Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-25497 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-07T19:45:40.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability enables account ownership reassignment to or away from any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/188626/ - https://helpdesk.netsweeper.com/docs/8_2_Docs/8_2_Netsweeper_Docs/Content/Release_Notes/Netsweeper_R
/files/id/188626/ - https://helpdesk.netsweeper.com/docs/8_2_Docs/8_2_Netsweeper_Docs/Content/Release_Notes/Netsweeper_Release_Notes/8_2_Release_Notes/8_2_7_Release_and_Downloads.htm
CVE ID: CVE-2025-25500 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-21T16:21:14.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/H3T76/8096a6ff9410f3a6d9a25db1a68ae657#file-cve-2025-25500
CVE ID: CVE-2025-25504 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-05T17:38:43.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gefen.com - https://www.troy-wilson.com/cve-2025-25504.html
CVE ID: CVE-2025-25505 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T20:45:03.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC6_getRootStatus_callback_overflow/detail.md
CVE ID: CVE-2025-25507 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T20:46:40.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC6_formexecommand_cmdinput_rce/detail.md
CVE ID: CVE-2025-25510 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T20:48:05.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC8_get_parentControl_list_Info_urls_overflow/detail.md
CVE ID: CVE-2025-25513 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-03-14T16:23:11.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-1.md
CVE ID: CVE-2025-25514 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-28T21:57:33.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-6.md
CVE ID: CVE-2025-25515 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-26T15:02:44.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-5.md
CVE ID: CVE-2025-25516 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-26T15:01:54.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-2.md
CVE ID: CVE-2025-25517 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-26T14:59:47.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-7.md
CVE ID: CVE-2025-25519 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-26T14:58:58.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-8.md
CVE ID: CVE-2025-25520 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-26T15:01:19.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-4.md
CVE ID: CVE-2025-25521 State: PUBLISHED Published: 2025-02-25T00:00:00.000Z Last Updated: 2025-02-26T15:00:46.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Colorado-all/cve/blob/main/seacms/seacms%20V13.3-sql-3.md
CVE ID: CVE-2025-25522 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T16:24:00.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Linksys WAP610N v1.0.05.002 due to the lack of length verification, which is related to the time setting operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/f2365f4f6d18b2b4518ee20d5c091e1b
CVE ID: CVE-2025-25523 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:38:01.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v1(1.00.023) due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/cb190038c9402c9f89681a0e116996f6
CVE ID: CVE-2025-25524 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:39:54.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/ce1f80afd2d8be8ca543437f16eae96b
CVE ID: CVE-2025-25525 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:41:23.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to the setting of firewall rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/d797c3cce41678028ff2d20c4e12137e
CVE ID: CVE-2025-25526 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:43:43.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the configuration of the PPTP server. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/5e3770d5e78e0aa5f9d51ba3882c35cd
CVE ID: CVE-2025-25527 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:44:50.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the configuration of source address NAT rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/354620285280aca98acba94a9c5fffb6
CVE ID: CVE-2025-25528 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:48:11.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. By successfully exploiting the vulnerabilities, attackers can crash the remote devices or execute arbitrary commands without any authorization verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/87f3a4412c46fa9c27d2f723136920b8
CVE ID: CVE-2025-25529 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T17:45:39.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Digital China DCBC Gateway 200-2.1.1 due to the lack of length verification, which is related to the configuration of static NAT rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/121e150c1cc100eab2cbd8ba3b55626b
CVE ID: CVE-2025-25530 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-18T15:14:56.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to saving parental control configuration information. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/570a765f6812b8c53d35f623ee701b19
CVE ID: CVE-2025-25535 State: PUBLISHED Published: 2025-03-26T00:00:00.000Z Last Updated: 2025-03-27T14:12:14.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.besafebrasil.com.br/script-case-cve-2025-xx-xxxx/ - https://github.com/simalamuel/Research/tree/main/CVE-2025-25535
CVE ID: CVE-2025-25539 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:42:48.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/drive/folders/1Va0QP5TtsRprk-pXL3bUfCwTSjYbqnLK?usp=sharing - https://gist.github.com/sornram9254/15eb12579b7acda8ba021217366960bd
