Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3565 State: PUBLISHED Published: 2025-04-14T12:00:10.432Z Last Updated: 2025-04-14T13:23:20.326Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: huanfenz, code-projects Products: StudentManager Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in huanfenz/code-projects StudentManager 1.0. This vulnerability affects unknown code of the file /upload/uploadArticle.do of the component Announcement Management Section. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
tiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304606 - https://vuldb.com/?ctiid.304606 - https://vuldb.com/?submit.549316 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/StudentManager-xss.md
CVE ID: CVE-2025-3566 State: PUBLISHED Published: 2025-04-14T12:31:04.765Z Last Updated: 2025-08-26T19:26:12.111Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: veal98 小牛肉 Products: Echo 开源社区系统 Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in veal98 小牛肉 Echo 开源社区系统 4.2. This issue affects the function uploadMdPic of the file /discuss/uploadMdPic. The manipulation of the argument editormd-image-file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.30
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304607 - https://vuldb.com/?ctiid.304607 - https://vuldb.com/?submit.549509 - https://github.com/caigo8/CVE-md/blob/main/Echo/%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
CVE ID: CVE-2025-3567 State: PUBLISHED Published: 2025-04-14T13:00:06.776Z Last Updated: 2025-04-14T13:30:31.722Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: veal98 小牛肉 Products: Echo 开源社区系统 Problem Types: CWE-285, CWE-266 Description: A vulnerability, which was classified as problematic, was found in veal98 小牛肉 Echo 开源社区系统 4.2. Affected is the function preHandle of the file src/main/java/com/greate/community/controller/interceptor/LoginTicketInterceptor.java of the component Ticket Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additio
ion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304608 - https://vuldb.com/?ctiid.304608 - https://vuldb.com/?submit.549537 - https://github.com/caigo8/CVE-md/blob/main/Echo/%E4%B8%8D%E5%AE%89%E5%85%A8%E7%9A%84%E6%9D%83%E9%99%90%E6%A0%A1%E9%AA%8C.md
CVE ID: CVE-2025-3568 State: PUBLISHED Published: 2025-04-14T13:31:04.358Z Last Updated: 2025-04-14T14:00:29.161Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Webkul Products: Krayin CRM Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/settings/users/edit/ of the component SVG File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor prepares a fix for the next major release and explains that he does n
isclosed to the public and may be used. The vendor prepares a fix for the next major release and explains that he does not think therefore that this should qualify for a CVE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304609 - https://vuldb.com/?ctiid.304609 - https://vuldb.com/?submit.549591 - https://gist.github.com/shellkraft/a8b1f35d5c3ba313605065889563fb00 - https://drive.google.com/file/d/1LMzZyCgloWquJRWzJAV2bpWMTuiMs6Xa/view?usp=sharing
CVE ID: CVE-2025-3569 State: PUBLISHED Published: 2025-04-14T14:00:09.199Z Last Updated: 2025-04-14T18:06:22.155Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: JamesZBL, code-projects Products: db-hospital-drug Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file ShiroConfig.java. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional
public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304610 - https://vuldb.com/?ctiid.304610 - https://vuldb.com/?submit.549920 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/db-hospital-drug-authority.md
CVE ID: CVE-2025-3570 State: PUBLISHED Published: 2025-04-14T14:31:04.600Z Last Updated: 2025-04-14T14:36:24.850Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: JamesZBL, code-projects Products: db-hospital-drug Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0. It has been classified as problematic. This affects the function Save of the file ContentController.java. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304611 - https://vuldb.com/?ctiid.304611 - https://vuldb.com/?submit.549923 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/db-hospital-drug-xss.md
