Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241286
CVE ID: CVE-2025-2825 State: REJECTED Published: 2025-03-26T15:58:14.218Z Last Updated: 2025-04-04T19:48:00.370Z Description: No description available.
CVE ID: CVE-2025-2826 State: PUBLISHED Published: 2025-05-27T22:22:51.717Z Last Updated: 2025-05-28T13:34:08.151Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Arista Networks Products: EOS Problem Types: CWE-1284 Description: n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to incorrectly be allowed or denied. The two symptoms of this issue on the affected release and platform are: * Packets which should be permitted may be
ied. The two symptoms of this issue on the affected release and platform are: * Packets which should be permitted may be dropped and, * Packets which should be dropped may be permitted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21414-security-advisory-0120
CVE ID: CVE-2025-2827 State: PUBLISHED Published: 2025-07-08T15:01:52.545Z Last Updated: 2025-08-24T11:22:04.961Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling File Gateway Problem Types: CWE-548 Description: IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239094
CVE ID: CVE-2025-2828 State: PUBLISHED Published: 2025-06-23T20:42:28.639Z Last Updated: 2025-06-24T13:32:19.925Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: langchain-ai Products: langchain-ai/langchain Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result
t enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result, an attacker could exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. This issue has been fixed in version 0.0.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc - https://github.com/langchain-ai/langchain/commit/e188d4ecb085d4561a0be3c583d26aa9c2c3283f
CVE ID: CVE-2025-2829 State: PUBLISHED Published: 2025-04-08T15:24:34.831Z Last Updated: 2025-04-08T18:27:51.914Z Vendors: Rockwell Automation Products: Arena® Problem Types: CWE-787 Description: A local code execution vulnerability exists in the Rockwell Automation Arena® due to a threat actor being able to write outside of the allocated memory buffer. The flaw is a result of improper validation of user-supplied data. If exploited a threat actor can disclose information and execute arbitrary code on the system. To exploit the vulnerability a legitimate user must open a malicious DOE file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-
CVE ID: CVE-2025-2830 State: PUBLISHED Published: 2025-04-15T15:06:13.895Z Last Updated: 2025-04-15T18:10:39.280Z Vendors: Mozilla Products: Thunderbird Problem Types: Information Disclosure of /tmp directory listing Description: By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunde
inux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1956379 - https://www.mozilla.org/security/advisories/mfsa2025-26/ - https://www.mozilla.org/security/advisories/mfsa2025-27/
CVE ID: CVE-2025-2831 State: PUBLISHED Published: 2025-03-27T03:00:14.303Z Last Updated: 2025-03-27T13:44:06.459Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: mingyuefusu 明月复苏 Products: tushuguanlixitong 图书管理系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Anal
ion. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301468 - https://vuldb.com/?ctiid.301468 - https://vuldb.com/?submit.521458 - https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSJL
CVE ID: CVE-2025-2832 State: PUBLISHED Published: 2025-03-27T03:31:09.720Z Last Updated: 2025-03-27T13:43:33.548Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: mingyuefusu 明月复苏 Products: tushuguanlixitong 图书管理系统 Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301469 - https://vuldb.com/?ctiid.301469 - https://vuldb.com/?submit.521460 - https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTSPH
CVE ID: CVE-2025-2833 State: PUBLISHED Published: 2025-03-27T04:00:05.554Z Last Updated: 2025-03-27T13:41:47.915Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: zhangyd-c Products: OneBlog Problem Types: CWE-1333, CWE-400 Description: A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: R
tely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301470 - https://vuldb.com/?ctiid.301470 - https://vuldb.com/?submit.521813 - https://github.com/zhangyd-c/OneBlog/issues/35 - https://github.com/zhangyd-c/OneBlog/issues/35#issue-2914268214
CVE ID: CVE-2025-2835 State: PUBLISHED Published: 2025-03-27T04:00:07.721Z Last Updated: 2025-03-27T13:40:16.293Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: zhangyd-c Products: OneBlog Problem Types: CWE-918 Description: A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301471 - https://vuldb.com/?ctiid.301471 - https://vuldb.com/?submit.521815 - https://github.com/zhangyd-c/OneBlog/issues/36 - https://github.com/zhangyd-c/OneBlog/issues/36#issue-2923097259
CVE ID: CVE-2025-2836 State: PUBLISHED Published: 2025-04-04T05:22:45.468Z Last Updated: 2025-04-04T13:08:02.541Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: metagauss Products: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Problem Types: CWE-79 Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with S
3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c0c3932-bdb0-4edb-bfec-2ed52cbc5cb6?source=cve - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.4.3/libs/factory/class_rm_form_factory_revamp.php#L1274 - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags
amp.php#L1274 - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.4.3/libs/factory/class_rm_form_factory_revamp.php#L1820 - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.4.3/includes/class_registration_magic.php#L1215 - https://plugins.trac.wordpress.org/changeset/3265041/
CVE ID: CVE-2025-2837 State: PUBLISHED Published: 2025-03-26T21:16:28.720Z Last Updated: 2025-03-27T15:05:03.581Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Silicon Labs Products: Gecko OS Problem Types: CWE-121 Description: Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of use
w exists within the handling of HTTP requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23245. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-871/ - https://community.silabs.com/a45Vm0000000Atp
CVE ID: CVE-2025-2838 State: PUBLISHED Published: 2025-03-26T21:16:33.186Z Last Updated: 2025-03-27T14:52:53.920Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Silicon Labs Products: Gecko OS Problem Types: CWE-835 Description: Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop.
