Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-61220 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:13:57.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://autobizline.com - http://commysecondlineapp.com - https://autobizline.com/secondline/user/get_user/ - https://github.com/syz913/CVE-reports/blob/main/CVE-2025-61220.md
CVE ID: CVE-2025-61224 State: PUBLISHED Published: 2025-10-06T00:00:00.000Z Last Updated: 2025-10-06T15:59:19.348Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dokuwiki/dokuwiki/issues/4512 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-61224
CVE ID: CVE-2025-61234 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-30T20:31:01.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stu
packets, and the build version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stuxve/expose-service-8888-dataphone
CVE ID: CVE-2025-61235 State: PUBLISHED Published: 2025-10-28T00:00:00.000Z Last Updated: 2025-10-29T13:57:25.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Dataphone A920 v2025.07.161103. A custom packet based on public documentation can be crafted, where some fields can contain arbitrary or trivial data. Normally, such data should cause the device to reject the packet. However, due to a lack of validation, the device accepts it with no authetication and triggers the functionality instead. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stuxve/poc-dataphone-crafted-packet
CVE ID: CVE-2025-61247 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T19:48:51.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/suyashksawant/CVEs/blob/main/CVE-2025-61247%3A%20SQL%20Injection%20in%20Online%20Shopping%20System
CVE ID: CVE-2025-61255 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:11:40.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/ - https://github.com/nikhilpatidar01/CVE-Assigned-Reports/blob/Master/CVE-2025-61255/advisory.md
CVE ID: CVE-2025-61261 State: PUBLISHED Published: 2025-11-07T00:00:00.000Z Last Updated: 2025-11-07T19:28:12.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1.0 & Angular v18.0.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckeditor/ckeditor5/releases/tag/v46.1.0 - https://senscybersecurity.nl/cve-2025-61261-explained/
CVE ID: CVE-2025-61301 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T13:50:57.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows attackers who can submit samples to cause incomplete or missing behavioral analysis reports by generating deeply nested or oversized behavior data that trigger MongoDB BSON limits or orjson recursion errors when the sample executes in the sandbox. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://capev2.com - https://github.com/kevoreilly/CAPEv2 - https://github.com/eGkritsis/CVE-202
nrichment: References: - http://capev2.com - https://github.com/kevoreilly/CAPEv2 - https://github.com/eGkritsis/CVE-2025-61301
CVE ID: CVE-2025-61303 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-21T13:47:55.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a vulnerability in its Windows behavioral analysis engine that allows a submitted malware sample to evade detection and cause denial-of-analysis. The vulnerability is triggered when a sample recursively spawns a large number of child processes, generating high log volume and exhausting system resources. As a result, key malicious behavior, including PowerShell execution and reverse shell activity, may not be recorded
es. As a result, key malicious behavior, including PowerShell execution and reverse shell activity, may not be recorded or reported, misleading analysts and compromising the integrity and availability of sandboxed analysis results. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/eGkritsis/CVE-2025-61303
CVE ID: CVE-2025-61304 State: PUBLISHED Published: 2025-11-05T00:00:00.000Z Last Updated: 2025-11-05T19:26:14.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pentastic-be/CVE-2025-61304
CVE ID: CVE-2025-61319 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T14:23:44.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. When scanning a target with an XSS payload, the unsanitized payload is rendered in the ReNgine web UI, resulting in arbitrary JavaScript execution in the victim's browser. This can be abused to steal session cookies, perform unauthorized actions, or compromise the ReNgine administrator's account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine - https:
account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yogeshojha/rengine - https://github.com/AmalJafarzade/CVE-2025-61319/
CVE ID: CVE-2025-61330 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:32:27.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. The vulnerability stems from the use of a hard-coded weak password for the root account in the /etc/shadow configuration or even the absence of any password at all. Some of these devices have the Telnet service enabled by default, or users can choose to enable the Telnet service in other device management interfaces (e.g. /debug.asp or /debug_telnet.asp). In addition, these devices ha
lnet service in other device management interfaces (e.g. /debug.asp or /debug_telnet.asp). In addition, these devices have related interfaces called Virtual Servers, which can map the devices to the public network, posing the risk of remote attacks. Therefore, attackers can obtain the highest root privileges of the devices through the Telnet service using the weak password hardcoded in the firmware (or without a password), and remote attacks are possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/25e8cd7f7805800a9a71c1193fb3cb43
CVE ID: CVE-2025-61385 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-28T15:19:57.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140 - https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385
CVE ID: CVE-2025-61413 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-24T15:16:50.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PiranhaCMS/piranha.core - http://piranhacms.org/ - https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-61413/advisory.md
CVE ID: CVE-2025-61417 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T15:38:57.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tastyigniter/TastyIgniter - https://github.com/mg7-x/CVEs/blob/main
A ADP Vulnrichment: References: - https://github.com/tastyigniter/TastyIgniter - https://github.com/mg7-x/CVEs/blob/main/CVE-2025-61417/README.md
CVE ID: CVE-2025-61427 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T18:12:04.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the userid and password parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ttz-wue.fiw.thws.de/blog/index.php/2025/10/31/ttz-wue-entdeckt-neue-schwachstelle-reflected-cross-site-scripting-xss-in-beo-gmbh-beo-atlas-einfuhr-ausfuhr-3-0/
CVE ID: CVE-2025-61429 State: PUBLISHED Published: 2025-10-29T00:00:00.000Z Last Updated: 2025-10-29T15:23:35.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@sulaimanalabduli/title-817c6346ac65
CVE ID: CVE-2025-61430 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:40:04.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request payloads from other clients. This happens when the TCP length prefix is malformed (len differs from actual packet len), and due to a concurrency/buffering issue, even when the lengths match. A length prefix that is smaller than the actual packet size increases information leakage. In summary, this vulnerability allows an attacker to see DNS queries of other clients.