CVE ID: CVE-2025-3571 State: PUBLISHED Published: 2025-04-14T15:00:10.698Z Last Updated: 2025-04-14T15:32:38.355Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Fannuo Products: Enterprise Content Management System 凡诺企业网站管理系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Fannuo Enterprise Content Management System 凡诺企业网站管理系统 1.1/4.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/cms_chip.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304612 - https://vuldb.com/?ctiid.304612 - https://vuldb.com/?submit.549927 - https://wiki.shikangsi.com/post/share/c46c50d3-c8d7-46a0-9fed-8d79a64abb44
CVE ID: CVE-2025-3572 State: PUBLISHED Published: 2025-04-14T01:38:42.018Z Last Updated: 2025-04-14T15:50:50.785Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: INTUMIT Products: SmartRobot Problem Types: CWE-918 Description: SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10064-6346a-1.html - https://www.twcert.org.tw/en/cp-139-10065-2494c-2.html
CVE ID: CVE-2025-3573 State: PUBLISHED Published: 2025-04-15T05:00:09.474Z Last Updated: 2025-04-15T15:03:53.661Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: jquery-validation Problem Types: CWE-79 Description: Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-JQUERYVALIDATION-5952285 - https://github.com/j
SA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-JQUERYVALIDATION-5952285 - https://github.com/jquery-validation/jquery-validation/pull/2462 - https://github.com/jquery-validation/jquery-validation/commit/7a490d8f39bd988027568ddcf51755e1f4688902
CVE ID: CVE-2025-3574 State: PUBLISHED Published: 2025-04-15T08:47:46.168Z Last Updated: 2025-04-15T13:11:09.222Z Vendors: T-INNOVA Products: Deporsite Problem Types: CWE-639 Description: Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-deporsite-t-innova
CVE ID: CVE-2025-3575 State: PUBLISHED Published: 2025-04-15T08:54:18.456Z Last Updated: 2025-04-15T14:57:41.566Z Vendors: T-INNOVA Products: Deporsite Problem Types: CWE-639 Description: Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-deporsite-t-innova
CVE ID: CVE-2025-3576 State: PUBLISHED Published: 2025-04-15T05:55:26.732Z Last Updated: 2025-11-13T11:42:36.679Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telec
tions Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Discovery 2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-328 Description: A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages u
roblem Types: CWE-328 Description: A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:11487 - https://access.redhat.com/errata/RHSA-2025:13664 - https://access.redhat.com/errata/RHSA-2025:13777 - https://access.redhat.com/errata/RHSA-2025:15000 - https://access.redhat.com/errata
.redhat.com/errata/RHSA-2025:13777 - https://access.redhat.com/errata/RHSA-2025:15000 - https://access.redhat.com/errata/RHSA-2025:15001 - https://access.redhat.com/errata/RHSA-2025:15002 - https://access.redhat.com/errata/RHSA-2025:15003 - https://access.redhat.com/errata/RHSA-2025:15004 - https://access.redhat.com/errata/RHSA-2025:8411 - https://access.redhat.com/errata/RHSA-2025:9418 - https://access.redhat.com/errata/RHSA-2025:9430 - https://access.redhat.com/security/cve/CVE-2025-3576 - https://bugzilla.redhat.com/show_bug.cgi?id=2359465 - https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
CVE ID: CVE-2025-3577 State: PUBLISHED Published: 2025-04-22T02:18:58.222Z Last Updated: 2025-04-22T13:28:29.341Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Zyxel Products: AMG1302-T10B firmware Problem Types: CWE-22 Description: **UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00(AAJC.16)C0 could allow an authenticated attacker with administrator privileges to access restricted directories by sending a crafted HTTP request to an affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/service-provider/global/en/securit
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/service-provider/global/en/security-advisories/end-of-life - https://github.com/Jiangxiazhe/IOT_Vulnerability/blob/main/README.md
CVE ID: CVE-2025-3578 State: PUBLISHED Published: 2025-04-15T08:42:55.349Z Last Updated: 2025-04-15T13:57:26.062Z Vendors: AiDex Products: AiDex Problem Types: CWE-1039 Description: A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in the application, list credentials of users in production or development environments. In addition, it would be possible to cause bugs that would result in the exfiltration of sensitive information, such as details about the software or internal system paths. These actions could be carried out through the misuse of LLM Prompt (chatbot) technology, via the /api/<string-chat>/mes
