Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
icly and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.329874 - https://vuldb.com/?ctiid.329874 - https://vuldb.com/?submit.673224 - https://shimo.im/docs/loqeMWMyZGtpEYqn/ - https://www.openwall.com/lists/oss-security/2025/11/02/3
CVE ID: CVE-2025-12205 State: PUBLISHED Published: 2025-10-27T02:32:07.777Z Last Updated: 2025-11-04T21:09:26.652Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Kamailio Problem Types: CWE-416, CWE-119 Description: A vulnerability was detected in Kamailio 5.5. The affected element is the function sr_push_yy_state of the file src/core/cfg.lex of the component Configuration File Handler. The manipulation results in use after free. The attack must be initiated from a local position. The exploit is now public and may be used. The real existence of this vulnerability is still doubted at the moment. This attack requires manipulating c
ay be used. The real existence of this vulnerability is still doubted at the moment. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329875 - https://vuldb.com/?ctiid.329875 - https://vuldb.com/?submit.673225 - https://shimo.im/docs/ZzkLMVMLOzIRlpAQ/ - https://www.openwall.com/lists/oss-security/2025/11/02/3
CVE ID: CVE-2025-12206 State: PUBLISHED Published: 2025-10-27T02:32:12.753Z Last Updated: 2025-11-04T21:09:29.239Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Kamailio Problem Types: CWE-476, CWE-404 Description: A flaw has been found in Kamailio 5.5. The impacted element is the function rve_is_constant of the file src/core/rvalue.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been published and may be used. It is still unclear if this vulnerability genuinely exists. This attack requires manipulating config files which might not be a realistic scenario in many cases.
genuinely exists. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329876 - https://vuldb.com/?ctiid.329876 - https://vuldb.com/?submit.673240 - https://shimo.im/docs/aBAYMVMB2jUP9jAj/ - https://www.openwall.com/lists/oss-security/2025/11/02/3
CVE ID: CVE-2025-12207 State: PUBLISHED Published: 2025-10-27T02:32:17.604Z Last Updated: 2025-11-04T21:09:31.867Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R) Vendors: n/a Products: Kamailio Problem Types: CWE-476, CWE-404 Description: A vulnerability has been found in Kamailio 5.5. This affects the function yyerror_at of the file src/core/cfg.y of the component Grammar Rule Handler. Such manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The actual existence of this vulnerability is currently in question. This attack requires manipulating config files
ed. The actual existence of this vulnerability is currently in question. This attack requires manipulating config files which might not be a realistic scenario in many cases. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329877 - https://vuldb.com/?ctiid.329877 - https://vuldb.com/?submit.673241 - https://shimo.im/docs/vVqRMVMlrycMO63y/ - https://www.openwall.com/lists/oss-security/2025/11/02/3
CVE ID: CVE-2025-12208 State: PUBLISHED Published: 2025-10-27T03:02:06.554Z Last Updated: 2025-10-28T13:50:50.036Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
oit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329878 - https://vuldb.com/?ctiid.329878 - https://vuldb.com/?submit.673226 - https://github.com/K1nakoo/cve/blob/main/58/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-12209 State: PUBLISHED Published: 2025-10-27T03:02:10.129Z Last Updated: 2025-10-28T13:48:15.487Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: O3 Problem Types: CWE-121, CWE-119 Description: A vulnerability was determined in Tenda O3 1.0.0.10(2478). Affected is the function SetValue/GetValue of the file /goform/setDhcpConfig. Executing manipulation of the argument dhcpEn can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329879 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329879 - https://vuldb.com/?ctiid.329879 - https://vuldb.com/?submit.673263 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDhcpConfig.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12210 State: PUBLISHED Published: 2025-10-27T03:02:13.722Z Last Updated: 2025-10-28T13:27:32.757Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: O3 Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329880 - https://vuldb
t be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329880 - https://vuldb.com/?ctiid.329880 - https://vuldb.com/?submit.673264 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/AdvSetLanip.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12211 State: PUBLISHED Published: 2025-10-27T03:32:06.892Z Last Updated: 2025-10-28T13:22:35.992Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: O3 Problem Types: CWE-121, CWE-119 Description: A security flaw has been discovered in Tenda O3 1.0.0.10(2478). Affected by this issue is the function SetValue/GetValue of the file /goform/setDmzInfo. The manipulation of the argument dmzIP results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329881 - http
d may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329881 - https://vuldb.com/?ctiid.329881 - https://vuldb.com/?submit.673265 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setDmzInfo.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12212 State: PUBLISHED Published: 2025-10-27T03:32:10.375Z Last Updated: 2025-10-27T15:22:32.247Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: O3 Problem Types: CWE-121, CWE-119 Description: A weakness has been identified in Tenda O3 1.0.0.10(2478). This affects the function SetValue/GetValue of the file /goform/setNetworkService. This manipulation of the argument upnpEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329882 - https://vuldb.com
oited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329882 - https://vuldb.com/?ctiid.329882 - https://vuldb.com/?submit.673267 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setNetworkService.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12213 State: PUBLISHED Published: 2025-10-27T04:02:06.607Z Last Updated: 2025-10-27T15:16:14.832Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: O3 Problem Types: CWE-121, CWE-119 Description: A security vulnerability has been detected in Tenda O3 1.0.0.10(2478). This vulnerability affects the function SetValue/GetValue of the file /goform/setVlanConfig. Such manipulation of the argument lan leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329883 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329883 - https://vuldb.com/?ctiid.329883 - https://vuldb.com/?submit.673268 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/setVlanConfig.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12214 State: PUBLISHED Published: 2025-10-27T04:02:10.027Z Last Updated: 2025-10-27T20:02:25.401Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: O3 Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in Tenda O3 1.0.0.10(2478). This issue affects the function SetValue/GetValue of the file /goform/sysAutoReboot. Performing manipulation of the argument enable results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329884 - https://vuldb.com/?ctiid.329884 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329884 - https://vuldb.com/?ctiid.329884 - https://vuldb.com/?submit.673269 - https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/sysAutoReboot.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12215 State: PUBLISHED Published: 2025-10-27T04:02:12.489Z Last Updated: 2025-10-27T20:03:23.987Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Shopping System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329885 - https://vuldb.com/?ctiid.32988
