Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-29526 State: PUBLISHED Published: 2025-04-23T00:00:00.000Z Last Updated: 2025-04-23T18:50:23.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execute arbitrary Javascript via injecting a crafted payload into the SearchTerm parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.google.com/document/d/15vZXyzddcOv61sFSb3Lf9Dg1rnZ9n3Q6ANoa82jzcNA/edit?usp=sharing - https://gist.github.com/k4nt0r/6ee5bfe9215cb10a436a03c67cf908fd
CVE ID: CVE-2025-29529 State: PUBLISHED Published: 2025-04-24T00:00:00.000Z Last Updated: 2025-04-25T17:08:23.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chamilo/chamilo-lms/commit/beb07770d674fcc9db6df0e59aab107678c28682 - https://github.com/Yoshik0xF6/CVE-2025-29529
CVE ID: CVE-2025-29534 State: PUBLISHED Published: 2025-07-28T00:00:00.000Z Last Updated: 2025-07-28T19:53:35.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://wave.com - https://gist.github.com/EmptyButter/19b2c626f4589d1f9d4478632205a9eb
CVE ID: CVE-2025-29547 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T19:31:51.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to cause a denial of service because of a null pointer dereference from IOCtl 0x96202000. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://horizondatasys.com/rollback-rx-time-machine/rollback-rx-professional/ - https://packetstorm.news/files/id/190491/
CVE ID: CVE-2025-29556 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T20:00:13.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an attacker to bypass these restrictions via API request manipulation. An attacker with an Admin access can intercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid
ercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid Security Officers group without the required approval. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exagrid.com/ - https://github.com/0xsu3ks/CVE-2025-29556
CVE ID: CVE-2025-29557 State: PUBLISHED Published: 2025-07-31T00:00:00.000Z Last Updated: 2025-07-31T19:48:10.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exagrid.com/ - https://github.com/0xsu3ks/CVE-2025-29557
CVE ID: CVE-2025-29568 State: PUBLISHED Published: 2025-04-24T00:00:00.000Z Last Updated: 2025-04-24T15:14:52.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects some unknown features in the file /Scheduling/pages/class_sched.php. Manipulating the class parameter can lead to cross-site scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/secloverwang/-Vulnerability-recurrence/issues/1
CVE ID: CVE-2025-29570 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-07T14:52:50.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binary named rc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IOTRes/IOT_Firmware_Update/blob/main/firmwareupdate.md
CVE ID: CVE-2025-29572 State: REJECTED Published: N/A Last Updated: 2025-07-18T05:13:32.687Z Description: No description available.
CVE ID: CVE-2025-29573 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T14:04:33.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stephenmcd/mezzanine - https://www.squadappsec.com/post/cve-2025-29573-persistent-xss-in-mezzanine-cms-6-0-0-via-malicious-filename
CVE ID: CVE-2025-29592 State: PUBLISHED Published: 2025-09-10T00:00:00.000Z Last Updated: 2025-09-10T20:02:50.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: oasys v1.1 is vulnerable to Directory Traversal in ProcedureController. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/qkdjksfkeg/Security-Collections/blob/main/PathTraversal.md
CVE ID: CVE-2025-29594 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T13:25:42.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately validated before being processed. Specifically, the $_GET['errorcode'] parameter can be manipulated to access unauthorized error codes, leading to Cross-Site Scripting (XSS) attacks and information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LielXD/CS2-WeaponPaints-Website/blob/b1d8364c1cbcab6981a564d8abe43b1cc26a2503/errorpage.php#L41 -
- https://github.com/LielXD/CS2-WeaponPaints-Website/blob/b1d8364c1cbcab6981a564d8abe43b1cc26a2503/errorpage.php#L41 - https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-29594
CVE ID: CVE-2025-29602 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-08T18:31:05.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/flatpressblog/flatpress - https://harish0x.github.io/blog/CVE-2025-29602
CVE ID: CVE-2025-29606 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-14T14:13:07.783Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: libp2p Products: py-libp2p Problem Types: CWE-770 Description: py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libp2p/py-libp2p/issues/526 - https://github.com/libp2p/py-libp2p/pull/531/files - https://github.com/libp2p/py-libp2p/compare/v0.2.2...v0.2.3
CVE ID: CVE-2025-29621 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T20:44:26.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This vulnerability allows attackers to manipulate application settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@rudranshsinghrajpurohit/content-spoofing-vulnerability-in-rosariosis-student-information-system-f6101e1ff84d - https://www.getastra.com/blog/vulnerability/content-spoofing-vulnerability-in-rosariosis-student-inform
m-f6101e1ff84d - https://www.getastra.com/blog/vulnerability/content-spoofing-vulnerability-in-rosariosis-student-information-system/
CVE ID: CVE-2025-29625 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T14:46:11.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in Astrolog v7.70 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via an overly long environment variable passed to FileOpen function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CruiserOne/Astrolog/issues/25 - https://blog.reodus.com/posts/cve-2025-29625/
CVE ID: CVE-2025-29627 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-09T19:47:50.738Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keepersecurity.com/ - https://www.keepersecurity.com/en_GB/keeperchat.html - https://github.com/SahilDabhilkar/CVE-Reference/blob/main/CVE-2025-29627.md
CVE ID: CVE-2025-29628 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T20:23:05.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute arbitrary code via a request Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gardyn.com - https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md
CVE ID: CVE-2025-29629 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T18:39:47.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Gardyn 4 allows a remote attacker to obtain sensitive information and execute arbitrary code via the Gardyn Home component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gardyn.com - https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29629.md
