Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-40597 State: PUBLISHED Published: 2025-07-23T14:48:36.604Z Last Updated: 2025-07-25T03:55:21.225Z Vendors: SonicWall Products: SMA 100 Series Problem Types: CWE-122 Description: A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0012
CVE ID: CVE-2025-40598 State: PUBLISHED Published: 2025-07-23T14:49:48.805Z Last Updated: 2025-07-29T13:24:17.161Z Vendors: SonicWall Products: SMA 100 Series Problem Types: CWE-79 Description: A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0012
CVE ID: CVE-2025-40599 State: PUBLISHED Published: 2025-07-23T13:13:45.791Z Last Updated: 2025-07-25T03:55:18.989Z Vendors: SonicWall Products: SMA 100 Series Problem Types: CWE-434 Description: An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0014
CVE ID: CVE-2025-40600 State: PUBLISHED Published: 2025-07-29T21:11:59.174Z Last Updated: 2025-07-30T15:07:47.649Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-134 Description: Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0013
CVE ID: CVE-2025-40601 State: PUBLISHED Published: 2025-11-20T12:26:54.465Z Last Updated: 2025-11-20T18:31:18.802Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-121 Description: A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0016
CVE ID: CVE-2025-40603 State: PUBLISHED Published: 2025-10-31T11:01:35.618Z Last Updated: 2025-10-31T18:53:53.156Z Vendors: SonicWall Products: SMA100 Problem Types: CWE-532 Description: A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0017
CVE ID: CVE-2025-40604 State: PUBLISHED Published: 2025-11-20T12:17:14.138Z Last Updated: 2025-11-21T05:02:06.383Z Vendors: SonicWall Products: Email Security Problem Types: CWE-494 Description: Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018
CVE ID: CVE-2025-40605 State: PUBLISHED Published: 2025-11-20T12:19:17.871Z Last Updated: 2025-11-20T18:30:31.164Z Vendors: SonicWall Products: Email Security Problem Types: CWE-23 Description: A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018
CVE ID: CVE-2025-40615 State: PUBLISHED Published: 2025-04-29T15:40:35.750Z Last Updated: 2025-04-29T17:46:51.247Z Vendors: Bookgy Products: Bookgy Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "TEXTO" parameter in /api/api_ajustes.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy
CVE ID: CVE-2025-40616 State: PUBLISHED Published: 2025-04-29T15:40:57.980Z Last Updated: 2025-04-29T16:20:16.950Z Vendors: Bookgy Products: Bookgy Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy
CVE ID: CVE-2025-40617 State: PUBLISHED Published: 2025-04-29T15:42:32.647Z Last Updated: 2025-04-29T16:17:03.869Z Vendors: Bookgy Products: Bookgy Problem Types: CWE-89 Description: SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy
CVE ID: CVE-2025-40618 State: PUBLISHED Published: 2025-04-29T15:43:11.900Z Last Updated: 2025-04-29T15:51:07.236Z Vendors: Bookgy Products: Bookgy Problem Types: CWE-89 Description: SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy
CVE ID: CVE-2025-40619 State: PUBLISHED Published: 2025-04-29T15:45:19.090Z Last Updated: 2025-04-29T16:06:37.247Z Vendors: Bookgy Products: Bookgy Problem Types: CWE-863 Description: Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to reach private areas and/or areas intended for other roles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bookgy
CVE ID: CVE-2025-40620 State: PUBLISHED Published: 2025-05-06T10:39:11.267Z Last Updated: 2025-05-06T15:10:34.244Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndWS’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CVE ID: CVE-2025-40621 State: PUBLISHED Published: 2025-05-06T10:39:53.671Z Last Updated: 2025-05-06T15:09:36.700Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ parameter of the ‘ValidateUserAndGetData’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CVE ID: CVE-2025-40622 State: PUBLISHED Published: 2025-05-06T10:40:28.916Z Last Updated: 2025-05-06T15:08:27.737Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘username’ parameter of the ‘GetLastDatePasswordChange’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CVE ID: CVE-2025-40623 State: PUBLISHED Published: 2025-05-06T10:41:04.724Z Last Updated: 2025-05-06T15:07:15.837Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘Sender’ and “email” parameters of the ‘createNotificationAndroid’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CVE ID: CVE-2025-40624 State: PUBLISHED Published: 2025-05-06T10:41:39.095Z Last Updated: 2025-05-06T14:15:57.922Z Vendors: TCMAN Products: GIM Problem Types: CWE-89 Description: SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and “email” parameters of the ‘updatePassword’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CVE ID: CVE-2025-40625 State: PUBLISHED Published: 2025-05-06T10:43:01.296Z Last Updated: 2025-05-07T06:41:41.523Z Vendors: TCMAN Products: GIM Problem Types: CWE-434 Description: Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file to obtain a Remote Code Execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tcmans-gim
CVE ID: CVE-2025-40626 State: PUBLISHED Published: 2025-05-12T11:31:43.769Z Last Updated: 2025-05-12T12:36:46.427Z Vendors: AbanteCart Products: AbanteCart Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through "/about_us?[XSS_PAYLOAD]". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-x
CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-abantecart
CVE ID: CVE-2025-40627 State: PUBLISHED Published: 2025-05-12T11:36:46.597Z Last Updated: 2025-05-12T18:42:35.890Z Vendors: AbanteCart Products: AbanteCart Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through "/eyes? [XSS_PAYLOAD]". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-
A ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-abantecart
