Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and above, to delete feeds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b09f97df-ee69-43aa-97b5-efc8ba16ef87?source=cve - https://wordpress.org/plugins/wp-filter-combine-rss-feeds/
CVE ID: CVE-2025-7829 State: PUBLISHED Published: 2025-07-19T13:14:05.666Z Last Updated: 2025-07-21T15:50:52.954Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316933 - https://vuldb.com/?ctiid.316933 - https://vuldb.com/?submit.616884 - https://github.com/n0name-yang/myCVE/issues/5 - https://code-projects.org/
CVE ID: CVE-2025-7830 State: PUBLISHED Published: 2025-07-19T14:32:05.487Z Last Updated: 2025-07-21T15:51:55.887Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /reg.php. The manipulation of the argument mobile leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA
n disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316934 - https://vuldb.com/?ctiid.316934 - https://vuldb.com/?submit.616886 - https://github.com/n0name-yang/myCVE/issues/6 - https://code-projects.org/
CVE ID: CVE-2025-7831 State: PUBLISHED Published: 2025-07-19T15:02:05.277Z Last Updated: 2025-07-21T15:52:36.599Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Church Donation System 1.0. This affects an unknown part of the file /members/Tithes.php. The manipulation of the argument trcode leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316935 - https://vuldb.com/?ctiid.316935 - https://vuldb.com/?submit.616917 - https://github.com/n0name-yang/myCVE/issues/7 - https://code-projects.org/
CVE ID: CVE-2025-7832 State: PUBLISHED Published: 2025-07-19T15:14:05.661Z Last Updated: 2025-07-21T15:53:36.929Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Church Donation System 1.0. This vulnerability affects unknown code of the file /members/offering.php. The manipulation of the argument trcode leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
osed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316936 - https://vuldb.com/?ctiid.316936 - https://vuldb.com/?submit.616918 - https://github.com/n0name-yang/myCVE/issues/8 - https://code-projects.org/
CVE ID: CVE-2025-7833 State: PUBLISHED Published: 2025-07-19T15:44:05.546Z Last Updated: 2025-07-21T15:54:22.394Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Church Donation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Church Donation System 1.0. This issue affects some unknown processing of the file /members/giving.php. The manipulation of the argument Amount leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316937 - https://vuldb.com/?ctiid.316937 - https://vuldb.com/?submit.616919 - https://github.com/n0name-yang/myCVE/issues/9 - https://code-projects.org/
CVE ID: CVE-2025-7834 State: PUBLISHED Published: 2025-07-19T16:02:07.384Z Last Updated: 2025-07-21T15:55:25.095Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Complaint Management System Problem Types: CWE-352, CWE-862 Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316938 - https://vuldb
y be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316938 - https://vuldb.com/?ctiid.316938 - https://vuldb.com/?submit.616888 - https://github.com/N1n3b9S/cve/issues/8 - https://phpgurukul.com/
CVE ID: CVE-2025-7835 State: PUBLISHED Published: 2025-07-24T09:22:21.998Z Last Updated: 2025-07-24T13:10:14.653Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: gerkin Products: iThoughts Advanced Code Editor Problem Types: CWE-352 Description: The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due to missing or incorrect nonce validation on the 'ithoughts_ace_update_options' AJAX action. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action
rs to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e99ed03f-ed0a-4f17-b9fe-db0a0e573ed2?source=cve - https://wordpress.org/plugins/ithoughts-advanced-code-editor/
CVE ID: CVE-2025-7836 State: PUBLISHED Published: 2025-07-19T16:44:06.551Z Last Updated: 2025-07-21T15:57:08.788Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-816L Problem Types: CWE-77, CWE-74 Description: A vulnerability has been found in D-Link DIR-816L up to 2.06B01 and classified as critical. Affected by this vulnerability is the function lxmldbc_system of the file /htdocs/cgibin of the component Environment Variable Handler. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer suppor
oit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316939 - https://vuldb.com/?ctiid.316939 - https://vuldb.com/?submit.617359 - https://github.com/bananashipsBBQ/CVE/blob/main/D-Link%20DIR-816L%20Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi.md - https://www.dlink.com/
