Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat Web Terminal 1.11 on RHEL 9, Red Hat Web Terminal 1.12 on RHEL 9, cert-manager operator for Red Hat OpenShift 1.16, Compliance Operator 1, File Integrity Operator 1, Red Hat Discovery 2, Red Hat Insights proxy 1.5, Red Hat OpenShift distributed tracing 3.5.2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 Problem Types: CWE-416 Description: A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory managemen
as found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:12447 - https://access.redhat.com/errata/RHSA-2025:12450 - https://access.redhat.com/errata/RHSA-2025:13267 - https://access.redhat.com/errata/RHSA-2025:13308 - https://access.redhat.com/errata
.redhat.com/errata/RHSA-2025:13267 - https://access.redhat.com/errata/RHSA-2025:13308 - https://access.redhat.com/errata/RHSA-2025:13309 - https://access.redhat.com/errata/RHSA-2025:13310 - https://access.redhat.com/errata/RHSA-2025:13311 - https://access.redhat.com/errata/RHSA-2025:13312 - https://access.redhat.com/errata/RHSA-2025:13313 - https://access.redhat.com/errata/RHSA-2025:13314 - https://access.redhat.com/errata/RHSA-2025:13335 - https://access.redhat.com/errata/RHSA-2025:13464 - https://access.redhat.com/errata/RHSA-2025:13622 - https://access.redhat.com/errata/RHSA-2025:14059 - https://access.redhat.com/errata/RHSA-2025:14396 - https://access.redhat.com/errata/RHSA-2025:14818 -
RHSA-2025:14059 - https://access.redhat.com/errata/RHSA-2025:14396 - https://access.redhat.com/errata/RHSA-2025:14818 - https://access.redhat.com/errata/RHSA-2025:14819 - https://access.redhat.com/errata/RHSA-2025:14853 - https://access.redhat.com/errata/RHSA-2025:14858 - https://access.redhat.com/errata/RHSA-2025:15308 - https://access.redhat.com/errata/RHSA-2025:15672 - https://access.redhat.com/errata/RHSA-2025:15827 - https://access.redhat.com/errata/RHSA-2025:15828 - https://access.redhat.com/errata/RHSA-2025:18219 - https://access.redhat.com/errata/RHSA-2025:21885 - https://access.redhat.com/errata/RHSA-2025:21913 - https://access.redhat.com/security/cve/CVE-2025-7425 - https://bugzill
ttps://access.redhat.com/errata/RHSA-2025:21913 - https://access.redhat.com/security/cve/CVE-2025-7425 - https://bugzilla.redhat.com/show_bug.cgi?id=2379274 - https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
CVE ID: CVE-2025-7426 State: PUBLISHED Published: 2025-08-25T08:52:47.797Z Last Updated: 2025-08-25T13:47:36.182Z Vendors: MINOVA Information Services GmbH Products: TTA Problem Types: CWE-200, CWE-312, CWE-532 Description: Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environments where this FTP server is part of automated business processes (e.g. EDI or data integration), this could lead to data manipulation, extraction, or abuse. Debug ports 1602, 1603 and 1636 also expose service archite
this could lead to data manipulation, extraction, or abuse. Debug ports 1602, 1603 and 1636 also expose service architecture information and system activity logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.minova.de/de/tta.html - https://www.cryptron.ch/en/blog-detail/security-advisory-CVE-2025-7426-en.html
CVE ID: CVE-2025-7427 State: PUBLISHED Published: 2025-07-22T09:52:56.703Z Last Updated: 2025-07-25T03:55:32.256Z Vendors: Arm Products: Development Studio Problem Types: CWE-427 Description: Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/documentation/110691
CVE ID: CVE-2025-7429 State: PUBLISHED Published: 2025-11-11T07:40:26.374Z Last Updated: 2025-11-13T04:55:31.343Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7429.html
CVE ID: CVE-2025-7430 State: PUBLISHED Published: 2025-11-11T10:24:11.018Z Last Updated: 2025-11-13T04:55:30.616Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-7430.html
CVE ID: CVE-2025-7431 State: PUBLISHED Published: 2025-07-18T01:44:06.021Z Last Updated: 2025-07-18T13:54:19.441Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: ajay Products: Knowledge Base Problem Types: CWE-79 Description: The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site instal
