:06.237Z Last Updated: 2025-08-19T20:01:27.018Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodePhiliaX Products: Chat2DB Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in an
t has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320527 - https://vuldb.com/?ctiid.320527 - https://vuldb.com/?submit.628912 - https://hip-motorcycle-97a.notion.site/Chat2DB-H2-JDBC-Connection-Remote-Code-Execution-2465f5e4caac80999d51dc98e8fc935f
CVE ID: CVE-2025-9149 State: PUBLISHED Published: 2025-08-19T17:32:06.085Z Last Updated: 2025-08-19T20:02:23.147Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Wavlink Products: WL-NU516U1 Problem Types: CWE-77, CWE-74 Description: A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320528 - https://vuldb.co
ilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320528 - https://vuldb.com/?ctiid.320528 - https://vuldb.com/?submit.629181 - https://github.com/lin-3-start/lin-cve/blob/main/Wavlink/Wavlink.md - https://github.com/lin-3-start/lin-cve/blob/main/Wavlink/Wavlink.md#poc
CVE ID: CVE-2025-9150 State: PUBLISHED Published: 2025-08-19T17:32:08.223Z Last Updated: 2025-08-19T20:03:01.620Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Surbowl Products: dormitory-management-php Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Surbowl dormitory-management-php up to 9f1d9d1f528cabffc66fda3652c56ff327fda317. Affected is an unknown function of the file /admin/violation_add.php?id=2. Such manipulation of the argument ID leads to sql injection. The attack may be performed from a remote location. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous del
. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320529 - https://vuldb.com/?ctiid.320529 - https://vuldb.com/?submit.629618 - https://github.com/xinzfy/cve/issues/1
CVE ID: CVE-2025-9151 State: PUBLISHED Published: 2025-08-19T18:02:06.380Z Last Updated: 2025-08-19T18:38:36.382Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: LiuYuYang01 Products: ThriveX-Blog Problem Types: CWE-285, CWE-266 Description: A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /web_config/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not resp
been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320530 - https://vuldb.com/?ctiid.320530 - https://vuldb.com/?submit.629873 - https://github.com/echo0d/vulnerability/blob/main/LiuYuYang01_ThriveX-Blog/IncorrectAuthorization.md - https://github.com/echo0d/vulnerability/blob/main/LiuYuYang01_ThriveX-Blog/IncorrectAuthorization.md#poc
CVE ID: CVE-2025-9152 State: PUBLISHED Published: 2025-10-16T12:37:00.966Z Last Updated: 2025-10-17T16:00:41.854Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WSO2 Products: WSO2 API Manager, WSO2 API Control Plane Description: An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations. Additional Analyst Notes: - CISA ADP Vulnri
to administrative access and the ability to perform unauthorized operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483/
CVE ID: CVE-2025-9153 State: PUBLISHED Published: 2025-08-19T18:32:08.442Z Last Updated: 2025-08-19T19:24:56.741Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Tour and Travel Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
otely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320533 - https://vuldb.com/?ctiid.320533 - https://vuldb.com/?submit.630200 - https://github.com/HjsCS/CVE/issues/4 - https://itsourcecode.com/
CVE ID: CVE-2025-9154 State: PUBLISHED Published: 2025-08-19T19:02:06.287Z Last Updated: 2025-08-19T19:25:28.580Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Tour and Travel Management System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /user/page-login.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3205
n published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320534 - https://vuldb.com/?ctiid.320534 - https://vuldb.com/?submit.630201 - https://github.com/HjsCS/CVE/issues/3 - https://itsourcecode.com/