CVE ID: CVE-2025-29630 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T20:24:47.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Gardyn 4 allows a remote attacker with the corresponding ssh private key can gain remote root access to affected devices Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gardyn.com - https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29630.md
CVE ID: CVE-2025-29631 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T18:32:46.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Gardyn 4 allows a remote attacker execute arbitrary code Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gardyn.com - https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md
CVE ID: CVE-2025-29632 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T18:07:21.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/free5gc/free5gc/issues/657 - https://github.com/OHnogood/CVE-2025-29632/
CVE ID: CVE-2025-29635 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-25T14:50:51.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md
CVE ID: CVE-2025-29640 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-24T17:52:33.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the parameter searchdata.. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pei4AN/CVE/issues/4
CVE ID: CVE-2025-29641 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-24T17:59:28.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pei4AN/CVE/issues/5
CVE ID: CVE-2025-29646 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-20T12:56:55.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and (teid = 0 or teid >= ogs_pfcp_pdr_teid_pool.size). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/3747 - https://gist.github.com/scmdcs/581fa485f957239ea5551daa173d0189
CVE ID: CVE-2025-29647 State: PUBLISHED Published: 2025-04-03T00:00:00.000Z Last Updated: 2025-04-04T15:32:51.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/B00W_NSD/poc/blob/master/seacms13.3-sql/poc.md
CVE ID: CVE-2025-29648 State: REJECTED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-06-16T21:56:36.141Z Description: No description available.
CVE ID: CVE-2025-29649 State: REJECTED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-06-16T21:57:22.830Z Description: No description available.
CVE ID: CVE-2025-29650 State: REJECTED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-06-16T21:57:50.735Z Description: No description available.
CVE ID: CVE-2025-29651 State: REJECTED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-06-16T21:58:35.278Z Description: No description available.
CVE ID: CVE-2025-29652 State: REJECTED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-06-16T21:59:14.518Z Description: No description available.
CVE ID: CVE-2025-29653 State: REJECTED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-06-16T22:00:18.988Z Description: No description available.
CVE ID: CVE-2025-29659 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T15:01:10.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yasha-ops/RCE-YiIOT - https://github.com/Yasha-ops/vulnerability-research/tree/master/CVE-2025-29659
CVE ID: CVE-2025-29660 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T15:09:08.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory traversal techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Yasha-ops/RCE-YiIOT - https://github.com/Yasha-ops/vulnerability-research/tree/master/CVE-2025-29660
CVE ID: CVE-2025-29661 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T18:21:59.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/litepubl/cms/issues/1
CVE ID: CVE-2025-29662 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T16:00:17.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/landchat/LandChat/issues/5
CVE ID: CVE-2025-29686 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T16:10:19.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/hailey888/oa_system/issues/IBRQWG
CVE ID: CVE-2025-29688 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T14:02:08.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/hailey888/oa_system/issues/IBRRZX
CVE ID: CVE-2025-29689 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T14:13:54.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/hailey888/oa_system/issues/IBRQZ9
CVE ID: CVE-2025-29690 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T14:01:25.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/hailey888/oa_system/issues/IBRRX3
CVE ID: CVE-2025-29691 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-15T13:29:04.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/hailey888/oa_system/issues/IBRQYI
CVE ID: CVE-2025-29699 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-04T16:48:42.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fysac/netsurf-disclosure/tree/main/CVE-2025-29699 - https://www.netsurf-browser.org/
CVE ID: CVE-2025-29705 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T18:20:39.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/durcframework/code-gen - https://github.com/yxzrw/CVE-2025-29705
CVE ID: CVE-2025-29708 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:46:27.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fupanc-w1n/fupanc/blob/main/php/Company%20Website%20CMS1.md - https://github.com/fupanc-w1n/fupanc/blob/main/php/CVE-2025-29708.md
CVE ID: CVE-2025-29709 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T13:45:10.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fupanc-w1n/fupanc/blob/main/php/Company%20Website%20CMS2.md - https://github.com/fupanc-w1n/fupanc/blob/main/php/CVE-2025-29709.md
CVE ID: CVE-2025-29710 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-18T12:02:32.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Company Website CMS 1.0 is vulnerable to Cross Site Scripting (XSS) via /dashboard/Services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fupanc-w1n/fupanc/blob/main/php/Company%20Website%20CMS3.md - https://github.com/fupanc-w1n/fupanc/blob/main/php/CVE-2025-29710.md
CVE ID: CVE-2025-29719 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T15:10:03.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and Address text fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17847/employee-management-system-using-php-and-mysql-source-code.html - https://github.com/sw8y/vulnerability_research/blob/main/CVE-2025-29719/CVE-2025-29719.md
CVE ID: CVE-2025-29720 State: PUBLISHED Published: 2025-04-14T00:00:00.000Z Last Updated: 2025-04-14T18:20:17.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dify.ai - https://github.com/langgenius/dify/issues/15185
CVE ID: CVE-2025-29722 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T18:19:29.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yassmittal/Commercify - https://github.com/cypherdavy/CVE-2025-29722