Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49991 State: PUBLISHED Published: 2025-06-20T15:04:07.772Z Last Updated: 2025-06-23T17:15:46.241Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: tggfref Products: WP-Recall Problem Types: CWE-862 Description: Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-recall/vulnerability/wordpress-wp-recall-plugin-16-26-14-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49992 State: PUBLISHED Published: 2025-10-22T14:32:21.965Z Last Updated: 2025-11-13T10:33:41.725Z Vendors: ThimPress Products: LearnPress Export Import Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through <= 4.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/learnpress-import-export/vulnerability/wordpress-learnpress-export-import-plugin-4-0-8-cross-site-scripting-xss-vulnerabili
rnpress-import-export/vulnerability/wordpress-learnpress-export-import-plugin-4-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49993 State: PUBLISHED Published: 2025-06-20T15:04:07.297Z Last Updated: 2025-06-23T17:16:05.311Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Cookie Script Products: Cookie-Script.com Problem Types: CWE-862 Description: Missing Authorization vulnerability in Cookie Script Cookie-Script.com allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cookie-Script.com: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cookie-script-com/vulnerability/wordpress-cookie-script-com-plugin-1-2-1-broken-access-control-vulnerabil
rdpress/plugin/cookie-script-com/vulnerability/wordpress-cookie-script-com-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49995 State: PUBLISHED Published: 2025-06-20T15:04:06.831Z Last Updated: 2025-06-23T17:17:35.753Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dFactory Products: Download Attachments Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Download Attachments: from n/a through 1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/download-attachments/vulnerability/wordpress-download-attachments-plugin-1-3-1-
patchstack.com/database/wordpress/plugin/download-attachments/vulnerability/wordpress-download-attachments-plugin-1-3-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-49996 State: PUBLISHED Published: 2025-06-20T15:04:06.330Z Last Updated: 2025-06-23T15:30:40.992Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: osama.esh Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-862 Description: Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor
ment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-7-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49997 State: PUBLISHED Published: 2025-06-20T15:04:05.866Z Last Updated: 2025-06-23T15:30:57.505Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Syed Balkhi Products: Giveaways and Contests by RafflePress Problem Types: CWE-862 Description: Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rafflepress/vulnerability/wordpress-giveaways-and-conte
: References: - https://patchstack.com/database/wordpress/plugin/rafflepress/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-17-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49998 State: PUBLISHED Published: 2025-06-20T15:04:05.400Z Last Updated: 2025-06-23T15:31:12.956Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Wetail Products: WooCommerce Fortnox Integration Problem Types: CWE-862 Description: Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Fortnox Integration: from n/a through 4.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-fortnox-integration/vulnerability/wordpress-woocommerce-fortnox-i
//patchstack.com/database/wordpress/plugin/woocommerce-fortnox-integration/vulnerability/wordpress-woocommerce-fortnox-integration-plugin-4-5-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-4000 State: PUBLISHED Published: 2025-04-28T04:00:07.125Z Last Updated: 2025-04-28T18:03:05.287Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Seeyon Products: Zhiyuan OA Web Application System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. Affected is an unknown function of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\ssoproxy\jsp\ssoproxy.jsp. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analys
possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306336 - https://vuldb.com/?ctiid.306336 - https://vuldb.com/?submit.558067 - https://wx.mail.qq.com/s?k=g1PB2UUAekANSMkHzr
CVE ID: CVE-2025-4001 State: PUBLISHED Published: 2025-04-28T04:31:05.040Z Last Updated: 2025-04-28T14:23:32.919Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: scipopt Products: scip Problem Types: CWE-769, CWE-400 Description: A vulnerability has been found in scipopt scip up to 9.2.1 and classified as problematic. Affected by this vulnerability is the function main of the file examples/LOP/src/genRandomLOPInstance.c of the component File Descriptor Handler. The manipulation of the argument File leads to uncontrolled file descriptor consumption. Local access is required to approach this attack. Upgrading to version 9.2.2 is able to address this issue. The id
