Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sue has been patched in version 8.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7 - https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412
CVE ID: CVE-2025-48384 State: PUBLISHED Published: 2025-07-08T18:23:48.710Z Last Updated: 2025-11-04T21:11:00.255Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: git Products: git Problem Types: CWE-436, CWE-59 Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path cont
oted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6q
DP Vulnrichment: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9
CVE ID: CVE-2025-48385 State: PUBLISHED Published: 2025-07-08T18:23:44.405Z Last Updated: 2025-11-04T21:11:01.641Z Vendors: git Products: git Problem Types: CWE-88, CWE-73 Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the cl
advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is
a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655
CVE ID: CVE-2025-48386 State: PUBLISHED Published: 2025-07-08T18:23:41.246Z Last Updated: 2025-11-04T21:11:02.964Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: git Products: git Problem Types: CWE-120 Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potent
operly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr
CVE ID: CVE-2025-48387 State: PUBLISHED Published: 2025-06-02T19:20:18.220Z Last Updated: 2025-11-03T20:04:45.253Z Vendors: mafintosh Products: tar-fs Problem Types: CWE-22 Description: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore non files/directories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v - https://github.com/google/s
References: - https://github.com/mafintosh/tar-fs/security/advisories/GHSA-8cj5-5rvv-wf4v - https://github.com/google/security-research/security/advisories/GHSA-xrg4-qp5w-2c3w - https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f
CVE ID: CVE-2025-48388 State: PUBLISHED Published: 2025-05-29T09:16:25.163Z Last Updated: 2025-05-29T13:39:08.939Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-134, CWE-93 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of user-supplied data, which is used as arguments to string formatting functions. As a result, an attacker can pass a string containing special symbols (\r, \n, \t)to the application. This issue has been patched in version 1.8.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-c76f-wggm-grcq - https://github.com/freescout-help-desk/freescout/commit/eab97711027fff4bce90ccd2e189cbc184fa0370
CVE ID: CVE-2025-48389 State: PUBLISHED Published: 2025-05-29T15:12:16.578Z Last Updated: 2025-05-30T22:03:18.131Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-502 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrusted data due to insufficient validation. Through the set function, a string with a serialized object can be passed, and when getting an option through the get method, deserialization will occur, which will allow arbitrary code execution This issue has been patched in version 1.8.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gi
s issue has been patched in version 1.8.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jmpv-8q3h-2m8v - https://github.com/freescout-help-desk/freescout/commit/f7548a7076a0b6e109001069d6be223fbd96c61e
CVE ID: CVE-2025-48390 State: PUBLISHED Published: 2025-05-29T15:15:03.629Z Last Updated: 2025-05-30T22:03:12.671Z Vendors: freescout-help-desk Products: freescout Problem Types: CWE-94 Description: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validation of user input in the php_path parameter. The backticks characters are not removed, as well as tabulation is not removed. When checking user input, the file_exists function is also called to check for the presence of such a file (folder) in the file system. A user with the administrator role can create a translation for the language, which
a file (folder) in the file system. A user with the administrator role can create a translation for the language, which will create a folder in the file system. Further in tools.php, the user can specify the path to this folder as php_path, which will lead to the execution of code in backticks. This issue has been patched in version 1.8.178. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5324-cw55-gwj5 - https://github.com/freescout-help-desk/freescout/commit/fb33d672a2d67f5a2b3cf69c80945267f17908b2
CVE ID: CVE-2025-48391 State: PUBLISHED Published: 2025-05-20T17:37:42.265Z Last Updated: 2025-05-20T17:51:27.480Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-306 Description: In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2025-48392 State: PUBLISHED Published: 2025-09-24T07:59:52.592Z Last Updated: 2025-11-04T21:11:04.278Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: DoS Vulnerability Description: A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/1rn0637hptglmctf8cqd9425bj4q21td
CVE ID: CVE-2025-48393 State: PUBLISHED Published: 2025-08-06T15:25:17.947Z Last Updated: 2025-08-06T15:52:52.971Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: Eaton Products: G4 PDU Problem Types: CWE-295 Description: The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Man-in-the-middle attack. This security issue has been fixed in the latest version which is available on the Eaton download center. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulle
P Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1002.pdf
CVE ID: CVE-2025-48394 State: PUBLISHED Published: 2025-08-06T15:25:41.219Z Last Updated: 2025-08-06T15:50:01.680Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Eaton Products: G4 PDU Problem Types: CWE-22 Description: An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version which is available on the Eaton download center. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1002.pdf
CVE ID: CVE-2025-48395 State: PUBLISHED Published: 2025-09-05T07:05:18.846Z Last Updated: 2025-09-05T13:29:15.610Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Eaton Products: NMC G2 Problem Types: CWE-22 Description: An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-202
References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1003.pdf