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329885 - https://vuldb.com/?ctiid.329885 - https://vuldb.com/?submit.673302 - https://github.com/juzidddd/SQL-Injection-Vulnerability-in-Projectworlds-PHP-Online-Shopping-System/issues/1
CVE ID: CVE-2025-12216 State: PUBLISHED Published: 2025-10-25T15:33:18.476Z Last Updated: 2025-10-28T14:07:11.115Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-1301 Description: Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12217 State: PUBLISHED Published: 2025-10-25T15:39:52.671Z Last Updated: 2025-10-28T14:15:52.139Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-1392 Description: SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12218 State: PUBLISHED Published: 2025-10-25T15:47:36.582Z Last Updated: 2025-10-28T14:16:38.559Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-1392 Description: Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12219 State: PUBLISHED Published: 2025-10-25T15:51:58.319Z Last Updated: 2025-10-28T14:17:14.372Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-1395 Description: Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12220 State: PUBLISHED Published: 2025-10-25T15:53:03.558Z Last Updated: 2025-10-28T14:18:06.558Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-1395 Description: Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12221 State: PUBLISHED Published: 2025-10-25T15:57:45.632Z Last Updated: 2025-10-28T14:19:34.913Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-16 Description: Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12222 State: PUBLISHED Published: 2025-10-27T04:32:05.653Z Last Updated: 2025-10-27T20:04:43.065Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Bdtask Products: Flight Booking Software Problem Types: CWE-434, CWE-284 Description: A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. Affected by this issue is some unknown functionality of the file /admin/transaction/deposit of the component Deposit Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not
he exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329892 - https://vuldb.com/?ctiid.329892 - https://vuldb.com/?submit.673424 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12222.md
CVE ID: CVE-2025-12223 State: PUBLISHED Published: 2025-10-27T04:32:07.968Z Last Updated: 2025-10-27T20:05:20.283Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Bdtask Products: Flight Booking Software Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in Bdtask Flight Booking Software up to 3.1. This affects an unknown part of the file /b2c/package-information of the component Package Information Module. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329893 - https://vuldb.com/?ctiid.329893 - https://vuldb.com/?submit.673436 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12223.md
CVE ID: CVE-2025-12224 State: PUBLISHED Published: 2025-10-27T04:32:10.383Z Last Updated: 2025-10-27T20:06:17.208Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Iqbolshoh Products: php-business-website Problem Types: CWE-79, CWE-94 Description: A flaw has been found in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This vulnerability affects unknown code of the file admin/contact.php. This manipulation of the argument twitter causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specif
published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329894 - https://vuldb.com/?ctiid.329894 - https://vuldb.com/?submit.673540 - https://github.com/mhszed/Report/blob/main/php-business-website%20xss.docx
CVE ID: CVE-2025-12225 State: PUBLISHED Published: 2025-10-27T05:02:06.747Z Last Updated: 2025-10-27T20:06:53.554Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC6 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Tenda AC6 15.03.06.50. This issue affects some unknown processing of the file /goform/WifiGuestSet of the component HTTP Request Handler. Such manipulation of the argument shareSpeed leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329895 - https://vuldb.com/?ctiid.329895 - https://vuldb.com/?submit.673547 - https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/Tenda/WifiGuestSet/WifiGuestSet.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-12226 State: PUBLISHED Published: 2025-10-27T05:02:10.120Z Last Updated: 2025-10-27T20:09:00.735Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performing manipulation of the argument house_no results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
it has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329896 - https://vuldb.com/?ctiid.329896 - https://vuldb.com/?submit.673611 - https://vuldb.com/?submit.674055 - https://vuldb.com/?submit.675883 - https://github.com/zhang947/vul/blob/main/report.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-12227 State: PUBLISHED Published: 2025-10-27T05:32:05.176Z Last Updated: 2025-10-27T20:09:56.142Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Gate Pass Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329897 - https://vu
be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329897 - https://vuldb.com/?ctiid.329897 - https://vuldb.com/?submit.673704 - https://github.com/QIU-DIE/CVE/issues/8
CVE ID: CVE-2025-12228 State: PUBLISHED Published: 2025-10-27T05:32:07.551Z Last Updated: 2025-10-27T20:10:59.785Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Expense Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329898 - https://vuldb.com/?ctiid.329898 - https://vuldb.com/?submit.673705 - https://github.com/QIU-DIE/CVE/issues/9
CVE ID: CVE-2025-12229 State: PUBLISHED Published: 2025-10-27T05:32:09.853Z Last Updated: 2025-10-27T20:11:46.848Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Expense Management System Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
een released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329899 - https://vuldb.com/?ctiid.329899 - https://vuldb.com/?submit.673706 - https://github.com/QIU-DIE/CVE/issues/10
CVE ID: CVE-2025-12230 State: PUBLISHED Published: 2025-10-27T06:02:06.014Z Last Updated: 2025-10-27T15:15:26.294Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Expense Management System Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of the component Currency Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
t has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.329900 - https://vuldb.com/?ctiid.329900 - https://vuldb.com/?submit.673707 - https://github.com/QIU-DIE/CVE/issues/11