Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ocation errors when handling expired session keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10226 State: PUBLISHED Published: 2025-09-10T12:38:42.549Z Last Updated: 2025-10-08T11:56:42.741Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-1395 Description: Dependency on Vulnerable Third-Party Component (CWE-1395) in the PostgreSQL backend in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier on Windows and Linux allows a remote attacker to escalate privileges, execute arbitrary code, or cause denial-of-service via exploitation of multiple known CVEs present in PostgreSQL v10.x, which are resolved in PostgreSQL 17.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
stgreSQL v10.x, which are resolved in PostgreSQL 17.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories - https://www.postgresql.org/docs/release
CVE ID: CVE-2025-10227 State: PUBLISHED Published: 2025-09-10T12:39:12.391Z Last Updated: 2025-10-08T11:57:58.014Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: AxxonSoft Products: AxxonOne C-Werk Problem Types: CWE-311 Description: Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a local attacker with access to exported storage or stolen physical drives to extract sensitive archive data in plaintext via lack of encryption at rest. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disc
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories
CVE ID: CVE-2025-10228 State: PUBLISHED Published: 2025-10-14T09:20:38.638Z Last Updated: 2025-10-14T15:30:57.503Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rolantis Information Technologies Products: Agentis Problem Types: CWE-384 Description: Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking.This issue affects Agentis: before 4.44. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0336
CVE ID: CVE-2025-10229 State: PUBLISHED Published: 2025-09-10T22:02:06.351Z Last Updated: 2025-09-15T19:10:14.684Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: n/a Products: Freshwork Problem Types: CWE-601 Description: A vulnerability has been found in Freshwork up to 1.2.3. This impacts an unknown function of the file /api/v2/logout. Such manipulation of the argument post_logout_redirect_uri leads to open redirect. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.3 will fix this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure but d
ll fix this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323487 - https://vuldb.com/?ctiid.323487 - https://vuldb.com/?submit.641089 - https://drive.google.com/file/d/1U-xaC1pqnregoZGefyNAykhUnvnuG6hb/view?usp=sharing
CVE ID: CVE-2025-10230 State: PUBLISHED Published: 2025-11-07T19:42:06.624Z Last Updated: 2025-11-08T04:55:22.163Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-78 Description: A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and execu
on or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-10230 - https://bugzilla.redhat.com/show_bug.cgi?id=2394377 - https://www.samba.org/samba/history/security.html
CVE ID: CVE-2025-10231 State: PUBLISHED Published: 2025-09-10T13:34:41.906Z Last Updated: 2025-09-11T03:56:20.758Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: N-able Products: N-central Problem Types: CWE-276 Description: An Incorrect File Handling Permission bug exists on the N-central Windows Agent and Probe that, in the right circumstances, can allow a local low-level user to run commands with elevated permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.3_Release_Notes.htm - https://me.n-able.com/s/security-advisory/aArVy0000000jgHKAQ/cve202510231-
/Content/N-central_2025.3_Release_Notes.htm - https://me.n-able.com/s/security-advisory/aArVy0000000jgHKAQ/cve202510231-incorrect-default-permissions-could-lead-to-privilege-escalation
CVE ID: CVE-2025-10232 State: PUBLISHED Published: 2025-09-10T22:32:06.692Z Last Updated: 2025-09-11T15:23:59.328Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: 299ko Problem Types: CWE-22 Description: A weakness has been identified in 299ko up to 2.0.0. Affected by this issue is the function getSentDir/delete of the file plugin/filemanager/controllers/FileManagerAPIController.php. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional A
nd could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323501 - https://vuldb.com/?ctiid.323501 - https://vuldb.com/?submit.641567 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb010.md
CVE ID: CVE-2025-10233 State: PUBLISHED Published: 2025-09-10T23:02:05.674Z Last Updated: 2025-09-11T14:29:03.494Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: kalcaddle Products: kodbox Problem Types: CWE-22 Description: A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA AD
