Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ysize - 1) + rle_raw_size / 2, which may exceed rle_raw_size. We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/436510153
CVE ID: CVE-2025-59732 State: PUBLISHED Published: 2025-10-06T08:09:31.276Z Last Updated: 2025-10-19T14:52:36.920Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-787 Description: When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or width of the image is not divisible by 8, the copy loops at [0] and [1] will continue to write until the next multiple of 8. The buffer td->uncompressed_data is allocated in decode_block based on the precise height and width of the image, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2]
e, so the "rounded-up" multiple of 8 in the copy loop can exceed the buffer bounds, and the write block starting at [2] can corrupt following heap memory. We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/436510316
CVE ID: CVE-2025-59733 State: PUBLISHED Published: 2025-10-06T08:09:37.290Z Last Updated: 2025-10-19T14:52:14.577Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-787 Description: When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that all image channels have the same pixel type (and size), and that if there are four channels, the first four are "B", "G", "R" and "A". The channel parsing code can be found in decode_header. The buffer td->uncompressed_data is allocated in decode_block based on the xsize, ysize and computed current_channel_offset. The function dwa_uncompress then assumes at [5] that if there are 4 channels, these are "B", "G",
rrent_channel_offset. The function dwa_uncompress then assumes at [5] that if there are 4 channels, these are "B", "G", "R" and "A", and in the calculations at [6] and [7] that all channels are of the same type, which matches the type of the main color channels. If we set the main color channels to a 4-byte type and add duplicate or unknown channels of the 2-byte EXR_HALF type, then the addition at [7] will increment the pointer by 4-bytes * xsize * nb_channels, which will exceed the allocated buffer. We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/436511754
CVE ID: CVE-2025-59734 State: PUBLISHED Published: 2025-10-06T08:09:44.280Z Last Updated: 2025-10-19T14:51:43.143Z Vendors: FFmpeg Products: FFmpeg Problem Types: CWE-416 Description: It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion <2. When a STOR chunk is present, a subsequent FOBJ chunk will be saved in ctx->stored_frame. Stored frames can later be referenced by FTCH chunks. For files using subversion < 2, the undecoded frame is stored, and decoded again when the FTCH chunks are parsed. However, in process_frame_obj if the frame has an invalid size, there’s an early return, with a value of 0. This causes the code in decod
ss_frame_obj if the frame has an invalid size, there’s an early return, with a value of 0. This causes the code in decode_frame to still store the raw frame buffer into ctx->stored_frame. Leaving ctx->has_dimensions set to false. A subsequent chunk with type FTCH would call process_ftch and decode that frame obj again, adding to the top/left values and calling process_frame_obj again. Given that we never set ctx->have_dimensions before, this time we set the dimensions, calling init_buffers, which can reallocate the buffer in ctx->stored_frame, freeing the previous one. However, the GetByteContext object gb still holds a reference to the old buffer. Finally, when the code tries to decode the
ver, the GetByteContext object gb still holds a reference to the old buffer. Finally, when the code tries to decode the frame, codecs that accept a GetByteContext as a parameter will trigger a use-after-free read when using gb. GetByteContext is only used for reading bytes, so at most one could read invalid data. There are no heap allocations between the free and when the object is accessed. However, upon returning to process_ftch, the code restores the original values for top/left in stored_frame, writing 4 bytes to the freed data at offset 6, potentially corrupting the allocator’s metadata. This issue can be triggered just by probing whether a file has the sanm format. We recommend upgradi
locator’s metadata. This issue can be triggered just by probing whether a file has the sanm format. We recommend upgrading to version 8.0 or beyond. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://issuetracker.google.com/440183164
CVE ID: CVE-2025-59735 State: PUBLISHED Published: 2025-10-02T13:59:36.381Z Last Updated: 2025-10-02T15:52:52.719Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59736 State: PUBLISHED Published: 2025-10-02T14:01:56.697Z Last Updated: 2025-10-02T15:52:39.374Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_DJO.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59737 State: PUBLISHED Published: 2025-10-02T14:02:41.242Z Last Updated: 2025-10-02T15:52:26.737Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_LXA.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59738 State: PUBLISHED Published: 2025-10-02T14:03:10.821Z Last Updated: 2025-10-02T15:51:58.767Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_BET.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59739 State: PUBLISHED Published: 2025-10-02T14:03:54.388Z Last Updated: 2025-10-02T15:51:14.217Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_original.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59740 State: PUBLISHED Published: 2025-10-02T14:07:57.757Z Last Updated: 2025-10-02T15:51:04.535Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/clt/LOGINFRM_CAT.