Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6906 State: PUBLISHED Published: 2025-06-30T12:02:05.578Z Last Updated: 2025-06-30T15:22:08.431Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Car Rental System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Car Rental System 1.0. This affects an unknown part of the file /login.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314397 - https:
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314397 - https://vuldb.com/?ctiid.314397 - https://vuldb.com/?submit.606157 - https://github.com/zzb1388/cve/issues/14 - https://code-projects.org/
CVE ID: CVE-2025-6907 State: PUBLISHED Published: 2025-06-30T12:32:06.124Z Last Updated: 2025-06-30T15:20:23.201Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Car Rental System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Car Rental System 1.0. This vulnerability affects unknown code of the file /book_car.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314398 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314398 - https://vuldb.com/?ctiid.314398 - https://vuldb.com/?submit.606158 - https://github.com/zzb1388/cve/issues/13 - https://code-projects.org/
CVE ID: CVE-2025-6908 State: PUBLISHED Published: 2025-06-30T13:02:07.209Z Last Updated: 2025-06-30T14:51:03.036Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument sertitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314400 - https://vuldb.com/?ctiid.314400 - https://vuldb.com/?submit.604928 - https://github.com/f1rstb100d/myCVE/issues/91 - https://phpgurukul.com/
CVE ID: CVE-2025-6909 State: PUBLISHED Published: 2025-06-30T13:32:07.564Z Last Updated: 2025-06-30T13:49:04.227Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314401 - https://vuldb.com/?ctiid.314401 - https://vuldb.com/?submit.604929 - https://github.com/f1rstb100d/myCVE/issues/92 - https://phpgurukul.com/
CVE ID: CVE-2025-6910 State: PUBLISHED Published: 2025-06-30T14:02:06.649Z Last Updated: 2025-06-30T14:38:13.362Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. The manipulation of the argument session leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314403 - https://vuldb.com/?ctiid.314403 - https://vuldb.com/?submit.605075 - https://github.com/f1rstb100d/myCVE/issues/93 - https://phpgurukul.com/
CVE ID: CVE-2025-6911 State: PUBLISHED Published: 2025-06-30T14:32:06.901Z Last Updated: 2025-06-30T14:50:33.980Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314404 - https://vuldb.com/?ctiid.314404 - https://vuldb.com/?submit.605076 - https://github.com/f1rstb100d/myCVE/issues/94 - https://phpgurukul.com/
CVE ID: CVE-2025-6912 State: PUBLISHED Published: 2025-06-30T15:02:06.564Z Last Updated: 2025-06-30T20:02:13.694Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Student Record System 3.2. It has been rated as critical. This issue affects some unknown processing of the file /manage-students.php. The manipulation of the argument del leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314405 - https://vuldb.com/?ctiid.314405 - https://vuldb.com/?submit.605077 - https://github.com/f1rstb100d/myCVE/issues/95 - https://phpgurukul.com/
CVE ID: CVE-2025-6913 State: PUBLISHED Published: 2025-06-30T15:32:06.995Z Last Updated: 2025-06-30T15:47:06.052Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314406 - https://vuldb.com/?ctiid.314406 - https://vuldb.com/?submit.605078 - https://github.com/f1rstb100d/myCVE/issues/96 - https://phpgurukul.com/
CVE ID: CVE-2025-6914 State: PUBLISHED Published: 2025-06-30T16:02:06.660Z Last Updated: 2025-06-30T16:06:44.178Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Student Record System 3.2. Affected by this vulnerability is an unknown functionality of the file /edit-student.php. The manipulation of the argument fmarks2 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314407 - https://vuldb.com/?ctiid.314407 - https://vuldb.com/?submit.605079 - https://github.com/f1rstb100d/myCVE/issues/97 - https://phpgurukul.com/
CVE ID: CVE-2025-6915 State: PUBLISHED Published: 2025-06-30T16:32:07.016Z Last Updated: 2025-06-30T16:56:48.925Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Student Record System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Student Record System 3.2. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument session leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314408 - https://vuldb.com/?ctiid.314408 - https://vuldb.com/?submit.605080 - https://github.com/f1rstb100d/myCVE/issues/98 - https://phpgurukul.com/
CVE ID: CVE-2025-6916 State: PUBLISHED Published: 2025-06-30T17:02:07.995Z Last Updated: 2025-06-30T20:47:24.541Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:R) Vendors: TOTOLINK Products: T6 Problem Types: CWE-306, CWE-287 Description: A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
k. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314409 - https://vuldb.com/?ctiid.314409 - https://vuldb.com/?submit.605101 - https://github.com/c0nyy/IoT_vuln/blob/main/TOTOLINK%20T6%20Vuln.md - https://www.totolink.net/
CVE ID: CVE-2025-6917 State: PUBLISHED Published: 2025-06-30T17:32:05.726Z Last Updated: 2025-06-30T17:57:33.761Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Hotel Booking Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Online Hotel Booking 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/registration.php. The manipulation of the argument uname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314410 - https://vuldb.com/?ctiid.314410 - https://vuldb.com/?submit.606285 - https://github.com/MaxedFF/cve/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-6918 State: PUBLISHED Published: 2025-07-28T11:05:16.203Z Last Updated: 2025-07-28T14:32:37.380Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ncvav Products: Virtual PBX Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection.This issue affects Virtual PBX Software: before 09.07.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0180