CVE ID: CVE-2025-25565 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-07-19T01:32:15.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a command line. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lzydry.github.io/CVE-2025-25565/ - https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25565.pdf
CVE ID: CVE-2025-25566 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-07-19T01:35:26.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function. NOTE: the Supplier disputes this because the behavior is limited to a single allocation of a few hundred bytes with a command-line tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lzydry.github.io/CVE-2025-25566/ - https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25566.pdf
CVE ID: CVE-2025-25567 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-07-19T01:29:18.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the behavior only enables a local user to attack himself through the UI, Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lzydry.github.io/CVE-2025-25567/ - https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25567.pdf
CVE ID: CVE-2025-25568 State: PUBLISHED Published: 2025-03-12T00:00:00.000Z Last Updated: 2025-07-19T01:24:27.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrusted input and runs under the user's own privileges (it is a stress-testing tool for a networking stack). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lzydry.github.io/CVE-2025-25568/ - https://filecenter.softether-upload.com/d/250715_001_
richment: References: - https://lzydry.github.io/CVE-2025-25568/ - https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25568.pdf
CVE ID: CVE-2025-25570 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T21:28:59.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hackerhan/Vben-Admin
CVE ID: CVE-2025-25579 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-03-31T17:47:58.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/regainer27/totolink_A3002R_remote_command_exec - https://gist.github.com/regainer27/0abf6f56eae3fa2826d2551e22c2ace3
CVE ID: CVE-2025-25580 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-19T18:25:20.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/yimioa/issues/IBI6XT
CVE ID: CVE-2025-25582 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-19T18:22:48.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/yimioa/issues/IBI74K
CVE ID: CVE-2025-25585 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-19T18:24:48.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/yimioa/issues/IBI7PG
CVE ID: CVE-2025-25586 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-19T18:21:33.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/yimioa/issues/IBI7LR
CVE ID: CVE-2025-25589 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-21T13:35:19.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/yimioa/issues/IBI81R
CVE ID: CVE-2025-25590 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-19T18:24:22.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/yimioa/issues/IBI7XH
CVE ID: CVE-2025-25595 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-25T16:49:31.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/t8FthPaF - https://play.google.com/store/apps/details?id=com.iitb.cse.arkenstone.safe_v2
CVE ID: CVE-2025-25598 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T13:51:54.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a crafted executable into a scheduled task. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/quriusfox/vulnerability-research/tree/main/CVE-2025-25598
CVE ID: CVE-2025-25604 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T21:04:36.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sezangel/IOT-vul/tree/main/Totolink/X5000R/5
CVE ID: CVE-2025-25605 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-02-21T21:03:17.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sezangel/IOT-vul/tree/main/Totolink/X5000R/4
CVE ID: CVE-2025-25609 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-05T15:44:47.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6 parameter in the formIpv6Setup interface of /bin/boa Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/firmcrosser/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-static_ipv6.md
CVE ID: CVE-2025-25610 State: PUBLISHED Published: 2025-02-28T00:00:00.000Z Last Updated: 2025-03-05T15:43:58.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_gw parameter in the formIpv6Setup interface of /bin/boa. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunnyYANGyaya/firmcrosser/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-static_gw.md
CVE ID: CVE-2025-25612 State: PUBLISHED Published: 2025-03-17T00:00:00.000Z Last Updated: 2025-03-17T18:02:41.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser. Additional Analyst Notes: - CISA ADP Vulnr
dministrators, resulting in arbitrary script execution in the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://fs.com - https://github.com/secmuzz/CVE-2025-25612/
CVE ID: CVE-2025-25613 State: PUBLISHED Published: 2025-11-20T00:00:00.000Z Last Updated: 2025-11-21T14:36:39.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://fs.com - http://s3150-8t2f.com - https://github.com/SwiftSecur/S3150-8T2F-FS.com-Rese
Vulnrichment: References: - http://fs.com - http://s3150-8t2f.com - https://github.com/SwiftSecur/S3150-8T2F-FS.com-Research/wiki
CVE ID: CVE-2025-25614 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-10T19:17:30.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/changeweb/Unifiedtransform - https://github.com/armaansidana2003/CVE-2025-25614