ry web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b405b5cb-b330-4bd6-87bd-fa97ded58460?source=cve - https://plugins.trac.wordpress.org/browser/knowledgebase/tags/2.3.1/includes/admin/settings/class-settings.php#L290
CVE ID: CVE-2025-7433 State: PUBLISHED Published: 2025-07-17T19:10:27.251Z Last Updated: 2025-07-17T20:35:32.913Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Intercept X for Windows Problem Types: CWE-502 Description: A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20250717-cix-lpe
CVE ID: CVE-2025-7434 State: PUBLISHED Published: 2025-07-11T01:32:08.701Z Last Updated: 2025-07-11T13:31:24.317Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda FH451 up to 1.0.0.9 and classified as critical. Affected by this issue is the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316004 - https://vuldb.com/?ctiid.316004 - https://vuldb.com/?submit.609058 - https://github.com/zezhifu1/cve_report/blob/main/FH451/fromAddressNat.md - https://github.com/zezhifu1/cve_report/blob/main/FH451/fromAddressNat.md#payload - https://www.tenda.com.cn/
CVE ID: CVE-2025-7435 State: PUBLISHED Published: 2025-07-11T02:02:07.812Z Last Updated: 2025-07-11T13:25:38.312Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: LiveHelperChat Products: lhc-php-resque Extension Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to t
name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 542aa8449b5aa889b3a54f419e794afe19f56d5d/0ce7b4f1193c0ed6c6e31a960fafededf979eef2. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316005 - https://vuldb.com/?ctiid.316005 - https://vuldb.com/?submit.609068 - https://github.com/CodeBrics/lhc-php-resque-exploit/ - h
://vuldb.com/?ctiid.316005 - https://vuldb.com/?submit.609068 - https://github.com/CodeBrics/lhc-php-resque-exploit/ - https://github.com/CodeBrics/lhc-php-resque-exploit/?tab=readme-ov-file#attack-vector - https://github.com/LiveHelperChat/lhc-php-resque/commit/542aa8449b5aa889b3a54f419e794afe19f56d5d
CVE ID: CVE-2025-7436 State: PUBLISHED Published: 2025-07-11T03:02:06.269Z Last Updated: 2025-07-11T13:24:30.269Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Online Recruitment Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_vacancy. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
tiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316006 - https://vuldb.com/?ctiid.316006 - https://vuldb.com/?submit.609358 - https://github.com/newb001/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-7437 State: PUBLISHED Published: 2025-07-24T04:24:13.455Z Last Updated: 2025-07-24T13:36:42.819Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: motovnet Products: Ebook Store Problem Types: CWE-434 Description: The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordf
make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc5c05d-51b7-4aee-bb4e-366ded45c4d8?source=cve - https://plugins.trac.wordpress.org/browser/ebook-store/trunk/functions.php#L2442 - https://plugins.trac.wordpress.org/changeset/3328355
CVE ID: CVE-2025-7438 State: PUBLISHED Published: 2025-07-18T06:45:33.113Z Last Updated: 2025-07-18T13:03:14.604Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: StylemixThemes Products: MasterStudy LMS Pro Problem Types: CWE-434 Description: The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerabi
ve, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ab970f5-35d1-43e9-891c-87a2a3e464c6?source=cve - https://docs.stylemixthemes.com/masterstudy-lms/changelog-pro-version
CVE ID: CVE-2025-7439 State: PUBLISHED Published: 2025-08-16T03:38:52.063Z Last Updated: 2025-08-18T13:24:31.416Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yeashir Products: Anber Elementor Addon Problem Types: CWE-79 Description: Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $anber_item['button_link']['url']’ parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb46d7fa-9667-4479-8136-837cb61eaf4c?source=cve - https://wordpress.org/plugins/anber-elementor-addon/
