Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-11303 State: PUBLISHED Published: 2025-10-05T20:32:05.809Z Last Updated: 2025-10-06T16:12:35.677Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Belkin Products: F9K1015 Problem Types: CWE-77, CWE-74 Description: A vulnerability was detected in Belkin F9K1015 1.00.10. Affected is an unknown function of the file /goform/mp. Performing manipulation of the argument command results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
osure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327184 - https://vuldb.com/?ctiid.327184 - https://vuldb.com/?submit.661307 - https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/mp.md - https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/mp.md#poc
CVE ID: CVE-2025-11304 State: PUBLISHED Published: 2025-10-05T21:02:06.131Z Last Updated: 2025-10-06T16:11:03.752Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: CodeCanyon, ui-lib Products: Mentor LMS Problem Types: CWE-942, CWE-346 Description: A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional An
shed and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327185 - https://vuldb.com/?ctiid.327185 - https://vuldb.com/?submit.661733 - https://github.com/PlsRevert/CVEs/issues/3 - https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888
CVE ID: CVE-2025-11305 State: PUBLISHED Published: 2025-10-05T21:32:07.072Z Last Updated: 2025-10-06T16:09:39.632Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: UTT Products: HiPER 840G Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in UTT HiPER 840G up to 3.1.1-190328. Affected by this issue is the function strcpy of the file /goform/formTaskEdit. The manipulation of the argument txtMin2 leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327186 - https://vuldb.com/?ctiid.327186 - https://vuldb.com/?submit.661807 - https://github.com/maximdevere/CVE2/issues/3
CVE ID: CVE-2025-11306 State: PUBLISHED Published: 2025-10-05T22:02:07.683Z Last Updated: 2025-10-06T16:08:19.087Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: qianfox Products: FoxCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichmen
s contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327187 - https://vuldb.com/?ctiid.327187 - https://vuldb.com/?submit.661874 - https://github.com/coolcj-stack/FoxCMS-V1.2-is-vulnerable-to-cross-site-scripting-attacks.-There-is-an-XSS-vulnerability
CVE ID: CVE-2025-11307 State: PUBLISHED Published: 2025-11-11T06:00:06.520Z Last Updated: 2025-11-13T18:03:20.350Z Vendors: Unknown Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.48 does not sanitize user input provided via an AJAX action, allowing unauthenticated users to store XSS payloads which are later retrieved from another AJAX call and output unescaped. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f5b21a05-7a51-4530-9e07-4700f00eeca3/
CVE ID: CVE-2025-11308 State: PUBLISHED Published: 2025-10-05T22:32:05.623Z Last Updated: 2025-10-06T16:07:23.550Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Vanderlande Products: Baggage 360 Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulation of the argument Message leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA A
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327189 - https://vuldb.com/?ctiid.327189 - https://vuldb.com/?submit.662216 - https://github.com/YasserREED/YasserREED-CVEs/blob/main/Vanderlande-OpenAIR-Baggage360/Stored%20Cross-Site%20Scripting%20(XSS).md - https://github.com/YasserREED/YasserREED-CVEs/blob/main/Vanderlande-OpenAIR-Baggage360/Stored%20Cross-Site%20Scripting%20(XSS).md#http-proof-of-concept-poc
CVE ID: CVE-2025-11309 State: PUBLISHED Published: 2025-10-05T23:02:06.774Z Last Updated: 2025-10-06T14:24:55.611Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Impacted is the function doFilter of the file findDeptPage.do. Performing manipulation of the argument sort results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about
attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327190 - https://vuldb.com/?ctiid.327190 - https://vuldb.com/?submit.663382 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-1.md - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-1.md#sql-injection-vulnerability
CVE ID: CVE-2025-11310 State: PUBLISHED Published: 2025-10-05T23:32:05.222Z Last Updated: 2025-10-06T13:57:39.566Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of the file findFileServerPage.do. Executing manipulation of the argument sort can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vend
ssible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327191 - https://vuldb.com/?ctiid.327191 - https://vuldb.com/?submit.663426 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-2.md
CVE ID: CVE-2025-11311 State: PUBLISHED Published: 2025-10-06T00:02:05.334Z Last Updated: 2025-10-06T17:22:36.698Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenantPage of the file findTenantPage.do. The manipulation of the argument sort leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about t
n be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327192 - https://vuldb.com/?ctiid.327192 - https://vuldb.com/?submit.663451 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-3.md
CVE ID: CVE-2025-11312 State: PUBLISHED Published: 2025-10-06T00:32:06.297Z Last Updated: 2025-10-06T19:14:15.570Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability was detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findModulePage.do. The manipulation of the argument sort results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in
The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327193 - https://vuldb.com/?ctiid.327193 - https://vuldb.com/?submit.663457 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-4.md
CVE ID: CVE-2025-11313 State: PUBLISHED Published: 2025-10-06T01:02:06.176Z Last Updated: 2025-10-06T19:13:23.602Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This impacts the function findRolePage of the file findRolePage.do. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327194 - https://vuldb.com/?ctiid.327194 - https://vuldb.com/?submit.663475 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-5.md
