Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9821 State: PUBLISHED Published: 2025-09-03T09:39:01.005Z Last Updated: 2025-09-03T14:12:35.814Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Mautic Products: Mautic Problem Types: CWE-918 Description: SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact. Resources https://cheatsheetseries.
rg/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69
CVE ID: CVE-2025-9822 State: PUBLISHED Published: 2025-09-03T13:55:12.870Z Last Updated: 2025-09-03T14:09:46.199Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Mautic Products: Mautic Problem Types: CWE-283 Description: SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w
CVE ID: CVE-2025-9823 State: PUBLISHED Published: 2025-09-03T14:33:26.111Z Last Updated: 2025-09-03T17:33:19.941Z Vendors: Mautic Products: Mautic Problem Types: CWE-79 Description: SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application. DetailsThe vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the se
ailsThe vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session. ImpactA Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, manipulate the web page content, and essentially take control of a user's session within an application by executing malicious JavaScript code within the victim's browser, even if the server-side co
ion within an application by executing malicious JavaScript code within the victim's browser, even if the server-side code is secure; essentially enabling them to perform actions as if they were the logged-in user. References * Web Security Academy: Cross-site scripting https://portswigger.net/web-security/cross-site-scripting * Web Security Academy: Reflected cross-site scripting https://portswigger.net/web-security/cross-site-scripting/reflected Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-9v8p-m85m-f7mm
CVE ID: CVE-2025-9824 State: PUBLISHED Published: 2025-09-03T14:25:06.796Z Last Updated: 2025-09-03T14:46:19.282Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Mautic Products: Mautic Problem Types: CWE-204 Description: ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures consistent response times regardless of whether a user exists or not. Technical DetailsThe vulnerability was caused by differe
tent response times regardless of whether a user exists or not. Technical DetailsThe vulnerability was caused by different response times when: * A valid username was provided (password hashing occurred) * An invalid username was provided (no password hashing occurred) The fix introduces a TimingSafeFormLoginAuthenticator that performs a dummy password hash verification even for non-existent users, ensuring consistent timing. WorkaroundsNo workarounds are available. Users should upgrade to the patched version. References * https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Gu
guide/latest/4-Web_Application_Security_Testing/03-Identity_Management_Testing/04-Testing_for_Account_Enumeration_and_Guessable_User_Account Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mautic/mautic/security/advisories/GHSA-3ggv-qwcp-j6xg
CVE ID: CVE-2025-9825 State: PUBLISHED Published: 2025-11-21T05:33:31.558Z Last Updated: 2025-11-24T18:09:10.207Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/ - https://gitlab.com/gi
References: - https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/567301 - https://hackerone.com/reports/3319800
CVE ID: CVE-2025-9826 State: PUBLISHED Published: 2025-09-15T10:15:15.855Z Last Updated: 2025-10-01T13:54:03.646Z Vendors: M-Files Corporation Products: Hubshare Problem Types: CWE-79 Description: Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://product.m-files.com/security-advisories/cve-2025-9826/
CVE ID: CVE-2025-9828 State: PUBLISHED Published: 2025-09-02T17:02:08.742Z Last Updated: 2025-09-02T20:35:45.362Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: Tenda Products: CP6 Problem Types: CWE-327, CWE-310 Description: A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vu
ribed as difficult. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322175 - https://vuldb.com/?ctiid.322175 - https://vuldb.com/?submit.641566 - https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/CP6.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-9829 State: PUBLISHED Published: 2025-09-02T18:32:07.340Z Last Updated: 2025-09-02T18:58:43.946Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The manipulation of the argument mobilenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnric
ly available and might be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322176 - https://vuldb.com/?ctiid.322176 - https://vuldb.com/?submit.641587 - https://vuldb.com/?submit.641592 - https://vuldb.com/?submit.641595 - https://github.com/dad-zm/myCVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-9830 State: PUBLISHED Published: 2025-09-02T20:02:07.601Z Last Updated: 2025-09-03T15:31:58.420Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids[] results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322177 - https://vuldb.com/?ctiid.322177 - https://vuldb.com/?submit.642387 - https://github.com/xiaoxinkaishi/cve/issues/1 - https://phpgurukul.com/
CVE ID: CVE-2025-9831 State: PUBLISHED Published: 2025-09-02T20:32:07.384Z Last Updated: 2025-09-02T20:49:21.498Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322178 - https://vuldb.com/?ctiid.322178 - https://vuldb.com/?submit.642472 - https://github.com/xiaoxinkaishi/cve/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-9832 State: PUBLISHED Published: 2025-09-02T20:32:10.413Z Last Updated: 2025-09-02T20:44:53.785Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register-router.php. Such manipulation of the argument phone leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
t has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322179 - https://vuldb.com/?ctiid.322179 - https://vuldb.com/?submit.641739 - https://github.com/lrjbsyh/CVE_Hunter/issues/11 - https://github.com/lrjbsyh/CVE_Hunter/issues/11#issue-3354473207 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9833 State: PUBLISHED Published: 2025-09-02T21:02:08.083Z Last Updated: 2025-09-03T15:53:51.427Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Farm Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/login.php. Performing manipulation of the argument uname results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322180 - https://vuldb.com/?ctiid.322180 - https://vuldb.com/?submit.641720 - https://github.com/ganzhi-qcy/cve/issues/17 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9834 State: PUBLISHED Published: 2025-09-02T21:02:11.231Z Last Updated: 2025-09-03T15:53:37.424Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Small CRM Problem Types: CWE-79, CWE-94 Description: A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Executing manipulation of the argument Username can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322181 - https://vuldb.com/?ctiid.322
