Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-34151 State: PUBLISHED Published: 2025-08-07T16:45:06.189Z Last Updated: 2025-11-20T22:35:00.819Z Vendors: Shenzhen Aitemi E Commerce Co. Ltd. Products: M300 Wi-Fi Repeater Problem Types: CWE-78 Description: A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/ - https://www.aliexpress.us/
t: References: - https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/ - https://www.aliexpress.us/item/3256806767641280.html - https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-password-command-injection
CVE ID: CVE-2025-34152 State: PUBLISHED Published: 2025-08-07T16:44:59.919Z Last Updated: 2025-11-21T00:47:24.679Z Vendors: Shenzhen Aitemi E Commerce Co. Ltd. Products: M300 Wi-Fi Repeater Problem Types: CWE-78 Description: An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
without triggering visible configuration changes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/ - https://www.aliexpress.us/item/3256806767641280.html - https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-time-parameter
CVE ID: CVE-2025-34153 State: PUBLISHED Published: 2025-08-13T16:51:26.020Z Last Updated: 2025-11-19T01:28:25.952Z Vendors: Hyland Software Products: OnBase Problem Types: CWE-502 Description: Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in Hyland.Core.Timers.dll. This endpoint deserializes untrusted input using the .NET BinaryFormatter, allowing attackers to execute arbitrary code under the context of NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CIS
, allowing attackers to execute arbitrary code under the context of NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/VAMorales/32794cccc2195a935623a12ef32760dc - https://www.hyland.com/en/internal/onbase-unity-client - https://support.hyland.com/r/OnBase/WorkView/Foundation-24.1/WorkView/Installation/Upgrade-Considerations/Upgrading-to-OnBase-Version-Foundation-24.1 - https://www.vulncheck.com/advisories/hyland-onbase-net-remoting-tcp-channel-unauthenticated-rce
CVE ID: CVE-2025-34154 State: PUBLISHED Published: 2025-08-13T21:04:24.387Z Last Updated: 2025-11-04T22:14:52.551Z Vendors: Synergetic Data Systems Inc. Products: UnForm Server Manager Problem Types: CWE-22 Description: UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analysis interface. The flaw resides in the arc endpoint, which accepts a fl parameter to specify the log file to be opened. Due to insufficient input validation and lack of path sanitization, attackers can supply relative paths to access arbitrary files on the host system — including sensitive OS-level files — without authentication. Additional Analyst Notes: -
ary files on the host system — including sensitive OS-level files — without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Janrdrz/3cf67a9ad488e07ceaacd7c1a7e59ae7 - https://unform.com/download/uf101_readme.txt - https://synergetic-data.com/ - https://www.vulncheck.com/advisories/unform-server-manager-unauthenticated-arbitrary-file-read
CVE ID: CVE-2025-34155 State: PUBLISHED Published: 2025-10-23T16:30:18.943Z Last Updated: 2025-10-23T16:40:02.865Z Vendors: Tibbo Systems Products: AggreGate Network Manager Problem Types: CWE-204 Description: Tibbo AggreGate Network Manager < 6.40.05 contains an observable response discrepancy in its login functionality. Authentication failure messages differ based on whether a supplied username exists or not, allowing an unauthenticated remote attacker to infer valid account identifiers. This can facilitate user enumeration and increase the likelihood of targeted brute-force or credential-stuffing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aggregate.d
rce or credential-stuffing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aggregate.digital/downloads.html - https://aggregate.digital/products/network-manager.html - https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-login-functionality-user-enumeration
CVE ID: CVE-2025-34156 State: PUBLISHED Published: 2025-10-23T16:30:41.555Z Last Updated: 2025-10-23T16:39:27.758Z Vendors: Tibbo Systems Products: AggreGate Network Manager Problem Types: CWE-497 Description: Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses Java system properties, server path details, and version information to unauthorized users, resulting in information disclosure that could aid further compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://aggregate.digital/downloads.html - https://aggregate.digital/products/network-manager.html - htt
: References: - https://aggregate.digital/downloads.html - https://aggregate.digital/products/network-manager.html - https://www.vulncheck.com/advisories/tibbo-aggregate-network-manager-system-information-exposure
CVE ID: CVE-2025-34157 State: PUBLISHED Published: 2025-08-27T16:48:03.027Z Last Updated: 2025-11-19T01:28:12.286Z Vendors: coolLabs Technologies Products: Coolify Problem Types: CWE-79, CWE-20 Description: Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, sessi
e admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 - https://coolify.io/ - https://github.com/Eyodav/CVE-2025-34157