ze increases information leakage. In summary, this vulnerability allows an attacker to see DNS queries of other clients. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ma-personal.notion.site/simpledns-vuln?source=copy_link - https://www.incognitotgt.me/blog/simpledns-vuln
CVE ID: CVE-2025-61431 State: PUBLISHED Published: 2025-11-04T00:00:00.000Z Last Updated: 2025-11-04T21:14:00.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the pHtmlSource parameter. A vendor fix was released on 2025-06-18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zucchetti.it/ - https://gist.github.com/alex-xor/8651dbdd413e4fa7240b0ab1b1845d76
CVE ID: CVE-2025-61454 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T13:39:14.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who visits a malicious link or submits a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tansique-17/CVE-2025-61454
CVE ID: CVE-2025-61455 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T13:50:19.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries, allowing unauthenticated attackers to bypass authentication and gain full access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tansique-17/CVE-2025-61455
CVE ID: CVE-2025-61456 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T15:09:39.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who visits a malicious link or submits a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tansique-17/CVE-2025-61456
CVE ID: CVE-2025-61457 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-21T20:30:10.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/code16/sharp/releases/tag/v9.7.0 - https://github.com/code16/sharp/blob/6d106b05aa07c6b46f5de28f909b732e1bbcdc47/src/Form/Fields/SharpFormUploadField.php#L97 - https://github.com/code16/sharp/issues/611 - https://github.com/chimmeee/vulnerability-research/blob/main/CVE-2025-61457
CVE ID: CVE-2025-61464 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T20:38:25.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gnuboard/gnuboard4/issues/1 - https://github.com/gnuboard/gnuboard4/issues/1#issue-3421008974
CVE ID: CVE-2025-61481 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-30T17:24:08.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.mikrotik.com/docs/spaces/ROS/pages/328131/WebFig - https://help.mikrotik.com/docs/spaces/SWOS/pages/328415/SwOS - https://svarthatt.se/cve/mikrotik-swos-cve-2025-61481/
CVE ID: CVE-2025-61482 State: PUBLISHED Published: 2025-10-27T00:00:00.000Z Last Updated: 2025-10-27T17:36:03.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentication. By hooking into app crypto routines and intercepting decryption paths, attacker can recover plaintext secrets, enabling generation of valid one-time passwords, and bypassing authentication for enrolled accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ReversecLabs/android-keystore-audit/blob/master
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ReversecLabs/android-keystore-audit/blob/master/frida-scripts/tracer-cipher.js - https://svarthatt.se/cve/cve-2025-61482-pulling-otp-secrets-from-privacyidea-authenticator/
CVE ID: CVE-2025-61488 State: PUBLISHED Published: 2025-10-20T00:00:00.000Z Last Updated: 2025-10-20T18:36:19.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slims/slims9_bulian/issues/299
CVE ID: CVE-2025-61498 State: PUBLISHED Published: 2025-10-30T00:00:00.000Z Last Updated: 2025-10-30T21:01:04.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows attackers to cause a Denial of Service (DoS) via supplying a crafted packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/sakshi-garg02/CVEs/tree/main/CVE-2025-61498
CVE ID: CVE-2025-61505 State: PUBLISHED Published: 2025-10-10T00:00:00.000Z Last Updated: 2025-10-10T19:02:22.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lead to remote code execution, arbitrary file operations, or denial of service, depending on available PHP object gadgets in the codebase. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/e107in
ject gadgets in the codebase. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/e107inc/e107/blob/master/install.php - https://xancatos.org/cve202561505
CVE ID: CVE-2025-61514 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:36:35.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sagemathinc/cocalc - https://github.com/sagemathinc/cocalc/commit/0d2ff5890a3ae62e941aad8a5884dd765b7e98fc - https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-61514
CVE ID: CVE-2025-61524 State: PUBLISHED Published: 2025-10-08T00:00:00.000Z Last Updated: 2025-10-14T14:11:52.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://casdoor.com - https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a - https://github.com/casdoor/casdoor/commit/d88
or.com - https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a - https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd - https://github.com/casdoor/casdoor/releases/tag/v2.63.0
CVE ID: CVE-2025-61532 State: PUBLISHED Published: 2025-10-09T00:00:00.000Z Last Updated: 2025-10-09T18:47:49.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in SVX Portal v.2.7A to execute arbitrary code via the TG parameter on last_heard_page.php component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sa2blv/SVXportal - https://docs.meeco.me/releases/svx-1.3.0#portal - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61532
CVE ID: CVE-2025-61536 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T15:31:59.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fel
phishing, and account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FelixRiddle/dev-jobs-handlebars/ - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61536
CVE ID: CVE-2025-61539 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T19:43:39.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHP-Outburst/myUPB?tab=readme-ov-file - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61539
CVE ID: CVE-2025-61540 State: PUBLISHED Published: 2025-10-16T00:00:00.000Z Last Updated: 2025-10-16T15:30:45.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHP-Outburst/myUPB?tab=readme-ov-file - https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61540