w exists within the processing of DNS responses. The issue results from a logic error that can lead to an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-23392. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-872/ - https://community.silabs.com/a45Vm0000000Atp
CVE ID: CVE-2025-2839 State: PUBLISHED Published: 2025-04-22T05:27:23.927Z Last Updated: 2025-04-22T13:13:16.621Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vjinfotech Products: WP Import Export Lite Problem Types: CWE-79 Description: The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8ca1ead-1bc5-4ccc-9034-559db27f5e82?source=cve - https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/assets/js/wpie-export-admin.min.js - https://plugins.trac.wordpress.org/changeset/3274100/
CVE ID: CVE-2025-2840 State: PUBLISHED Published: 2025-03-29T07:03:29.710Z Last Updated: 2025-03-31T13:19:54.340Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bhuvnesh Products: DAP to Autoresponders Email Syncing Problem Types: CWE-200 Description: The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
tion contained in the exposed file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff90774-f5f6-4d9c-9565-1cff31f9bec4?source=cve - https://plugins.trac.wordpress.org/browser/dap-to-autoresponders-daar/trunk/infusionsoft_src/phpinfo.php#L3 - https://wordpress.org/plugins/dap-to-autoresponders-daar/#developers
CVE ID: CVE-2025-2841 State: PUBLISHED Published: 2025-04-12T02:23:14.583Z Last Updated: 2025-04-14T19:22:00.733Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: reality66 Products: Cart66 Cloud :: WordPress Ecommerce The Easy Way Problem Types: CWE-200 Description: The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/
ntained in the exposed file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5be01bba-e4f4-4818-9612-fc37b648a349?source=cve - https://plugins.trac.wordpress.org/browser/cart66-cloud/tags/2.3.7/views/admin/html-system-info.php#L26 - https://plugins.trac.wordpress.org/browser/cart66-cloud/tags/2.3.7/views/admin/html-system-info.php#L39 - https://plugins.trac.wordpress.org/browser/cart66-cloud/tags/2.3.7/views/admin/html-system-info.php#L59 - https://wordpress.org/plugins/cart66-cloud/#developers
CVE ID: CVE-2025-2842 State: PUBLISHED Published: 2025-04-02T11:09:55.496Z Last Updated: 2025-11-20T20:42:20.922Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift distributed tracing 3.5.2, Red Hat OpenShift distributed tracing 3 Problem Types: CWE-200 Description: A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get'
he cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:3607 - https://access.redhat.com/errata/RHSA-2025:3740 - https://access.redhat.com/security/cve/CVE-2025-2842 - https://bugzilla.redhat.com/show_bug.cgi?id=2355219
CVE ID: CVE-2025-2843 State: PUBLISHED Published: 2025-11-12T16:36:04.735Z Last Updated: 2025-11-12T21:05:01.616Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Cluster Observability Operator 1.3.0 Problem Types: CWE-266 Description: A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by
g a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:21146 - https://access.redhat.com/security/cve/CVE-2025-2843 - https://bugzilla.redhat.com/show_bug.cgi?id=2355222
CVE ID: CVE-2025-2845 State: REJECTED Published: N/A Last Updated: 2025-04-09T22:15:57.485Z Description: No description available.
CVE ID: CVE-2025-2846 State: PUBLISHED Published: 2025-03-27T12:31:05.130Z Last Updated: 2025-03-27T13:09:05.076Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects the function registration of the file /oews/classes/Users.php?f=registration of the component Registration. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
motely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301492 - https://vuldb.com/?ctiid.301492 - https://vuldb.com/?submit.522326 - https://github.com/jeajeaa/cve/blob/main/sql.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-2847 State: PUBLISHED Published: 2025-03-27T13:00:19.885Z Last Updated: 2025-03-27T13:20:01.951Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Codezips Products: Gym Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. This issue affects some unknown processing of the file /dashboard/admin/over_month.php. The manipulation of the argument mm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301493 - https://vuldb.com/?ctiid.301493 - https://vuldb.com/?submit.522330 - https://www.yuque.com/baimatangseng-iyusa/qwwm81/zbefafzyl0of6g56?singleDoc
CVE ID: CVE-2025-2849 State: PUBLISHED Published: 2025-03-27T13:31:06.442Z Last Updated: 2025-03-27T14:11:39.541Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: UPX Problem Types: CWE-122, CWE-119 Description: A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to
may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.301494 - https://vuldb.com/?ctiid.301494 - https://vuldb.com/?submit.522371 - https://github.com/upx/upx/issues/898 - https://github.com/upx/upx/issues/898#issuecomment-2734082143 - https://github.com/user-attachments/files/19307868/input.zip - https://github.com/upx/upx/commit/e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2
CVE ID: CVE-2025-2850 State: PUBLISHED Published: 2025-04-26T07:31:03.631Z Last Updated: 2025-04-28T18:09:52.772Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GL.iNet Products: GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli, GL-XE3000 Puli AX Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in GL.i
pitz AX, GL-XE300 Puli, GL-XE3000 Puli AX Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been rated as problematic. This issue affects some unknown processing of the component Download Interface. The manipulation leads to improper authoriz