Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6451 State: PUBLISHED Published: 2025-06-22T01:31:05.166Z Last Updated: 2025-06-23T19:26:44.301Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: code-projects Products: Simple Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_pending.php. The manipulation of the argument transaction_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a p
can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313558 - https://vuldb.com/?ctiid.313558 - https://vuldb.com/?submit.598589 - https://github.com/zzb1388/cve/issues/11 - https://code-projects.org/
CVE ID: CVE-2025-6452 State: PUBLISHED Published: 2025-06-22T02:00:10.742Z Last Updated: 2025-06-24T08:17:27.284Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Patient Record Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CodeAstro Patient Record Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Generate New Report Page. The manipulation of the argument Patient Name/Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
ay be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313559 - https://vuldb.com/?ctiid.313559 - https://vuldb.com/?submit.598711 - https://github.com/Vanshdhawan188/CodeAstro-Online-Healthcare-Patient-Record-Management-System/blob/main/CodeAstro-Online-Healthcare-Patient-Record-Management-System.md - https://github.com/Vanshdhawan188/CodeAstro-Online-Healthcare-Patient-Record-Management-System/blob/main/CodeAstro-Online-Healthcare-Patient-Record-Management-System.md#-proof-of-concept-poc - https://codeastro.com/
CVE ID: CVE-2025-6453 State: PUBLISHED Published: 2025-06-22T02:31:05.226Z Last Updated: 2025-06-23T14:51:03.172Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: diyhi Products: bbs Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in diyhi bbs 6.8. Affected is the function Add of the file /src/main/java/cms/web/action/template/ForumManageAction.java of the component API. The manipulation of the argument dirName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313560 - https://vuldb.com/?ctiid.313560 - https://vuldb.com/?submit.598862 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.md - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-01.md#steps-to-reproduce
CVE ID: CVE-2025-6454 State: PUBLISHED Published: 2025-09-12T06:05:49.792Z Last Updated: 2025-09-12T17:18:59.590Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-918 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ - https://gitlab.com/
: References: - https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ - https://gitlab.com/gitlab-org/gitlab/-/issues/550766 - https://hackerone.com/reports/3162711
CVE ID: CVE-2025-6455 State: PUBLISHED Published: 2025-06-22T03:00:12.788Z Last Updated: 2025-06-23T14:48:47.429Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /messageexec.php. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313561 - https://vuldb.com/?ctiid.313561 - https://vuldb.com/?submit.598876 - https://github.com/blueandhack/cve/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-6456 State: PUBLISHED Published: 2025-06-22T03:31:08.757Z Last Updated: 2025-06-23T14:34:10.673Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Hotel Reservation System 1.0. Affected by this issue is some unknown functionality of the file /reservation/order.php. The manipulation of the argument Start leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
e launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313562 - https://vuldb.com/?ctiid.313562 - https://vuldb.com/?submit.598877 - https://github.com/blueandhack/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6457 State: PUBLISHED Published: 2025-06-22T04:00:06.384Z Last Updated: 2025-06-23T14:33:22.048Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Online Hotel Reservation System 1.0. This affects an unknown part of the file /reservation/demo.php. The manipulation of the argument Start leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313563 - https://vuldb.com/?ctiid.313563 - https://vuldb.com/?submit.598878 - https://github.com/blueandhack/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6458 State: PUBLISHED Published: 2025-06-22T04:31:06.736Z Last Updated: 2025-06-23T14:32:42.762Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Hotel Reservation System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Online Hotel Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/execedituser.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313564 - https://vuldb.com/?ctiid.313564 - https://vuldb.com/?submit.598883 - https://github.com/Kristin5634487/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6459 State: PUBLISHED Published: 2025-07-02T03:47:22.333Z Last Updated: 2025-07-02T13:18:58.816Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-352 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted the
akes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22fa8290-ebab-4fa4-bcba-0053c3b79f76?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2025-6462 State: PUBLISHED Published: 2025-06-29T04:23:58.324Z Last Updated: 2025-06-30T15:53:23.429Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: scheeeli Products: EZ SQL Reports Shortcode Widget and DB Backup Problem Types: CWE-79 Description: The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
s. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a6811f19-07fb-4c05-977f-90f9c5d89bb4?source=cve - https://wordpress.org/plugins/elisqlreports/#developers - https://plugins.trac.wordpress.org/changeset/3318513/
CVE ID: CVE-2025-6463 State: PUBLISHED Published: 2025-07-02T04:24:56.446Z Last Updated: 2025-07-02T13:17:02.392Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-73 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will
