Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-6076 State: PUBLISHED Published: 2025-08-02T02:15:31.536Z Last Updated: 2025-11-03T20:06:46.248Z Vendors: Partner Software Products: Partner Web Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and compromise the device. By default, the software runs as SYSTEM, heightening the severity of the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://partnersoftware.com/resources/software-release-inf
CISA ADP Vulnrichment: - CVE Program Container: References: - https://partnersoftware.com/resources/software-release-info-4-32/
CVE ID: CVE-2025-6077 State: PUBLISHED Published: 2025-08-02T02:15:45.052Z Last Updated: 2025-11-03T20:06:47.643Z Vendors: Partner Software Products: Partner Web Problem Types: CWE-1391 Description: Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://partnersoftware.com/resources/software-release-info-4-32/
CVE ID: CVE-2025-6078 State: PUBLISHED Published: 2025-08-02T02:15:55.155Z Last Updated: 2025-11-03T20:06:49.011Z Vendors: Partner Software Products: Partner Web Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting). Additional Analyst Notes: - CISA ADP Vulnric
taining malicious JavaScript, leading to stored XSS (cross-site scripting). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://partnersoftware.com/resources/software-release-info-4-32/
CVE ID: CVE-2025-6079 State: PUBLISHED Published: 2025-08-16T03:38:52.812Z Last Updated: 2025-08-18T13:18:47.533Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: School Management System for Wordpress Problem Types: CWE-434 Description: The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the homework.php file in all versions up to, and including, 93.2.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Addit
and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d872ec33-6284-495c-b894-41fe7b40b63c?source=cve - https://codecanyon.net/item/school-management-system-for-wordpress/11470032
CVE ID: CVE-2025-6080 State: PUBLISHED Published: 2025-08-16T03:38:50.216Z Last Updated: 2025-08-18T19:00:07.097Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: WPGYM - Wordpress Gym Management System Problem Types: CWE-269 Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This is due to the plugin not properly validating a user's capabilities prior to adding users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new users, including admins. Additional Analys
uthenticated attackers, with Subscriber-level access and above, to create new users, including admins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f853657-1801-4d63-89b8-b2132212a205?source=cve - https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964
CVE ID: CVE-2025-6081 State: PUBLISHED Published: 2025-07-01T03:25:38.240Z Last Updated: 2025-07-02T13:24:52.549Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Konica Minolta Products: bizhub 227 Multifunction printers Problem Types: CWE-522 Description: Insufficiently Protected Credentials in LDAP in Konica Minolta bizhub 227 Multifunction printers version GCQ-Y3 or earlier allows an attacker can reconfigure the target device to use an external LDAP service controlled by the attacker. If an LDAP password is set on the target device, the attacker can force the target device to authenticate to the attacker controlled LDAP service. This will allow the attack
attacker can force the target device to authenticate to the attacker controlled LDAP service. This will allow the attacker to capture the plaintext password of the configured LDAP service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rapid7.com/blog/post/cve-2025-6081-konica-minolta-bizhub-pass-back-attack-vulnerability-not-fixed/ - https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0003.pdf
CVE ID: CVE-2025-6082 State: PUBLISHED Published: 2025-07-22T09:22:43.204Z Last Updated: 2025-07-22T13:23:24.582Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mia4 Products: Birth Chart Compatibility Problem Types: CWE-200 Description: The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The informa
nticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4607dca0-d3b7-4fca-8f89-a0a739bd7551?source=cve - https://plugins.svn.wordpress.org/birth-chart-compatibility/trunk/index.php - https://wordpress.org/plugins/birth-chart-compatibility/
CVE ID: CVE-2025-6083 State: PUBLISHED Published: 2025-06-13T21:06:34.653Z Last Updated: 2025-06-17T18:14:09.833Z Vendors: Extreme Networks Products: ExtremeCloud Universal ZTNA Problem Types: CWE-287 Description: In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://extreme-networks.my.site.com/ExtrArticleDetail?an=000126912
CVE ID: CVE-2025-6085 State: PUBLISHED Published: 2025-09-04T09:22:24.861Z Last Updated: 2025-09-04T15:04:25.042Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: integromat Products: Make Connector Problem Types: CWE-434 Description: The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP
files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c53c322a-b197-4ece-ae4a-a3a86a009e4d?source=cve - https://plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.php#L24 - https://plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.php#L74 - https://plugins.trac.wordpress.org/browser/integromat-connector/trunk/class/class-rest-request.php#L90-95 - https://github.com/d0n601/CVE-2025-6085 - https://ryankozak.com/posts/cve-2025-6085/
CVE ID: CVE-2025-6086 State: PUBLISHED Published: 2025-06-18T09:21:31.021Z Last Updated: 2025-06-18T13:40:45.108Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: scottyla Products: CSV Me Problem Types: CWE-434 Description: The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csv_me_options_page' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: R
fected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83bf3f3d-49f1-473a-a9ee-d78eb8981ad3?source=cve - https://plugins.trac.wordpress.org/browser/csv-me/trunk/csv_me_index.php#L49
CVE ID: CVE-2025-6087 State: PUBLISHED Published: 2025-06-16T18:30:44.180Z Last Updated: 2025-06-16T18:55:53.269Z Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com In
sing the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com In this example, attacker-controlled content from attacker.com is served through the victim site’s domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services. Impact: * SSRF via unrestricted remote URL loading * Arbitrary remote content loading * Potential internal service exposure or phishing risks through domain abuse Mitigation: The following mitigations have been put in place: * Server side updates to Cloudflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically miti
udflare’s platform to restrict the content loaded via the /_next/image endpoint to images. The update automatically mitigates the issue for all existing and any future sites deployed to Cloudflare using the affected version of the Cloudflare adapter for Open Next * Root cause fix https://github.com/opennextjs/opennextjs-cloudflare/pull/727 to the Cloudflare adapter for Open Next. The patched version of the adapter is found here @opennextjs/cloudflare@1.3.0 https://www.npmjs.com/package/@opennextjs/cloudflare/v/1.3.0 * Package dependency update https://github.com/cloudflare/workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The pa
workers-sdk/pull/9608 to create-cloudflare (c3) to use the fixed version of the Cloudflare adapter for Open Next. The patched version of create-cloudflare is found here: create-cloudflare@2.49.3 https://www.npmjs.com/package/create-cloudflare/v/2.49.3 In addition to the automatic mitigation deployed on Cloudflare’s platform, we encourage affected users to upgrade to @opennext/cloudflare v1.3.0 and use the remotePatterns https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns filter in Next config https://nextjs.org/docs/pages/api-reference/components/image#remotepatterns if they need to allow-list external urls with images assets. Additional Analyst Notes: - CISA ADP Vuln
ge#remotepatterns if they need to allow-list external urls with images assets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opennextjs/opennextjs-cloudflare
CVE ID: CVE-2025-6088 State: PUBLISHED Published: 2025-09-11T00:43:51.699Z Last Updated: 2025-09-11T14:42:34.879Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-285 Description: In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerabilit
obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/361405bb-a739-41eb-a680-4cb6193e7c76 - https://github.com/danny-avila/librechat/commit/3af2666890bbf291cb7b9f3e03592d54714f0ff5
CVE ID: CVE-2025-6089 State: PUBLISHED Published: 2025-06-15T13:00:14.560Z Last Updated: 2025-06-16T16:44:23.482Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C) Vendors: Astun Technology Products: iShare Maps Problem Types: CWE-601 Description: A vulnerability has been found in Astun Technology iShare Maps 5.4.0 and classified as problematic. This vulnerability affects unknown code of the file atCheckJS.aspx. The manipulation of the argument ref leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst No
may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312556 - https://vuldb.com/?ctiid.312556 - https://vuldb.com/?submit.587876
CVE ID: CVE-2025-6090 State: PUBLISHED Published: 2025-06-15T14:31:04.690Z Last Updated: 2025-06-16T16:43:12.346Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:U/RC:C) Vendors: H3C Products: GR-5400AX Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in H3C GR-5400AX V100R009L50 and classified as critical. This issue affects the function UpdateWanparamsMulti/UpdateIpv6params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk as low, t
d to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk as low, they do not have immediate plans for remediation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312557 - https://vuldb.com/?ctiid.312557 - https://vuldb.com/?submit.587999 - https://github.com/CH13hh/cve/blob/main/new/5.md