CVE ID: CVE-2025-6919 State: PUBLISHED Published: 2025-10-13T12:46:11.403Z Last Updated: 2025-10-21T19:53:01.085Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cats Information Technology Software Development Technologies Products: Aykome License Tracking System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection.This issue affects Aykome License Tracking System: before Version dated 06.10.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
cense Tracking System: before Version dated 06.10.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0332
CVE ID: CVE-2025-6920 State: PUBLISHED Published: 2025-07-01T13:16:17.180Z Last Updated: 2025-11-20T20:59:11.209Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat AI Inference Server Problem Types: CWE-306 Description: A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows unauthorized users to access the same inference features available on protected endpoints, potentially exposing sensitive func
orized users to access the same inference features available on protected endpoints, potentially exposing sensitive functionality or allowing unintended access to backend resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-6920 - https://bugzilla.redhat.com/show_bug.cgi?id=2375522
CVE ID: CVE-2025-6921 State: PUBLISHED Published: 2025-09-23T13:56:15.636Z Last Updated: 2025-09-23T14:56:29.038Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-400 Description: The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the r
ecay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f - https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be
CVE ID: CVE-2025-6925 State: PUBLISHED Published: 2025-06-30T18:02:05.860Z Last Updated: 2025-06-30T18:20:46.486Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Dromara Products: RuoYi-Vue-Plus Problem Types: CWE-22 Description: A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
s to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314437 - https://vuldb.com/?ctiid.314437 - https://vuldb.com/?submit.600948 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.md - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250620-01/report.md#steps-to-reproduce
CVE ID: CVE-2025-6926 State: PUBLISHED Published: 2025-07-03T16:23:56.503Z Last Updated: 2025-11-03T20:07:17.094Z Vendors: Wikimedia Foundation Products: Mediawiki - CentralAuth Extension Problem Types: CWE-287 Description: Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T389010 - https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165117
CVE ID: CVE-2025-6929 State: PUBLISHED Published: 2025-06-30T21:02:06.521Z Last Updated: 2025-07-01T13:22:23.883Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Zoo Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/view-normal-ticket.php. The manipulation of the argument viewid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314441 - https://vuldb.com/?ctiid.314441 - https://vuldb.com/?submit.605578 - https://github.com/f1rstb100d/myCVE/issues/99 - https://phpgurukul.com/
CVE ID: CVE-2025-6930 State: PUBLISHED Published: 2025-06-30T22:02:06.332Z Last Updated: 2025-07-01T13:47:21.242Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Zoo Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314442 - https://vuldb.com/?ctiid.314442 - https://vuldb.com/?submit.605579 - https://github.com/f1rstb100d/myCVE/issues/100 - https://phpgurukul.com/
CVE ID: CVE-2025-6931 State: PUBLISHED Published: 2025-06-30T22:32:09.468Z Last Updated: 2025-07-01T13:45:40.519Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: D-Link Products: DCS-6517, DCS-7517 Problem Types: CWE-331, CWE-330 Description: A vulnerability classified as problematic was found in D-Link DCS-6517 and DCS-7517 up to 2.02.0. Affected by this vulnerability is the function generate_pass_from_mac of the file /bin/httpd of the component Root Password Generation Handler. The manipulation leads to insufficient entropy. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
e attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314443 - https://vuldb.com/?ctiid.314443 - https://vuldb.com/?submit.605592 - https://vuldb.com/?submit.605593 - https://vuldb.com/?submit.605596 - http://cdn2.v50to.cc/dlink/DCS-6517B1_FW_v2.02.01/report_3.pdf - http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_1.pdf - https://www.dlink.com/
CVE ID: CVE-2025-6932 State: PUBLISHED Published: 2025-06-30T23:02:08.045Z Last Updated: 2025-07-01T13:39:11.315Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: D-Link Products: DCS-7517 Problem Types: CWE-259, CWE-255 Description: A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /bin/httpd of the component Qlync Password Generation Handler. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit
he attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314445 - https://vuldb.com/?ctiid.314445 - https://vuldb.com/?submit.605595 - http://cdn2.v50to.cc/dlink/DCS-7517_B1_FW_v2.02.01/report_2.pdf - https://www.dlink.com/
CVE ID: CVE-2025-6934 State: PUBLISHED Published: 2025-07-01T06:43:03.156Z Last Updated: 2025-07-02T13:24:45.496Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpopal Products: Opal Estate Pro – Property Management and Submission Problem Types: CWE-269 Description: The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily c
ng registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7b75a4-67b4-4347-91a6-dbf98da5ceaf?source=cve - https://themeforest.net/item/fullhouse-real-estate-responsive-wordpress-theme/16179481 - https://plugins.trac.wordpress.org/browser/opal-estate-pro/trunk/inc/user/class-opalestate-user.php#L228 - https://plugins.trac.wordpress.org/browser/opal-estate-pro/trunk/inc/user/class-opalestate-user.php#L235
CVE ID: CVE-2025-6935 State: PUBLISHED Published: 2025-06-30T23:32:06.444Z Last Updated: 2025-07-01T19:18:01.287Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Sales and Inventory System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/payment_add.php. The manipulation of the argument cid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.314456 - https://vuldb.com/?ctiid.314456 - https://vuldb.com/?submit.605720 - https://github.com/dragonghost2025/cve/issues/9 - https://www.campcodes.com/