These actions could be carried out through the misuse of LLM Prompt (chatbot) technology, via the /api/<string-chat>/message endpoint, by manipulating the contents of the ‘content’ parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-aidex
CVE ID: CVE-2025-3579 State: PUBLISHED Published: 2025-04-15T08:44:06.085Z Last Updated: 2025-04-15T13:55:06.599Z Vendors: AiDex Products: AiDex Problem Types: CWE-94 Description: In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system. This includes executing operating system (Unix) commands, interacting with internal services such as PHP or MySQL, and even invoking native functions of the framework used, such as Laravel or Symfony. This execution is achieved by Prompt Injection attacks through the /api/<string-chat>/message endpoint, manipulating the content of the ‘content’ parameter. Addi
ction attacks through the /api/<string-chat>/message endpoint, manipulating the content of the ‘content’ parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-aidex
CVE ID: CVE-2025-3580 State: PUBLISHED Published: 2025-05-23T13:44:45.974Z Last Updated: 2025-07-17T10:28:18.011Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H) Vendors: Grafana Products: Grafana Problem Types: CWE-284 Description: An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrato
nistrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-3580/
CVE ID: CVE-2025-3581 State: PUBLISHED Published: 2025-06-09T06:00:01.730Z Last Updated: 2025-06-10T15:13:27.616Z Vendors: Unknown Products: Newsletter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2d96f018-510d-40ab-9e73-76fa4
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2d96f018-510d-40ab-9e73-76fa44784813/
CVE ID: CVE-2025-3582 State: PUBLISHED Published: 2025-06-09T06:00:13.973Z Last Updated: 2025-06-10T15:14:20.966Z Vendors: Unknown Products: Newsletter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19db8521-8dff-48c5-b21a-1001895292e0/
CVE ID: CVE-2025-3583 State: PUBLISHED Published: 2025-05-05T06:00:03.098Z Last Updated: 2025-05-05T14:27:58.842Z Vendors: Unknown Products: Newsletter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6582e14-e21e-48e7-9b4c-0044fb199825/
CVE ID: CVE-2025-3584 State: PUBLISHED Published: 2025-06-03T06:00:16.525Z Last Updated: 2025-06-03T15:32:46.821Z Vendors: Unknown Products: Newsletter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/76937bdd-7ffa-4b5e-ade1-60da095a03a3/
CVE ID: CVE-2025-3585 State: PUBLISHED Published: 2025-04-14T18:00:09.378Z Last Updated: 2025-04-14T18:48:16.223Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: westboy Products: CicadasCMS Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304641 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304641 - https://vuldb.com/?ctiid.304641 - https://vuldb.com/?submit.549981 - https://github.com/Bae-ke/cve/issues/1
CVE ID: CVE-2025-3586 State: PUBLISHED Published: 2025-09-01T18:07:56.434Z Last Updated: 2025-09-03T03:55:32.181Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-863 Description: In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. In contrast, in L
strator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586
CVE ID: CVE-2025-3587 State: PUBLISHED Published: 2025-04-14T20:00:08.666Z Last Updated: 2025-04-14T20:52:27.973Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ZeroWdd, code-projects Products: studentmanager Problem Types: CWE-285, CWE-266 Description: A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304642 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304642 - https://vuldb.com/?ctiid.304642 - https://vuldb.com/?submit.550129 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/ZeroWdd-studentmanager-authority.md
CVE ID: CVE-2025-3588 State: PUBLISHED Published: 2025-04-14T20:31:04.933Z Last Updated: 2025-04-14T20:51:21.686Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: joelittlejohn Products: jsonschema2pojo Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as problematic, has been found in joelittlejohn jsonschema2pojo 1.2.2. This issue affects the function apply of the file org/jsonschema2pojo/rules/SchemaRule.java of the component JSON File Handler. The manipulation leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted earl