Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-56746 State: PUBLISHED Published: 2025-10-15T00:00:00.000Z Last Updated: 2025-10-15T15:36:11.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://suryadina.com/academy-lms-session-fixation-1t8v5n3q6h/
CVE ID: CVE-2025-56747 State: PUBLISHED Published: 2025-10-14T00:00:00.000Z Last Updated: 2025-10-14T15:57:08.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://suryadina.com/academy-lms-instructor-escalation-3n7b9f2w5k
CVE ID: CVE-2025-56748 State: PUBLISHED Published: 2025-10-15T00:00:00.000Z Last Updated: 2025-10-15T17:51:37.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encoded templates without rate limiting, allowing brute force attacks to guess valid reset tokens and compromise user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://suryadina.com/academy-lms-reset-bruteforce-5q8w2e7t9y/
CVE ID: CVE-2025-56749 State: PUBLISHED Published: 2025-10-15T00:00:00.000Z Last Updated: 2025-10-15T17:37:38.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://suryadina.com/academy-lms-jwt-secret-7k9m2x4p8q/
CVE ID: CVE-2025-56752 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-03T17:48:21.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter administrative settings and potentially seize control of affected devices via crafted HTTP POST request to /user.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TNCX-byte/Vulnerability_Research/blob/main/CVE-2025-56752/README.md
CVE ID: CVE-2025-56760 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-04T14:28:46.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48 - https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/
CVE ID: CVE-2025-56761 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-04T14:27:45.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48 - https://github.com/usememos/memos/blob/v0.2
m/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48 - https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147 - https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/
CVE ID: CVE-2025-56762 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T20:16:03.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/paracrawl/keops - https://github.com/Shaunak-Chatterjee/CVE-2025-56762
CVE ID: CVE-2025-56764 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-11-11T18:36:27.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user" vs. "Wrong password"), allowing an attacker to enumerate valid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Remenis/CVE-2025-56764-trivision-nc227wf - https://github.com/Remenis/CVE-2025-56764
CVE ID: CVE-2025-56769 State: PUBLISHED Published: 2025-09-25T00:00:00.000Z Last Updated: 2025-09-26T20:29:53.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/chinabugotech/hutool/issues/3994
CVE ID: CVE-2025-56795 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-10-01T17:31:42.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mealie-recipes/mealie/issues/5677 - https://github.com/mealie-recipes/mealie/pull/5754 - https://github.com/B1tBreaker/CVE-2025-56795
CVE ID: CVE-2025-56799 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T13:14:10.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/reolink-command-injection - https://github.com/shinyColumn/CVE-2025-56799
CVE ID: CVE-2025-56800 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T13:17:28.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user mod
entication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/reolink-auth-bypass - https://github.com/shinyColumn/CVE-2025-56800
CVE ID: CVE-2025-56801 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T13:20:55.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/reolink-aes-iv - https://github.