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323502 - https://vuldb.com/?ctiid.323502 - https://vuldb.com/?submit.641755 - https://vuldb.com/?submit.641757 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb012.md - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb011.md
CVE ID: CVE-2025-10234 State: PUBLISHED Published: 2025-09-10T23:32:06.274Z Last Updated: 2025-09-11T14:11:08.174Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323503 - https://vuldb.com/?ctiid.323503 - https://vuldb.com/?submit.641896 - https://medium.com/@warlleyfreire/stored-xss-in-scada-lts-data-point-edit-42c7383402f0
CVE ID: CVE-2025-10235 State: PUBLISHED Published: 2025-09-11T00:32:06.278Z Last Updated: 2025-09-11T13:53:18.898Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Scada-LTS Problem Types: CWE-79, CWE-94 Description: A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This manipulation of the argument Colour causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichm
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323504 - https://vuldb.com/?ctiid.323504 - https://vuldb.com/?submit.641972 - https://medium.com/@warlleyfreire/stored-xss-in-scada-lts-reports-module-colour-field-4d7e6633d298
CVE ID: CVE-2025-10236 State: PUBLISHED Published: 2025-09-11T01:02:07.190Z Last Updated: 2025-09-11T13:22:17.633Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: binary-husky Products: gpt_academic Problem Types: CWE-22 Description: A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input{} leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this dis
ed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323505 - https://vuldb.com/?ctiid.323505 - https://vuldb.com/?submit.640977 - https://github.com/d3do-23/cvelist/blob/main/gpt_academic/Plugins_LFI.md
CVE ID: CVE-2025-10239 State: PUBLISHED Published: 2025-10-09T12:42:05.557Z Last Updated: 2025-10-10T03:55:22.638Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Flowmon Problem Types: CWE-78 Description: In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/CVE-2025-10239
CVE ID: CVE-2025-10240 State: PUBLISHED Published: 2025-10-09T12:43:40.906Z Last Updated: 2025-10-10T03:55:21.833Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Flowmon Problem Types: CWE-79 Description: A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.progress.com/s/article/Can-CVE-2025-10240-affect-Progress-Flowmon-appliance
CVE ID: CVE-2025-10242 State: PUBLISHED Published: 2025-10-14T14:14:49.572Z Last Updated: 2025-10-18T03:55:32.713Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-78 Description: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-10243 State: PUBLISHED Published: 2025-10-14T14:17:55.836Z Last Updated: 2025-10-18T03:55:33.483Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-78 Description: OS command injection in the admin panel of Ivanti EPMM before version 12.6.0.2, 12.5.0.4, and 12.4.0.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Endpoint-Manager-Mobile-EPMM-10-2025-Multiple-CVEs?language=en_US
CVE ID: CVE-2025-10244 State: PUBLISHED Published: 2025-09-23T11:31:27.769Z Last Updated: 2025-09-24T03:55:13.046Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Autodesk Products: Fusion Problem Types: CWE-79 Description: A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader
ADP Vulnrichment: References: - https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe - https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0020
CVE ID: CVE-2025-10245 State: PUBLISHED Published: 2025-09-11T01:32:05.829Z Last Updated: 2025-09-11T13:14:41.933Z Severity: N/A (CVSS 4.7 AV:A/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Display Painéis Products: TGA Problem Types: CWE-22 Description: A security flaw has been discovered in Display Painéis TGA up to 7.1.41. Affected by this issue is some unknown functionality of the file /gallery/rename of the component Galeria Page. The manipulation of the argument current_folder results in path traversal. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CI
ted. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323545 - https://vuldb.com/?ctiid.323545 - https://vuldb.com/?submit.642068 - https://github.com/lfparizzi/CVE-TGA-7.1.41/tree/main