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322181 - https://vuldb.com/?ctiid.322181 - https://vuldb.com/?submit.642025 - https://github.com/YoSheep/cve/blob/main/PHPGurukul%20Small%20CRM%20in%20PHP%20V4.0%20Multiple%20Stored%20Cross-Site%20Scripting%20(XSS)%20Vulnerabilities.md - https://phpgurukul.com/
CVE ID: CVE-2025-9835 State: PUBLISHED Published: 2025-09-02T21:32:06.106Z Last Updated: 2025-09-03T15:53:22.953Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: macrozheng Products: mall Problem Types: CWE-639, CWE-285 Description: A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322182 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322182 - https://vuldb.com/?ctiid.322182 - https://vuldb.com/?submit.641729 - https://github.com/ez-lbz/poc/issues/46 - https://github.com/ez-lbz/poc/issues/46#issue-3354477952
CVE ID: CVE-2025-9836 State: PUBLISHED Published: 2025-09-02T22:02:07.021Z Last Updated: 2025-09-03T20:04:41.250Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: macrozheng Products: mall Problem Types: CWE-639, CWE-285 Description: A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322183 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322183 - https://vuldb.com/?ctiid.322183 - https://vuldb.com/?submit.641738 - https://github.com/ez-lbz/poc/issues/47 - https://github.com/ez-lbz/poc/issues/47#issue-3354493935
CVE ID: CVE-2025-9837 State: PUBLISHED Published: 2025-09-02T22:02:09.792Z Last Updated: 2025-09-03T20:05:52.027Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the file /admin/modules/student/index.php. This manipulation of the argument studentId causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322184 - https://vuldb.com/?ctiid.322184 - https://vuldb.com/?submit.641750 - https://github.com/hjsjbsg/record-for-own/issues/4 - https://itsourcecode.com/
CVE ID: CVE-2025-9838 State: PUBLISHED Published: 2025-09-02T22:32:07.018Z Last Updated: 2025-09-03T19:10:34.504Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?
blicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322185 - https://vuldb.com/?ctiid.322185 - https://vuldb.com/?submit.645382 - https://github.com/mybonn/CVE/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2025-9839 State: PUBLISHED Published: 2025-09-02T22:32:09.884Z Last Updated: 2025-09-03T19:05:06.881Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information Management System Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/modules/course/index.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP
ack is possible. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322186 - https://vuldb.com/?ctiid.322186 - https://vuldb.com/?submit.645384 - https://github.com/mybonn/CVE/issues/3 - https://itsourcecode.com/
CVE ID: CVE-2025-9840 State: PUBLISHED Published: 2025-09-02T23:02:07.612Z Last Updated: 2025-09-03T19:01:39.856Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Sports Management System Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/gametype.php. Executing manipulation of the argument code can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
e to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322187 - https://vuldb.com/?ctiid.322187 - https://vuldb.com/?submit.641754 - https://github.com/hjsjbsg/record-for-own/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2025-9841 State: PUBLISHED Published: 2025-09-02T23:32:06.541Z Last Updated: 2025-09-03T18:51:27.843Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Mobile Shop Management System Problem Types: CWE-434, CWE-284 Description: A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
e exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322188 - https://vuldb.com/?ctiid.322188 - https://vuldb.com/?submit.641779 - https://github.com/chen2496088236/CVE/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-9842 State: PUBLISHED Published: 2025-09-03T00:02:06.233Z Last Updated: 2025-09-03T20:26:27.927Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Das Products: Parking Management System 停车场管理系统 Problem Types: CWE-200, CWE-284 Description: A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation results in information disclosure. The attack may be performed from remote. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322189 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322189 - https://vuldb.com/?ctiid.322189 - https://vuldb.com/?submit.641783 - https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/dasiot.md
CVE ID: CVE-2025-9843 State: PUBLISHED Published: 2025-09-03T00:32:06.671Z Last Updated: 2025-09-03T15:44:56.460Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Das Products: Parking Management System 停车场管理系统 Problem Types: CWE-200, CWE-284 Description: A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes information disclosure. It is possible to initiate the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322190 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322190 - https://vuldb.com/?ctiid.322190 - https://vuldb.com/?submit.644854 - https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/Parking.md
CVE ID: CVE-2025-9844 State: PUBLISHED Published: 2025-09-23T13:11:31.566Z Last Updated: 2025-09-24T03:55:13.851Z Vendors: Salesforce Products: Salesforce CLI Problem Types: CWE-427 Description: Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.salesforce.com/s/articleView?id=005224301&type=1
CVE ID: CVE-2025-9845 State: PUBLISHED Published: 2025-09-03T00:32:09.581Z Last Updated: 2025-09-03T15:44:50.905Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Fruit Shop Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. Such manipulation of the argument product_code/gen_name/product_name/supplier leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322191 - https://vuldb.com/?ctiid.322191 - https://vuldb.com/?submit.641940 - https://github.com/chen2496088236/CVE/issues/3 - https://code-projects.org/