CVE ID: CVE-2025-34158 State: PUBLISHED Published: 2025-08-21T13:43:30.032Z Last Updated: 2025-08-28T19:18:55.994Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Plex Products: Media Server Problem Types: CWE-669 Description: Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.plex.tv/media-server-downloads/ - https://forums.plex.tv/t/plex-media-server-security-update/928341 - https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/ - https://www.runzero.com/blo
ngcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/ - https://www.runzero.com/blog/plex/ - https://www.tenable.com/plugins/nessus/250294 - https://www.vulncheck.com/advisories/plex-media-server-unspecified - https://github.com/lufinkey/vulnerability-research/tree/main/CVE-2025-34158
CVE ID: CVE-2025-34159 State: PUBLISHED Published: 2025-08-27T16:47:54.240Z Last Updated: 2025-11-19T01:28:03.074Z Vendors: coolLabs Technologies Products: Coolify Problem Types: CWE-94, CWE-20 Description: Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
acker can gain full root access to the underlying server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 - https://coolify.io/ - https://github.com/Eyodav/CVE-2025-34159
CVE ID: CVE-2025-34160 State: PUBLISHED Published: 2025-08-27T21:22:12.666Z Last Updated: 2025-11-19T01:27:53.124Z Vendors: Shanghai Aishu Information Technology Co., Ltd. Products: AnyShare Problem Types: CWE-78 Description: AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/start_service accepts user-supplied input via POST and fails to sanitize command-like payloads. An attacker can inject shell syntax that is interpreted by the backend, enabling arbitrary command execution. The vulnerability is presumed to affect builds released prior to August 2025 and is said to be remediated in
execution. The vulnerability is presumed to affect builds released prior to August 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-11 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cn-sec.com/archives/4320091.html - https://stack.chaitin.com/vuldb/detail/b4640952-9be9-4bfa-9d7f-a0be72b35e18 - https://www.aishu.cn/cn - https://www.aishutech.com/en/anyshare-family7 - https://www.vulncheck.com/advisories/anyshare-serviceagent-api-unauthenticated-rce
CVE ID: CVE-2025-34161 State: PUBLISHED Published: 2025-08-27T16:47:45.581Z Last Updated: 2025-11-19T01:27:34.100Z Vendors: coolLabs Technologies Products: Coolify Problem Types: CWE-78, CWE-20 Description: Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise. Add
ntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 - https://coolify.io/ - https://github.com/Eyodav/CVE-2025-34161
CVE ID: CVE-2025-34162 State: PUBLISHED Published: 2025-08-27T21:22:34.090Z Last Updated: 2025-08-28T19:52:50.056Z Vendors: Feijiu Medical Technology Co., Ltd. Products: Bian Que Feijiu Intelligent Emergency and Quality Control System Problem Types: CWE-89 Description: An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams endpoint of Bian Que Feijiu Intelligent Emergency and Quality Control System, accessible via the /AppService/BQMedical/WebServiceForFirstaidApp.asmx interface. The backend fails to properly sanitize user-supplied input in the strOpid parameter, allowing attackers to inject arbitrary SQL statements. This can lead to data exfiltration, authentication by
parameter, allowing attackers to inject arbitrary SQL statements. This can lead to data exfiltration, authentication bypass, and potentially remote code execution, depending on backend configuration. The vulnerability is presumed to affect builds released prior to June 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-23 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wooluo/nuclei-templates-2025hw/blob/main/bianque-medical-sql-injection.yaml - https://cn-sec.com/archives/4160402.html - http://www.ivt
emplates-2025hw/blob/main/bianque-medical-sql-injection.yaml - https://cn-sec.com/archives/4160402.html - http://www.ivtbq.com/ - https://www.vulncheck.com/advisories/bian-que-feiju-intelligent-emergency-and-quality-control-system-sqli
CVE ID: CVE-2025-34163 State: PUBLISHED Published: 2025-08-27T21:24:43.998Z Last Updated: 2025-08-28T19:53:51.666Z Vendors: Qingdao Dongsheng Weiye Software Co., Ltd. Products: Dongsheng Logistics Software Problem Types: CWE-434 Description: Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST request. This allows remote code execution on the server, potentially leading to full system compromise. The vulnerability is presumed to affect builds released prior
he server, potentially leading to full system compromise. The vulnerability is presumed to affect builds released prior to July 2025 and is said to be remediated in newer versions of the product, though the exact affected range remains undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-07-23 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cn-sec.com/archives/4243708.html - http://www.dongshengsoft.com/ - https://www.vulncheck.com/advisories/dongsheng-logisitics-software-unauth-arbitrary-file-upload