tion. Local access is required to approach this attack. Upgrading to version 9.2.2 is able to address this issue. The identifier of the patch is d6da63b941216d75fbc1aefea9abf1de6712a2d0. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306337 - https://vuldb.com/?ctiid.306337 - https://vuldb.com/?submit.558121 - https://github.com/scipopt/scip/issues/130 - https://github.com/scipopt/scip/issues/130#issuecomment-2697893742 - https://github.com/scipopt/scip/commit/d6da63b941216d75fbc1aefea9abf1de6712a2d0 - https://github.com/scipopt/scip/releases/tag/v922
CVE ID: CVE-2025-4002 State: PUBLISHED Published: 2025-04-28T05:00:07.032Z Last Updated: 2025-04-28T14:22:13.128Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: RefindPlusRepo Products: RefindPlus Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB and classified as problematic. Affected by this issue is the function GetDebugLogFile of the file Library/MemLogLib/BootLog.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The patch is identified as d2143a1e2deefddd9b105fb7160763c4f8d47ea2. It is recommended to apply a patch to fix this issue. Additional Analyst N
as d2143a1e2deefddd9b105fb7160763c4f8d47ea2. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306338 - https://vuldb.com/?ctiid.306338 - https://vuldb.com/?submit.558122 - https://github.com/RefindPlusRepo/RefindPlus/issues/204 - https://github.com/RefindPlusRepo/RefindPlus/issues/204#issuecomment-2696817643 - https://github.com/RefindPlusRepo/RefindPlus/commit/d2143a1e2deefddd9b105fb7160763c4f8d47ea2
CVE ID: CVE-2025-4003 State: PUBLISHED Published: 2025-04-28T05:31:05.213Z Last Updated: 2025-04-28T14:21:14.276Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: RefindPlusRepo Products: RefindPlus Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB. It has been classified as problematic. This affects the function InternalApfsTranslateBlock of the file Library/RP_ApfsLib/RP_ApfsIo.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The patch is named 4d35125ca689a255647e9033dd60c257d26df7cb. It is recommended to apply a patch to fix this issue.
host. The patch is named 4d35125ca689a255647e9033dd60c257d26df7cb. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306339 - https://vuldb.com/?ctiid.306339 - https://vuldb.com/?submit.558123 - https://github.com/RefindPlusRepo/RefindPlus/issues/206 - https://github.com/RefindPlusRepo/RefindPlus/issues/206#event-16595888967 - https://github.com/RefindPlusRepo/RefindPlus/commit/4d35125ca689a255647e9033dd60c257d26df7cb
CVE ID: CVE-2025-4004 State: PUBLISHED Published: 2025-04-28T06:00:07.575Z Last Updated: 2025-05-02T10:48:11.321Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst
exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306340 - https://vuldb.com/?ctiid.306340 - https://vuldb.com/?submit.558125 - https://github.com/wyl091256/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4005 State: PUBLISHED Published: 2025-04-28T06:31:06.157Z Last Updated: 2025-04-28T14:10:50.310Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: COVID19 Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul COVID19 Testing Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /patient-report.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306341 - https://vuldb.com/?ctiid.306341 - https://vuldb.com/?submit.558126 - https://github.com/wyl091256/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4006 State: PUBLISHED Published: 2025-04-28T07:00:08.315Z Last Updated: 2025-04-28T14:09:50.785Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: youyiio Products: BeyongCms Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in youyiio BeyongCms 1.6.0. Affected is an unknown function of the file /admin/theme/Upload.html of the component Document Management Page. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306342 - https://vuldb.com/?ctiid.306342 - https://vuldb.com/?submit.558152 - https://wiki.shikangsi.com/post/share/7e2d3cf9-6463-4331-a1f5-c270d5695266
CVE ID: CVE-2025-4007 State: PUBLISHED Published: 2025-04-28T07:31:05.788Z Last Updated: 2025-04-28T16:16:02.573Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W12, i24 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in Tenda W12 and i24 3.0.0.4(2887)/3.0.0.5(3644). Affected by this vulnerability is the function cgidhcpsCfgSet of the file /goform/modules of the component httpd. The manipulation of the argument json leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306343 - https://vuldb.com/?ctiid.306343 - https://vuldb.com/?submit.558165 - https://github.com/02Tn/vul/issues/5 - https://www.tenda.com.cn/
CVE ID: CVE-2025-4008 State: PUBLISHED Published: 2025-05-21T15:31:23.118Z Last Updated: 2025-10-21T22:55:14.636Z Vendors: Smartbedded Products: MeteoBridge Problem Types: CWE-77, CWE-306 Description: The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com