CVE ID: CVE-2025-48396 State: PUBLISHED Published: 2025-11-03T07:57:22.765Z Last Updated: 2025-11-04T10:44:25.658Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Eaton Products: Eaton Brightlayer Software Suite (BLSS) Problem Types: CWE-434 Description: Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1021.pdf
CVE ID: CVE-2025-48397 State: PUBLISHED Published: 2025-11-03T08:28:53.084Z Last Updated: 2025-11-03T15:48:09.729Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Eaton Products: Eaton Brightlayer Software Suite (BLSS) Problem Types: CWE-306 Description: The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1030.pdf
CVE ID: CVE-2025-48413 State: PUBLISHED Published: 2025-05-21T11:39:19.438Z Last Updated: 2025-11-03T20:04:46.631Z Vendors: eCharge Hardy Barth Products: cPH2 / cPP2 charging stations Problem Types: CWE-798 Description: The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device. Authentication can be performed via SSH backdoor or likely via physical access (UART shell). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
via physical access (UART shell). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/echarge
CVE ID: CVE-2025-48414 State: PUBLISHED Published: 2025-05-21T11:40:50.424Z Last Updated: 2025-11-03T20:04:48.022Z Vendors: eCharge Hardy Barth Products: cPH2 / cPP2 charging stations Problem Types: CWE-798 Description: There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/echarge
CVE ID: CVE-2025-48415 State: PUBLISHED Published: 2025-05-21T12:13:14.475Z Last Updated: 2025-11-03T20:04:49.416Z Vendors: eCharge Hardy Barth Products: cPH2 / cPP2 charging stations Problem Types: CWE-749 Description: A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:
ecution of OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/echarge
CVE ID: CVE-2025-48416 State: PUBLISHED Published: 2025-05-21T12:15:02.694Z Last Updated: 2025-11-03T20:04:50.778Z Vendors: eCharge Hardy Barth Products: cPH2 / cPP2 charging stations Problem Types: CWE-912 Description: An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/echarge
CVE ID: CVE-2025-48417 State: PUBLISHED Published: 2025-05-21T12:30:08.012Z Last Updated: 2025-11-03T20:04:52.170Z Vendors: eCharge Hardy Barth Products: cPH2 / cPP2 charging stations Problem Types: CWE-321 Description: The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates. Additional An
crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://r.sec-consult.com/echarge
CVE ID: CVE-2025-48419 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:09.493Z Description: No description available.
CVE ID: CVE-2025-48420 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:09.020Z Description: No description available.
CVE ID: CVE-2025-48421 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:08.537Z Description: No description available.
CVE ID: CVE-2025-48422 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:08.014Z Description: No description available.
CVE ID: CVE-2025-48423 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:07.511Z Description: No description available.
CVE ID: CVE-2025-48424 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:07.027Z Description: No description available.
CVE ID: CVE-2025-48425 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:06.476Z Description: No description available.
CVE ID: CVE-2025-48426 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:05.884Z Description: No description available.
CVE ID: CVE-2025-48427 State: REJECTED Published: N/A Last Updated: 2025-05-21T02:55:05.142Z Description: No description available.
CVE ID: CVE-2025-48428 State: PUBLISHED Published: 2025-10-23T03:39:07.905Z Last Updated: 2025-10-23T17:30:36.170Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-312 Description: Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use allowing them to deploy a compromised or counterfeit device on that site. This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8
mmand Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48428
CVE ID: CVE-2025-48430 State: PUBLISHED Published: 2025-10-23T03:39:31.438Z Last Updated: 2025-10-23T15:26:56.990Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Gallagher Products: Command Centre Server Problem Types: CWE-248 Description: Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
vEL9.00.3831 (MR8), all versions of 8.90 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2025-48430
CVE ID: CVE-2025-48432 State: PUBLISHED Published: 2025-06-05T00:00:00.000Z Last Updated: 2025-06-11T14:59:01.028Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: djangoproject Products: Django Problem Types: CWE-117 Description: An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
processed by external systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.djangoproject.com/en/dev/releases/security/ - https://groups.google.com/g/django-announce - https://www.djangoproject.com/weblog/2025/jun/04/security-releases/ - https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
CVE ID: CVE-2025-48443 State: PUBLISHED Published: 2025-06-17T20:34:35.526Z Last Updated: 2025-06-18T15:50:22.231Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Password Manager Problem Types: CWE-64 Description: Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerability that could allow a local attacker to leverage this vulnerability to delete files in the context of an administrator when the administrator installs Trend Micro Password Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trend
Trend Micro Password Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-12917 - https://www.zerodayinitiative.com/advisories/ZDI-25-361/
CVE ID: CVE-2025-48444 State: PUBLISHED Published: 2025-06-11T14:19:21.219Z Last Updated: 2025-06-11T15:28:38.044Z Vendors: Drupal Products: Quick Node Block Problem Types: CWE-862 Description: Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-064
CVE ID: CVE-2025-48445 State: PUBLISHED Published: 2025-06-11T14:31:03.526Z Last Updated: 2025-06-11T15:38:27.544Z Vendors: Drupal Products: Commerce Eurobank (Redirect) Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-066
CVE ID: CVE-2025-48446 State: PUBLISHED Published: 2025-06-11T14:34:50.071Z Last Updated: 2025-06-11T15:48:21.281Z Vendors: Drupal Products: Commerce Alphabank Redirect Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-067