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/reolink-aes-iv - https://github.com/shinyColumn/CVE-2025-56801
CVE ID: CVE-2025-56802 State: PUBLISHED Published: 2025-10-21T00:00:00.000Z Last Updated: 2025-10-22T13:22:33.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/reolink-aes-key - https://
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/reolink-aes-key - https://github.com/shinyColumn/CVE-2025-56802
CVE ID: CVE-2025-56803 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-09-08T18:25:25.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to child_process.exec without validation, leading to possible RCE. NOTE: this is disputed by the Supplier because the behavior only allows a local user to attack himself via a local plugin. The local build procedure, which is essential to the attack, is not executed for plugins sha
himself via a local plugin. The local build procedure, which is essential to the attack, is not executed for plugins shared to the Figma Community. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinycolumn.notion.site/figma-command-injection - https://github.com/shinyColumn/CVE-2025-56803
CVE ID: CVE-2025-56807 State: PUBLISHED Published: 2025-09-29T00:00:00.000Z Last Updated: 2025-09-29T19:48:22.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://fairsketch.com - https://github.com/aqwainfosec/CVE-2025-56807/
CVE ID: CVE-2025-56815 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-24T17:23:05.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/running-elephant/datart/tags - https://github.com/xiaoxiaoranxxx/CVE-2025-56815
CVE ID: CVE-2025-56816 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-24T17:18:26.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load() or loadAs() method without input sanitization. This allows deserialization of attacker-controlled YAML content, leading to arbitrary class instantiation. Under certain conditions, this can be exploited to achieve remote code execution (RCE). Additional Analyst Notes
iation. Under certain conditions, this can be exploited to achieve remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/running-elephant/datart - https://github.com/xiaoxiaoranxxx/CVE-2025-56815
CVE ID: CVE-2025-56819 State: PUBLISHED Published: 2025-09-24T00:00:00.000Z Last Updated: 2025-09-24T19:11:48.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://h2database.com/html/features.html#runscript - https://github.com/h2database/h2database - https://github.com/xyyzxc/CVE-2025-56819
CVE ID: CVE-2025-56869 State: PUBLISHED Published: 2025-09-19T00:00:00.000Z Last Updated: 2025-09-19T17:57:08.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in backend/src/applications/files/services/files-manager.service.ts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sync-in.com/ - https://github.com/Sync-in/server - https://github.com/Sync-in/server/releases/tag/v1
ferences: - https://sync-in.com/ - https://github.com/Sync-in/server - https://github.com/Sync-in/server/releases/tag/v1.2.0
CVE ID: CVE-2025-57052 State: PUBLISHED Published: 2025-09-03T00:00:00.000Z Last Updated: 2025-11-03T18:13:42.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
CVE ID: CVE-2025-57055 State: PUBLISHED Published: 2025-09-17T00:00:00.000Z Last Updated: 2025-09-17T17:23:49.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter. The server fetches the provided URL using curl_exec() without sufficient validation, allowing the attacker to force internal or external HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thawphone/CVE-2025-57055
CVE ID: CVE-2025-57057 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:46:04.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/ipMacBindListStore.md
CVE ID: CVE-2025-57058 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:57.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formSetDebugCfg function via the pEnable, pLevel, and pModule parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formSetDebugCfg.md
CVE ID: CVE-2025-57059 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:51.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter in the addDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/addDhcpRule.md
CVE ID: CVE-2025-57060 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T15:52:52.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the rules parameter in the dns_forward_rule_store function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/dns_forward_rule_store.md
CVE ID: CVE-2025-57061 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:45.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the formIPMacBindModify function via the ruleId, ip, mac, v6 and remark parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formIPMacBindModify.md
CVE ID: CVE-2025-57062 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-11T19:13:07.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex parameter in the formDelDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formDelDhcpRule.md
CVE ID: CVE-2025-57063 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:12.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex parameter in the formDelPortMapping function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formDelPortMapping.md
CVE ID: CVE-2025-57064 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:40.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex parameter in the modifyDhcpRule function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/modifyDhcpRule.md
CVE ID: CVE-2025-57069 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:45:06.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter in the getsinglepppuser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/getsinglepppuser.md
CVE ID: CVE-2025-57070 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:44:47.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in the guestWifiRuleRefresh function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/guestWifiRuleRefresh.md
CVE ID: CVE-2025-57071 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:44:58.875Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter in the formAddVpnUsers function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formAddVpnUsers.md
CVE ID: CVE-2025-57072 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:44:52.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway parameter in the formSetStaticRoute function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formSetStaticRoute.md
CVE ID: CVE-2025-57078 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T13:44:35.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pppoeServerWhiteMacIndex parameter in the formModifyPppAuthWhiteMac function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/G3/formModifyPppAuthWhiteMac.md
CVE ID: CVE-2025-57085 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-11T18:29:39.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/W30E/UploadCfg.md
CVE ID: CVE-2025-57086 State: PUBLISHED Published: 2025-09-09T00:00:00.000Z Last Updated: 2025-09-10T15:51:10.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter in the formDeleteMeshNode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vulnDetailRecord/VulforDevice/blob/main/Tenda/W30E/formDeleteMeshNode.md