es ( root ) on affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 - https://forum.meteohub.de/viewtopic.php?t=18687
CVE ID: CVE-2025-4009 State: PUBLISHED Published: 2025-05-28T07:00:32.896Z Last Updated: 2025-09-12T13:49:31.997Z Vendors: Evertz Products: 3080ipx-10G, MViP-II, cVIP, 7890IXG, CC Access Server, 5782XPS-APP-4E Problem Types: CWE-77 Description: The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among other features. The application has been developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vuln
en developed in PHP with the webEASY SDK, also named ‘ewb’ by Evertz. This web interface has two endpoints that are vulnerable to arbitrary command injection (CVE-2025-4009, CVE-2025-10364) and the authentication mechanism has a flaw leading to authentication bypass (CVE-2025-10365). CVE-2025-4009 covers the command injection in feature-transfer-import.php CVE-2025-10364 covers the command injection in feature-transfer-export.php Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices. This level of access could lead to serious business impact such as the interruption of media streaming, modification of media being streamed,
CVE ID: CVE-2025-4010 State: PUBLISHED Published: 2025-06-02T07:00:52.366Z Last Updated: 2025-06-02T13:33:15.587Z Vendors: Netcomm Products: NTC 6200, NWL-222 Problem Types: CWE-77 Description: The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to arbitrary command injection and use insecure hardcoded passwords. Remote authenticated attackers can gain arbitrary code execution with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.onekey.com/resource/security-advisory-remote-command-execution-on-netcomm-ntc-6200-and-nwl-222
CVE ID: CVE-2025-4011 State: PUBLISHED Published: 2025-04-28T08:00:11.964Z Last Updated: 2025-04-28T16:12:33.949Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Redmine Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.0.4 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
t is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306364 - https://vuldb.com/?ctiid.306364 - https://vuldb.com/?submit.558240 - https://www.redmine.org/issues/42238 - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://www.redmine.org/versions/206
CVE ID: CVE-2025-4012 State: PUBLISHED Published: 2025-04-28T08:31:04.539Z Last Updated: 2025-04-28T15:59:57.756Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: playeduxyz Products: PlayEdu 开源培训系统 Problem Types: CWE-918 Description: A vulnerability was found in playeduxyz PlayEdu 开源培训系统 up to 1.8 and classified as problematic. This issue affects some unknown processing of the file /api/backend/v1/user/create of the component User Avatar Handler. The manipulation of the argument Avatar leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but d
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306365 - https://vuldb.com/?ctiid.306365 - https://vuldb.com/?submit.558283 - https://github.com/Bae-ke/cve/issues/3
CVE ID: CVE-2025-4013 State: PUBLISHED Published: 2025-04-28T09:00:08.171Z Last Updated: 2025-04-28T13:12:06.160Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Art Gallery Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306366 - https://vuldb.com/?ctiid.306366 - https://vuldb.com/?submit.558348 - https://github.com/ljfhhh/CVE/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-4014 State: PUBLISHED Published: 2025-04-28T09:31:06.712Z Last Updated: 2025-04-28T12:33:22.710Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Art Gallery Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/manage-art-medium.php. The manipulation of the argument artmed leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306367 - https://vuldb.com/?ctiid.306367 - https://vuldb.com/?submit.558350 - https://github.com/ljfhhh/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-4015 State: PUBLISHED Published: 2025-04-28T10:00:09.386Z Last Updated: 2025-04-28T12:10:46.391Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: 20120630 Products: Novel-Plus Problem Types: CWE-306, CWE-287 Description: A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was
tion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306368 - https://vuldb.com/?ctiid.306368 - https://vuldb.com/?submit.558367 - https://www.cnblogs.com/aibot/p/18827501
CVE ID: CVE-2025-4016 State: PUBLISHED Published: 2025-04-28T10:31:05.659Z Last Updated: 2025-04-28T12:09:17.582Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: 20120630 Products: Novel-Plus Problem Types: CWE-285, CWE-266 Description: A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIndex of the file novel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about th
e attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306369 - https://vuldb.com/?ctiid.306369 - https://vuldb.com/?submit.558375 - https://www.cnblogs.com/aibot/p/18827506