CVE ID: CVE-2025-7837 State: PUBLISHED Published: 2025-07-19T17:02:08.694Z Last Updated: 2025-07-21T15:58:11.629Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: TOTOLINK Products: T6 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of the argument dest leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316940 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316940 - https://vuldb.com/?ctiid.316940 - https://vuldb.com/?submit.617572 - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/4.md - https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/4.md#poc - https://www.totolink.net/
CVE ID: CVE-2025-7838 State: PUBLISHED Published: 2025-07-19T17:14:06.080Z Last Updated: 2025-07-21T15:12:40.653Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Movie Theater Seat Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Online Movie Theater Seat Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/manage_seat.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
iated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316102 - https://vuldb.com/?ctiid.316102 - https://vuldb.com/?submit.609491 - https://github.com/N1n3b9S/cve/issues/6 - https://www.campcodes.com/
CVE ID: CVE-2025-7839 State: PUBLISHED Published: 2025-08-23T04:25:47.781Z Last Updated: 2025-08-25T17:10:19.829Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pokornydavid Products: Restore Permanently delete Post or Page Data Problem Types: CWE-352 Description: The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rp_dpo_dpa_ajax_dp_delete_data() function. This makes it possible for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into pe
le for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ff9d034-3c6e-4f8f-a53e-86ad85cc10e6?source=cve - https://plugins.trac.wordpress.org/browser/restore-permanently-delete-post-or-page-data/trunk/delete-store-file.php#L305
CVE ID: CVE-2025-7840 State: PUBLISHED Published: 2025-07-19T18:02:06.718Z Last Updated: 2025-07-21T15:15:47.973Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Movie Theater Seat Reservation System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Campcodes Online Movie Theater Seat Reservation System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=reserve of the component Reserve Your Seat Page. The manipulation of the argument Firstname/Lastname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to th
name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316941 - https://vuldb.com/?ctiid.316941 - https://vuldb.com/?submit.617678 - https://github.com/N1n3b9S/cve/issues/9 - https://www.campcodes.com/
CVE ID: CVE-2025-7841 State: PUBLISHED Published: 2025-08-23T04:25:48.897Z Last Updated: 2025-08-25T16:15:52.156Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sertifier Products: Sertifier Certificate & Badge Maker for WordPress – Tutor LMS Problem Types: CWE-352 Description: The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19. This is due to missing or incorrect nonce validation on the 'sertifier_settings' page. This makes it possible for unauthenticated attackers to update the plugin's api key via a forged request granted they can tr
makes it possible for unauthenticated attackers to update the plugin's api key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0050d44-bfa1-4dcb-947b-0df1b5e826d3?source=cve - https://wordpress.org/plugins/sertifier-certificates-open-badges/
CVE ID: CVE-2025-7842 State: PUBLISHED Published: 2025-08-23T04:25:47.397Z Last Updated: 2025-08-25T17:15:08.114Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: silence Products: Silencesoft RSS Reader Problem Types: CWE-352 Description: The Silencesoft RSS Reader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.6. This is due to missing or incorrect nonce validation on the 'sil_rss_edit_page' page. This makes it possible for unauthenticated attackers to delete RSS feeds via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Ana
request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e688654-8e21-48e8-a497-06812f3be9fb?source=cve - https://wordpress.org/plugins/external-rss-reader/
CVE ID: CVE-2025-7843 State: PUBLISHED Published: 2025-09-10T06:38:48.743Z Last Updated: 2025-09-10T20:30:12.979Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fernandiez Products: Auto Save Remote Images (Drafts) Problem Types: CWE-918 Description: The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetch_images() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from interna
to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93818487-739e-48ed-ac67-02469277c22d?source=cve - https://wordpress.org/plugins/auto-save-remote-images-drafts/