CVE ID: CVE-2025-11314 State: PUBLISHED Published: 2025-10-06T01:32:06.133Z Last Updated: 2025-10-06T19:57:32.791Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected is the function findRolePage of the file findSingConfigPage.do. Such manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure bu
y. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327195 - https://vuldb.com/?ctiid.327195 - https://vuldb.com/?submit.663480 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-6.md
CVE ID: CVE-2025-11315 State: PUBLISHED Published: 2025-10-06T02:02:05.405Z Last Updated: 2025-10-06T19:41:31.092Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this vulnerability is the function findUserPage of the file findUserPage.do. Performing manipulation of the argument sort results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about
tion of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327196 - https://vuldb.com/?ctiid.327196 - https://vuldb.com/?submit.663494 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-7.md - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-7.md#3-proof-of-concept-poc
CVE ID: CVE-2025-11316 State: PUBLISHED Published: 2025-10-06T02:32:06.270Z Last Updated: 2025-10-06T13:52:52.214Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of the file findCategoryPage.do. Executing manipulation of the argument tenantId can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted ear
tack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327197 - https://vuldb.com/?ctiid.327197 - https://vuldb.com/?submit.663506 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-8.md
CVE ID: CVE-2025-11317 State: PUBLISHED Published: 2025-10-06T03:02:05.205Z Last Updated: 2025-10-06T13:51:44.941Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findRolePage of the file findSingConfigPage.do. The manipulation of the argument sort leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosu
ed out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327198 - https://vuldb.com/?ctiid.327198 - https://vuldb.com/?submit.663514 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-9.md
CVE ID: CVE-2025-11318 State: PUBLISHED Published: 2025-10-06T03:32:05.595Z Last Updated: 2025-10-06T19:38:16.047Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Tipray 厦门天锐科技股份有限公司 Products: Data Leakage Prevention System 天锐数据泄露防护系统 Problem Types: CWE-434, CWE-284 Description: A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file uploadWxFile.do. The manipulation of the argument File results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about
med from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327199 - https://vuldb.com/?ctiid.327199 - https://vuldb.com/?submit.663517 - https://github.com/FightingLzn9/vul/blob/main/%E5%A4%A9%E9%94%90%E6%95%B0%E6%8D%AE%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E7%B3%BB%E7%BB%9F-10.md
CVE ID: CVE-2025-11319 State: PUBLISHED Published: 2025-10-06T04:02:05.530Z Last Updated: 2025-10-06T19:24:26.793Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: nahiduddinahammed Products: Hospital-Management-System-Website Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some unknown processing of the file /delete.php. This manipulation of the argument ai causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. This product is
initiate the attack remotely. The exploit has been made available to the public and could be exploited. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327200 - https://vuldb.com/?ctiid.327200 - https://vuldb.com/?submit.664324 - https://github.com/mhszed/Report/blob/main/SQL%20Injection%20Vulnerability%20in%20the%20Hospital-Management-System-Website%20Editor.docx
CVE ID: CVE-2025-11320 State: PUBLISHED Published: 2025-10-06T04:32:06.583Z Last Updated: 2025-10-06T19:17:16.405Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: zhuimengshaonian Products: wisdom-education Problem Types: CWE-434, CWE-284 Description: A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP
unch the attack remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327201 - https://vuldb.com/?ctiid.327201 - https://vuldb.com/?submit.664392 - https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md - https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E5%89%8D%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md#vulnerability-reproduction
CVE ID: CVE-2025-11321 State: PUBLISHED Published: 2025-10-06T05:02:06.331Z Last Updated: 2025-10-06T17:20:47.842Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: zhuimengshaonian Products: wisdom-education Problem Types: CWE-639, CWE-285 Description: A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes
zation bypass. The attack can be initiated remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327202 - https://vuldb.com/?ctiid.327202 - https://vuldb.com/?submit.664395 - https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%832.md - https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%832.md#vulnerability-reproduction
CVE ID: CVE-2025-11322 State: PUBLISHED Published: 2025-10-06T05:32:05.987Z Last Updated: 2025-10-06T17:18:06.064Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Mangati Products: NovoSGA Problem Types: CWE-521 Description: A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published a
Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327203 - https://vuldb.com/?ctiid.327203 - https://vuldb.com/?submit.664517 - https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md - https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md
CVE ID: CVE-2025-11323 State: PUBLISHED Published: 2025-10-06T06:02:06.891Z Last Updated: 2025-10-06T17:14:34.780Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: UTT Products: 1250GW Problem Types: CWE-120, CWE-119 Description: A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation of the argument Username causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vul
endor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.327206 - https://vuldb.com/?ctiid.327206 - https://vuldb.com/?submit.664524 - https://github.com/DavCloudz/cve/issues/3