CVE ID: CVE-2025-40628 State: PUBLISHED Published: 2025-05-13T09:37:39.081Z Last Updated: 2025-05-13T19:05:44.423Z Vendors: DomainsPRO Products: DomainsPRO Problem Types: CWE-89 Description: SQL injection vulnerability in DomainsPRO 1.2. This vulnerability could allow an attacker to retrieve, create, update and delete databases via the “d” parameter in the “/article.php” endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-domainspro
CVE ID: CVE-2025-40629 State: PUBLISHED Published: 2025-05-16T12:40:17.878Z Last Updated: 2025-05-16T12:59:59.664Z Vendors: PNETLab Products: PNETLab Problem Types: CWE-22 Description: PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/path-traversal-vulnerability-pnetlab
CVE ID: CVE-2025-40630 State: PUBLISHED Published: 2025-05-16T11:08:18.538Z Last Updated: 2025-05-16T13:46:17.479Z Vendors: Icewarp Products: Icewarp Mail Server Problem Types: CWE-601 Description: Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-
DP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
CVE ID: CVE-2025-40631 State: PUBLISHED Published: 2025-05-16T11:09:17.351Z Last Updated: 2025-05-16T13:46:34.760Z Vendors: Icewarp Products: Icewarp Mail Server Problem Types: CWE-644 Description: HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
CVE ID: CVE-2025-40632 State: PUBLISHED Published: 2025-05-16T11:09:59.590Z Last Updated: 2025-05-16T13:46:48.664Z Vendors: Icewarp Products: Icewarp Mail Server Problem Types: CWE-79 Description: Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server
CVE ID: CVE-2025-40633 State: PUBLISHED Published: 2025-05-20T10:17:00.222Z Last Updated: 2025-05-20T13:19:41.492Z Vendors: Koibox Products: Koibox Problem Types: CWE-79 Description: A Stored Cross-Site Scripting (XSS) vulnerability has been found in Koibox for versions prior to e8cbce2. This vulnerability allows an authenticated attacker to upload an image containing malicious JavaScript code as profile picture in the '/es/dashboard/clientes/ficha/' endpoint Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-koibox
CVE ID: CVE-2025-40634 State: PUBLISHED Published: 2025-05-20T10:12:16.550Z Last Updated: 2025-05-20T13:30:19.289Z Vendors: TP-Link Products: Link Archer AX50 Problem Types: CWE-121 Description: Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the device over LAN and WAN networks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stack-based-buffer-overflow-tp-link-archer-ax50
CVE ID: CVE-2025-40635 State: PUBLISHED Published: 2025-05-20T12:51:57.761Z Last Updated: 2025-05-21T11:17:30.680Z Vendors: Comerzzia Products: Comerzzia Backoffice: Sales Orchestrator Problem Types: CWE-89 Description: SQL injection vulnerability in Comerzzia Backoffice: Sales Orchestrator 3.0.15. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘uidActivity’, ‘codCompany’ and ‘uidInstance’ parameters of the ‘/comerzzia/login’ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-comerzzia
CVE ID: CVE-2025-40636 State: PUBLISHED Published: 2025-10-03T11:24:43.808Z Last Updated: 2025-10-03T13:56:34.609Z Vendors: mod_vvisit_counter Products: mod_vvisit_counter Problem Types: CWE-89 Description: SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisitcounter’ cookie at all endpoints where the plugin counts visits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-modvvisitcounter-module
CVE ID: CVE-2025-40640 State: PUBLISHED Published: 2025-10-10T08:19:33.723Z Last Updated: 2025-10-23T10:43:05.371Z Vendors: Status Tracker Products: Energy CRM Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_invoice_submit.php”, using the “customerName_0” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incib
cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker
CVE ID: CVE-2025-40641 State: PUBLISHED Published: 2025-09-08T11:40:31.130Z Last Updated: 2025-09-08T11:57:11.794Z Vendors: Multi-Purpose Inventory Management System Products: Multi-Purpose Inventory Management System Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the product_name parameter in /Controller_Products/update. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnric
fted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-multi-purpose-inventory-management-system
CVE ID: CVE-2025-40642 State: PUBLISHED Published: 2025-09-08T11:25:15.099Z Last Updated: 2025-09-08T13:36:31.300Z Vendors: WebWork Products: WebWork PHP script Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request parameters in /search. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-webwork
CVE ID: CVE-2025-40643 State: PUBLISHED Published: 2025-10-23T10:46:10.437Z Last Updated: 2025-10-23T14:41:23.192Z Vendors: Status Tracker Products: Energy CRM Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert
e session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker
CVE ID: CVE-2025-40645 State: PUBLISHED Published: 2025-10-02T09:41:36.252Z Last Updated: 2025-10-02T15:53:28.138Z Vendors: ViDay Products: ViDay Problem Types: CWE-200 Description: Exposure of sensitive information in Viday. This vulnerability could allow an unauthenticated attacker to obtain sensitive information about customers by sending an HTTP GET request to “/api/reserva/web/clients” using the “phone” parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-viday
CVE ID: CVE-2025-40646 State: PUBLISHED Published: 2025-10-02T09:42:30.375Z Last Updated: 2025-10-10T08:20:22.420Z Vendors: Status Tracker Products: Energy CRM Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert
CVE ID: CVE-2025-40647 State: PUBLISHED Published: 2025-10-01T12:30:02.773Z Last Updated: 2025-10-01T13:12:16.110Z Vendors: issabel-pbx module, Issabel, issabel-agenda module Products: Issabel Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'email' parameter in '/index.php?menu=address_book'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-issabel-products
CVE ID: CVE-2025-40648 State: PUBLISHED Published: 2025-10-01T12:30:44.653Z Last Updated: 2025-10-01T14:58:08.623Z Vendors: issabel-pbx module, Issabel, issabel-agenda module Products: Issabel Problem Types: CWE-79 Description: Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-issabel-products