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59741 State: PUBLISHED Published: 2025-10-02T14:08:42.809Z Last Updated: 2025-10-02T15:50:52.926Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-77 Description: Operating system command injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute operating system commands on the server by sending a POST request. The relationship between parameter and assigned identifier is a 'm' parameter in '/CLT/LOGINERRORFRM.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59742 State: PUBLISHED Published: 2025-10-02T14:11:26.029Z Last Updated: 2025-10-02T15:50:43.667Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-89 Description: SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'USRMAIL' parameter in'/inc/login/TRACK_REQUESTFRMSQL.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59743 State: PUBLISHED Published: 2025-10-02T14:13:38.370Z Last Updated: 2025-10-02T15:47:09.585Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-89 Description: SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending a POST request. The relationship between parameter and assigned identifier is a 'SessionID' cookie in '/inc/connect/CONNECTION.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59744 State: PUBLISHED Published: 2025-10-02T14:16:32.701Z Last Updated: 2025-10-02T15:46:56.102Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-22 Description: Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only within the web root using the “docurl” parameter in “/lib/asp/DOCSAVEASASP.ASP”. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59745 State: PUBLISHED Published: 2025-10-02T14:18:52.916Z Last Updated: 2025-10-02T15:46:49.054Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-327 Description: Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cryptographically vulnerable hash algorithm and is no longer considered secure for storing or transmitting passwords. It is vulnerable to collision attacks and can be easily cracked with modern hardware, exposing user credentials to potential risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnera
CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59746 State: PUBLISHED Published: 2025-10-02T14:20:51.841Z Last Updated: 2025-10-02T15:46:17.068Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'm' parameter in '/lib/asp/alert.asp'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59747 State: PUBLISHED Published: 2025-10-02T14:21:17.682Z Last Updated: 2025-10-02T15:45:44.848Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in '/clt/resetPassword.asp'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59748 State: PUBLISHED Published: 2025-10-02T14:21:53.364Z Last Updated: 2025-10-02T15:45:37.868Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' and 'reset' parameters in '/clt/changepassword.asp'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59749 State: PUBLISHED Published: 2025-10-02T14:23:26.679Z Last Updated: 2025-10-02T15:45:31.837Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in '/clt/TRACK_REQUEST.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59750 State: PUBLISHED Published: 2025-10-02T14:24:15.272Z Last Updated: 2025-10-02T15:45:25.335Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59751 State: PUBLISHED Published: 2025-10-02T14:24:41.512Z Last Updated: 2025-10-02T15:45:18.427Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DJO.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59752 State: PUBLISHED Published: 2025-10-02T14:25:11.985Z Last Updated: 2025-10-02T15:45:11.411Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LXA.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59753 State: PUBLISHED Published: 2025-10-02T14:25:33.408Z Last Updated: 2025-10-02T15:45:04.460Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_BET.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59754 State: PUBLISHED Published: 2025-10-02T14:26:56.536Z Last Updated: 2025-10-02T15:44:57.074Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_original.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e
nt: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59755 State: PUBLISHED Published: 2025-10-02T14:27:24.746Z Last Updated: 2025-10-02T15:44:50.454Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CAT.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59756 State: PUBLISHED Published: 2025-10-02T14:27:47.919Z Last Updated: 2025-10-02T15:44:42.774Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in 'SuppConn in /clt/LOGINFRM_CON.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-and
nrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59757 State: PUBLISHED Published: 2025-10-02T14:30:15.137Z Last Updated: 2025-10-02T15:44:30.397Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CATOLD.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-t
: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59758 State: PUBLISHED Published: 2025-10-02T14:34:01.160Z Last Updated: 2025-10-02T15:44:23.740Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CYLOG.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tm
References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59759 State: PUBLISHED Published: 2025-10-02T14:34:21.531Z Last Updated: 2025-10-02T15:44:15.339Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DELCROIX.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e
CVE ID: CVE-2025-59760 State: PUBLISHED Published: 2025-10-02T14:34:51.879Z Last Updated: 2025-10-02T15:44:08.678Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DHL.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms
CVE ID: CVE-2025-59761 State: PUBLISHED Published: 2025-10-02T14:35:18.157Z Last Updated: 2025-10-02T15:43:59.655Z Vendors: AndSoft Products: e-TMS Problem Types: CWE-79 Description: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DLG.ASP'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/update-24092025-multiple-vulnerabilities-andsofts-e-tms