This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc9b4cb-d36b-4693-a7b9-1dad123b6639?source=cve - https://plugins.trac.wordpress.org/browser/forminator/trunk/library/model/class-form-entry-model.php#L1249 - https://plugins.trac.wordpress.org/changeset/3319860/forminator#fil
unk/library/model/class-form-entry-model.php#L1249 - https://plugins.trac.wordpress.org/changeset/3319860/forminator#file3
CVE ID: CVE-2025-6464 State: PUBLISHED Published: 2025-07-02T05:29:17.413Z Last Updated: 2025-07-02T13:14:34.849Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-502 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is prese
makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. Additional Analyst Notes: - CISA ADP Vuln
hether by an Administrator or via auto-deletion determined by plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6707aa4c-c652-42c0-bdb9-00be984e7271?source=cve - https://plugins.trac.wordpress.org/browser/forminator/trunk/library/model/class-form-entry-model.php#L1249 - https://plugins.trac.wordpress.org/browser/forminator/trunk/library/model/class-form-entry-model.php#L1263 - https://plugins.trac.wordpress.org/changeset?old_path=%2Fforminator&old=3319860&new_path=%2Fforminator&new=3319860&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6465 State: PUBLISHED Published: 2025-08-21T17:01:42.866Z Last Updated: 2025-08-21T17:30:45.951Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-22 Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-6466 State: PUBLISHED Published: 2025-06-22T05:00:14.279Z Last Updated: 2025-06-23T14:32:06.283Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: ageerle Products: ruoyi-ai Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading
ed upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as 4e93ac86d4891c59ecfcd27c051de9b3c5379315. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313574 - https://vuldb.com/?ctiid.313574 - https://vuldb.com/?submit.598365 - https://github.com/ageerle/ruoyi-ai/issues/9 - https://github.com/ageerle/ruoyi-ai/issues/9#event-16775988438 - https://github.com/ageerle/ruoyi-ai/commit/4e93ac86d4891c59ecfcd27c051de9b3c5379315 - https://github.com/ageerle/ruoyi-ai/releases/ta
b.com/ageerle/ruoyi-ai/commit/4e93ac86d4891c59ecfcd27c051de9b3c5379315 - https://github.com/ageerle/ruoyi-ai/releases/tag/v2.0.1
CVE ID: CVE-2025-6467 State: PUBLISHED Published: 2025-06-22T05:31:06.961Z Last Updated: 2025-06-23T14:00:22.271Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313575 - https://vuldb.com/?ctiid.313575 - https://vuldb.com/?submit.598882 - https://github.com/Kristin5634487/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6468 State: PUBLISHED Published: 2025-06-22T07:31:05.058Z Last Updated: 2025-06-23T17:26:45.855Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Bidding System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /bidnow.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.31
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313576 - https://vuldb.com/?ctiid.313576 - https://vuldb.com/?submit.598994 - https://github.com/ganzhi-qcy/cve/issues/12 - https://code-projects.org/
CVE ID: CVE-2025-6469 State: PUBLISHED Published: 2025-06-22T08:00:13.554Z Last Updated: 2025-06-23T17:10:29.690Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Bidding System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /details.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313577 - https://vuldb.com/?ctiid.313577 - https://vuldb.com/?submit.599089 - https://github.com/W2-l0mechan1c/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-6470 State: PUBLISHED Published: 2025-06-22T09:00:16.534Z Last Updated: 2025-06-23T17:07:28.679Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /bidlog.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313578 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313578 - https://vuldb.com/?ctiid.313578 - https://vuldb.com/?submit.599090 - https://github.com/W2-l0mechan1c/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-6471 State: PUBLISHED Published: 2025-06-22T09:31:06.748Z Last Updated: 2025-06-23T17:02:44.415Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Online Bidding System 1.0. Affected by this vulnerability is an unknown functionality of the file /administrator. The manipulation of the argument aduser leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313579 - https://vuldb.com/?ctiid.313579 - https://vuldb.com/?submit.599402 - https://github.com/ganzhi-qcy/cve/issues/11 - https://code-projects.org/
CVE ID: CVE-2025-6472 State: PUBLISHED Published: 2025-06-22T10:00:15.166Z Last Updated: 2025-06-23T16:55:28.331Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Bidding System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Bidding System 1.0. Affected by this issue is some unknown functionality of the file /showprod.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313580 - https://vuldb.com/?ctiid.313580 - https://vuldb.com/?submit.599867 - https://github.com/ganzhi-qcy/cve/issues/10 - https://code-projects.org/
CVE ID: CVE-2025-6473 State: PUBLISHED Published: 2025-06-22T11:00:09.969Z Last Updated: 2025-06-23T16:53:24.587Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: School Fees Payment System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /fees.php. The manipulation of the argument transcation_remark leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313581 - https://vuldb.com/?ctiid.313581 - https://vuldb.com/?submit.599888 - https://github.com/tuooo/CVE/issues/17 - https://code-projects.org/
CVE ID: CVE-2025-6474 State: PUBLISHED Published: 2025-06-22T11:31:06.073Z Last Updated: 2025-06-23T14:10:06.491Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Inventory Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /changeUsername.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.313582 - https://vuldb.com/?ctiid.313582 - https://vuldb.com/?submit.600494 - https://github.com/1609624781/cve/issues/1 - https://code-projects.org/