CVE ID: CVE-2025-10246 State: PUBLISHED Published: 2025-09-11T05:02:07.313Z Last Updated: 2025-09-11T14:42:28.140Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: lokibhardwaj Products: PHP-Code-For-Unlimited-File-Upload Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in lokibhardwaj PHP-Code-For-Unlimited-File-Upload up to 124fe96324915490c81eaf7db3234b0b4e4bab3c. This affects an unknown part of the file /f.php. This manipulation of the argument h causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. This product follows a rolling release app
le. The exploit has been made available to the public and could be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323546 - https://vuldb.com/?ctiid.323546 - https://vuldb.com/?submit.642206
CVE ID: CVE-2025-10247 State: PUBLISHED Published: 2025-09-11T05:32:06.216Z Last Updated: 2025-09-11T14:42:14.299Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: JEPaaS Problem Types: CWE-284, CWE-266 Description: A security vulnerability has been detected in JEPaaS 7.2.8. This vulnerability affects the function doFilterInternal of the component Filter Handler. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
d early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323547 - https://vuldb.com/?ctiid.323547 - https://vuldb.com/?submit.642413 - https://github.com/c3p0ooo-Yiqiyin/JEPaaS-Access-control-bypass-vulnerability/blob/main/README.md
CVE ID: CVE-2025-10249 State: PUBLISHED Published: 2025-10-09T11:20:56.306Z Last Updated: 2025-10-09T14:46:37.151Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Revolution Slider Products: Slider Revolution Problem Types: CWE-23 Description: The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files. Additional Analyst Notes: - CISA ADP
install and activate plugin add-ons, create sliders, and download arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43f2c4e5-c19d-4b7c-849b-47052bb62cb5?source=cve - https://www.sliderrevolution.com/documentation/changelog/
CVE ID: CVE-2025-10250 State: PUBLISHED Published: 2025-09-11T11:32:06.456Z Last Updated: 2025-09-11T14:35:20.945Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: DJI Products: Mavic Spark, Mavic Air, Mavic Mini Problem Types: CWE-321, CWE-320 Description: A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic Mini 01.00.0500. Affected is an unknown function of the component Telemetry Channel. Executing manipulation can lead to use of hard-coded cryptographic key . The attacker needs to be present on the local network. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit h
twork. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323609 - https://vuldb.com/?ctiid.323609 - https://vuldb.com/?submit.639757 - https://github.com/ByteMe1001/DJI-Enhanced-WiFi-Weak-Cryptography
CVE ID: CVE-2025-10251 State: PUBLISHED Published: 2025-09-11T13:02:06.501Z Last Updated: 2025-09-11T13:33:52.704Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: FoxCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323611 - https://vuldb.com/?ctiid.323611 - https://vuldb.com/?submit.642476 - https://github.com/ueh1013/VULN/issues/3
CVE ID: CVE-2025-10252 State: PUBLISHED Published: 2025-09-11T13:32:04.989Z Last Updated: 2025-09-11T13:51:59.150Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R) Vendors: SEAT Products: Queue Ticket Kiosk Problem Types: CWE-502, CWE-20 Description: A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This affects an unknown part of the component Java RMI Registry Handler. This manipulation causes deserialization. The attack can only be done within the local network. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in
cated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323612 - https://vuldb.com/?ctiid.323612 - https://vuldb.com/?submit.642598
CVE ID: CVE-2025-10253 State: PUBLISHED Published: 2025-09-11T14:02:06.360Z Last Updated: 2025-09-11T14:27:15.248Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: openDCIM Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handler. Such manipulation of the argument Filedata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323613 - https://vuldb.com/?ctiid.323613 - https://vuldb.com/?submit.642716 - https://github.com/lam-sec/openDCIMpoc
CVE ID: CVE-2025-10254 State: PUBLISHED Published: 2025-09-11T15:32:05.251Z Last Updated: 2025-09-11T16:23:19.388Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: Ascensio System SIA Products: OnlyOffice Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.aspx of the component SVG Image Handler. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was informed early about this issue and replied: "We are already work
has been made public and could be used. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323614 - https://vuldb.com/?ctiid.323614 - https://vuldb.com/?submit.635870 - https://hkohi.ca/vulnerability/20