CVE ID: CVE-2025-7844 State: PUBLISHED Published: 2025-08-04T21:35:04.013Z Last Updated: 2025-08-05T13:36:36.065Z Vendors: wolfSSL Inc. Products: wolfTPM Problem Types: CWE-121 Description: Exporting a TPM based RSA key larger than 2048 bits from the TPM could overrun a stack buffer if the default `MAX_RSA_KEY_BITS=2048` is used. If your TPM 2.0 module supports RSA key sizes larger than 2048 bit and your applications supports creating or importing an RSA private or public key larger than 2048 bits and your application calls `wolfTPM2_RsaKey_TpmToWolf` on that key, then a stack buffer could be overrun. If the `MAX_RSA_KEY_BITS` build-time macro is set correctly (RSA bits match what TPM hardwa
ack buffer could be overrun. If the `MAX_RSA_KEY_BITS` build-time macro is set correctly (RSA bits match what TPM hardware is capable of) for the hardware target, then a stack overrun is not possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfTPM/pull/427
CVE ID: CVE-2025-7845 State: PUBLISHED Published: 2025-08-01T04:24:30.095Z Last Updated: 2025-08-01T14:20:19.521Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jetmonsters Products: Stratum – Elementor Widgets Problem Types: CWE-79 Description: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d9f6ba-1c41-4933-8eb2-8f27b9e87574?source=cve - https://wordpress.org/plugins/stratum/#developers - https://plugins.trac.wordpress.org/browser/stratum/tags/1.6.0/includes/templates/image-hotspot.php - https://plugins.trac.wordpress.org/changeset/3335410
CVE ID: CVE-2025-7846 State: PUBLISHED Published: 2025-10-31T06:42:56.125Z Last Updated: 2025-10-31T14:26:13.340Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vanquish Products: WordPress User Extra Fields Problem Types: CWE-36 Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (suc
delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c66d0fb4-e2df-4bdb-8ccb-18a96173a55d?source=cve - https://codecanyon.net/item/user-extra-fields/12949844
CVE ID: CVE-2025-7847 State: PUBLISHED Published: 2025-07-31T04:26:20.021Z Last Updated: 2025-07-31T13:25:15.938Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: tigroumeow Products: AI Engine Problem Types: CWE-434 Description: The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload() function in versions 2.9.3 and 2.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server when the REST API is enabled, which may make remote code execution possible. Additional Analyst Notes: - CISA A
s server when the REST API is enabled, which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c1c7ec9-d01f-433d-abec-dc2b6ff684c7?source=cve - https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/api.php#L673 - https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.9.3/classes/modules/files.php#L332 - https://plugins.trac.wordpress.org/changeset/3329842/ai-engine/trunk/classes/api.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332539%40ai-engine&new=3332539%40ai-engine&sfp_email=&sfph_mail=
CVE ID: CVE-2025-7848 State: PUBLISHED Published: 2025-07-29T21:24:32.568Z Last Updated: 2025-08-02T03:55:47.625Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: A memory corruption vulnerability due to improper input validation in lvpict.cpp exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-
: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-labview.html
CVE ID: CVE-2025-7849 State: PUBLISHED Published: 2025-07-29T21:27:20.080Z Last Updated: 2025-08-02T03:55:48.802Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-1285 Description: A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security
yst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-labview.html
CVE ID: CVE-2025-7850 State: PUBLISHED Published: 2025-10-21T00:28:11.589Z Last Updated: 2025-10-24T16:59:25.310Z Vendors: TP-Link Systems Inc. Products: Omada gateways, Festa gateways, Omada Pro gateways Problem Types: CWE-78 Description: A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.omadanetworks.com/en/document/108456/ - https://www.omadanetworks.com/us/business-networking/all-omada-router/ - https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-g
.com/us/business-networking/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-gateway/ - https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/
CVE ID: CVE-2025-7851 State: PUBLISHED Published: 2025-10-21T00:29:05.809Z Last Updated: 2025-10-24T17:00:06.753Z Vendors: TP-Link Systems Inc. Products: Omada gateways, Festa gateways, Omada Pro gateways Description: An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.omadanetworks.com/en/document/108456/ - https://www.omadanetworks.com/us/business-networking/all-omada-router/ - https://www.omadanetworks.com/us/business-networking/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-gateway/ - https://www.fores
/omada-pro-router-wired-router/ - https://www.tp-link.com/us/business-networking/soho-festa-gateway/ - https://www.forescout.com/blog/new-tp-link-router-vulnerabilities-a-primer-on-rooting-routers/