CVE ID: CVE-2025-6091 State: PUBLISHED Published: 2025-06-15T16:31:05.392Z Last Updated: 2025-06-16T16:33:57.505Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:U/RC:C) Vendors: H3C Products: GR-3000AX Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk
n disclosed to the public and may be used. The vendor confirms the existence of this issue. Because they assess the risk as low, they do not have immediate plans for remediation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312558 - https://vuldb.com/?ctiid.312558 - https://vuldb.com/?submit.588000 - https://github.com/CH13hh/cve/blob/main/new/6.md
CVE ID: CVE-2025-6092 State: PUBLISHED Published: 2025-06-15T17:31:05.460Z Last Updated: 2025-06-16T16:33:21.100Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: comfyanonymous Products: comfyui Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in comfyanonymous comfyui up to 0.3.39. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /upload/image of the component Incomplete Fix CVE-2024-10099. The manipulation of the argument image leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted ear
ack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312559 - https://vuldb.com/?ctiid.312559 - https://vuldb.com/?submit.588224 - https://gist.github.com/superboy-zjc/96f0d56da584d840ba18355cbea96ac4
CVE ID: CVE-2025-6093 State: PUBLISHED Published: 2025-06-15T22:00:12.638Z Last Updated: 2025-06-16T16:32:01.612Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R) Vendors: uYanki Products: board-stm32f103rc-berial Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in uYanki board-stm32f103rc-berial up to 84daed541609cb7b46854cc6672a275d1007e295. This vulnerability affects the function heartrate1_i2c_hal_write of the file 7.Example/hal/i2c/max30100/Manual/demo2/2/heartrate1_hal.c. The manipulation of the argument num leads to stack-based buffer overflow. Continious delivery with rolling releases is used by this p
on of the argument num leads to stack-based buffer overflow. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312562 - https://vuldb.com/?ctiid.312562 - https://vuldb.com/?submit.588106 - https://github.com/uYanki/board-stm32f103rc-berial/issues/3
CVE ID: CVE-2025-6094 State: PUBLISHED Published: 2025-06-15T22:31:05.526Z Last Updated: 2025-07-15T13:44:26.983Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: qianfox Products: FoxCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in qianfox FoxCMS up to 1.2.5. This issue affects the function batchCope of the file app/admin/controller/Download.php. The manipulation of the argument ids leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.31256
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312563 - https://vuldb.com/?ctiid.312563 - https://vuldb.com/?submit.588807 - https://github.com/FSRM1/CVE/blob/main/foxcms_%E5%90%8E%E5%8F%B0sql%E6%B3%A8%E5%85%A5.md
CVE ID: CVE-2025-6095 State: PUBLISHED Published: 2025-06-15T23:00:13.567Z Last Updated: 2025-06-16T16:27:55.956Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: codesiddhant Products: Jasmin Ransomware Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in codesiddhant Jasmin Ransomware 1.0.1. Affected is an unknown function of the file /checklogin.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in a
n disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312564 - https://vuldb.com/?ctiid.312564 - https://vuldb.com/?submit.588833 - https://vuldb.com/?submit.588834 - https://github.com/YZS17/CVE/blob/main/Jasmin-Ransomware/sqli_username.md - https://github.com/YZS17/CVE/blob/main/Jasmin-Ransomware/sqli_password.md
CVE ID: CVE-2025-6096 State: PUBLISHED Published: 2025-06-15T23:31:05.235Z Last Updated: 2025-06-16T16:24:36.991Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: codesiddhant Products: Jasmin Ransomware Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in codesiddhant Jasmin Ransomware up to 1.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard.php. The manipulation of the argument Search leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not res
t has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312565 - https://vuldb.com/?ctiid.312565 - https://vuldb.com/?submit.588836 - https://github.com/YZS17/CVE/blob/main/Jasmin-Ransomware/sqli_search.md
CVE ID: CVE-2025-6097 State: PUBLISHED Published: 2025-06-16T00:00:12.840Z Last Updated: 2025-06-16T16:22:55.742Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: UTT Products: 进取 750W Problem Types: CWE-620, CWE-640 Description: A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted ear
ack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.312566 - https://vuldb.com/?ctiid.312566 - https://vuldb.com/?submit.589425 - https://github.com/pfwqdxwdd/cve/blob/main/6.md - https://github.com/pfwqdxwdd/cve/blob/main/6.md#poc