CVE ID: CVE-2025-34164 State: PUBLISHED Published: 2025-08-29T23:27:51.004Z Last Updated: 2025-11-03T16:11:21.827Z Vendors: NetSupport Ltd. Products: NetSupport Manager Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 allows a remote, unauthenticated attacker to cause a denial of service (DoS) or execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netsupportmanager.com/ - https://www.vulncheck.com/advisories/netsupport-client-manager-buffer-overflows
CVE ID: CVE-2025-34165 State: PUBLISHED Published: 2025-08-29T23:31:18.668Z Last Updated: 2025-09-02T19:25:28.968Z Vendors: NetSupport Ltd. Products: NetSupport Manager Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 allows a remote, unauthenticated attacker to cause a denial of service (DoS) or potentially leak a limited amount of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netsupportmanager.com/ - https://www.vulncheck.com/advisories/netsupport-client-manager-buffer-overflows
CVE ID: CVE-2025-34172 State: PUBLISHED Published: 2025-09-09T19:43:30.508Z Last Updated: 2025-11-20T12:24:05.777Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-79 Description: In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/04d1328ab077830eb57a24bb7018c812b6358c64 - https://redmine.pfsense.org/issues/16411 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-ha-proxy-reflect
4 - https://redmine.pfsense.org/issues/16411 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-ha-proxy-reflected-xss
CVE ID: CVE-2025-34173 State: PUBLISHED Published: 2025-09-09T19:59:14.136Z Last Updated: 2025-11-20T12:23:55.690Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-22 Description: In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References
h at least "WebCfg - Services: Snort package" permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/d6f462bcc446969f8955c16cfde300d5c9ab7435 - https://redmine.pfsense.org/issues/16412 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-snort-directory-traversal-information-disclosure
CVE ID: CVE-2025-34174 State: PUBLISHED Published: 2025-09-09T20:02:05.701Z Last Updated: 2025-11-20T12:23:37.606Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-79 Description: In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions. Additional Analyst Notes:
e attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893 - https://redmine.pfsense.org/issues/16413 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xss
CVE ID: CVE-2025-34175 State: PUBLISHED Published: 2025-09-09T20:09:50.289Z Last Updated: 2025-11-20T12:23:27.465Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-79 Description: In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 - https://redmine.pfsense.org/issues/16414 - https://www.vulncheck.com/advisories/netgate-pf-sense-c
e30af81272485fde0b4 - https://redmine.pfsense.org/issues/16414 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-reflected-xss
CVE ID: CVE-2025-34176 State: PUBLISHED Published: 2025-09-09T20:14:37.899Z Last Updated: 2025-11-20T12:23:14.723Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-22 Description: In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. Additional Analyst Notes: - CISA ADP Vulnr
uthenticated with at least "WebCfg - Services: suricata package" permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 - https://redmine.pfsense.org/issues/16414 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-directory-traversal-information-disclosure
CVE ID: CVE-2025-34177 State: PUBLISHED Published: 2025-09-09T20:19:09.928Z Last Updated: 2025-11-20T12:23:06.521Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-79 Description: In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 - https://redmine.pfsense.org/issues
://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 - https://redmine.pfsense.org/issues/16414 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-stored-xss
CVE ID: CVE-2025-34178 State: PUBLISHED Published: 2025-09-09T20:23:44.475Z Last Updated: 2025-11-20T12:22:56.508Z Vendors: Netgate Products: pfSense CE Problem Types: CWE-79 Description: In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 - https://redmine.pfsense.org/issues
://github.com/pfsense/FreeBSD-ports/commit/97852ccfd201b24ee542be30af81272485fde0b4 - https://redmine.pfsense.org/issues/16414 - https://www.vulncheck.com/advisories/netgate-pf-sense-ce-suricata-package-stored-xss
CVE ID: CVE-2025-34182 State: PUBLISHED Published: 2025-10-01T17:01:08.384Z Last Updated: 2025-10-01T17:35:15.970Z Vendors: Deciso Products: OPNsense Problem Types: CWE-79 Description: In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data()
This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.opnsense.org/releases/CE_25.7.html#september-30-2025 - https://www.vulncheck.com/advisories/decisio-opnsense-stored-xss
CVE ID: CVE-2025-34183 State: PUBLISHED Published: 2025-09-16T19:39:20.150Z Last Updated: 2025-09-17T14:41:57.768Z Vendors: Ilevia Srl. Products: EVE X1 Server Problem Types: CWE-532 Description: Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential reuse. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ilevia.com/ - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5957.php - https://packetstorm.news/files/id/208700/ -