CVE ID: CVE-2025-7440 State: PUBLISHED Published: 2025-08-16T03:38:49.848Z Last Updated: 2025-08-18T19:00:16.709Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yeashir Products: Anber Elementor Addon Problem Types: CWE-79 Description: The Anber Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $item['button_link']['url'] parameter in all versions up to, and including, 1.0.1 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
vel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67b0f756-9130-402d-9787-78d482fa183e?source=cve - https://wordpress.org/plugins/anber-elementor-addon/
CVE ID: CVE-2025-7441 State: PUBLISHED Published: 2025-08-16T03:38:51.342Z Last Updated: 2025-08-18T13:36:29.055Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: storychief Products: StoryChief Problem Types: CWE-434 Description: The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst No
pload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/979efaa4-10f1-4c7f-b4b0-5a41678c9d66?source=cve - https://plugins.trac.wordpress.org/browser/story-chief/trunk/includes/tools.php#L75
CVE ID: CVE-2025-7442 State: PUBLISHED Published: 2025-07-11T07:23:01.096Z Last Updated: 2025-07-11T15:39:10.602Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dasinfomedia Products: WPGYM - Wordpress Gym Management System Problem Types: CWE-89 Description: The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to SQL Injection via several parameters in the MJ_gmgt_delete_class_limit_for_member, MJ_gmgt_get_yearly_income_expense, MJ_gmgt_get_monthly_income_expense, MJ_gmgt_add_class_limit, MJ_gmgt_view_meeting_detail, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied pa
, and MJ_gmgt_create_meeting functions in all versions up to 67.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e52289fe-9a38-4ebf-b24a-034768fa56b7?source=cve - https://codecanyon.net/item/-wpgym-wordpress-gym-management-system/13352964?s_rank=2
CVE ID: CVE-2025-7443 State: PUBLISHED Published: 2025-08-01T04:24:29.246Z Last Updated: 2025-08-01T13:30:00.478Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: berqwp Products: BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript Problem Types: CWE-434 Description: The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthent
a the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d7dc644-ab83-4f03-998a-ec8eda695161?source=cve - https://plugins.trac.wordpress.org/browser/searchpro/trunk/api/store_javascript_cache.php#L14 - https://plugins.trac.wordpress.org/changeset/3330075/searchpro/trunk/api/register_apis.php
CVE ID: CVE-2025-7444 State: PUBLISHED Published: 2025-07-18T08:22:39.012Z Last Updated: 2025-07-18T13:44:40.017Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LoginPress Products: LoginPress Pro Problem Types: CWE-288 Description: The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account
site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/80fcb3af-0b27-4442-aca0-58626b68f0d9?source=cve - https://loginpress.pro/changelog/
CVE ID: CVE-2025-7445 State: PUBLISHED Published: 2025-09-05T02:31:35.360Z Last Updated: 2025-09-05T15:55:05.022Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Kubernetes Products: secrets-store-sync-controller Problem Types: CWE-532 Description: Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/133897 - https://groups.google.com/g/kubernetes-security-announce/c/NP7cQvQ1aGA
CVE ID: CVE-2025-7448 State: PUBLISHED Published: 2025-09-12T09:11:53.850Z Last Updated: 2025-09-12T17:20:37.955Z Vendors: silabs.com Products: Wi-SUN Stack Problem Types: CWE-290 Description: Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.silabs.com/sisdk-release-notes/latest/sisdk-wisun-release-notes/ - https://community.silabs.com/068Vm00000UtuIG
CVE ID: CVE-2025-7450 State: PUBLISHED Published: 2025-07-11T17:02:05.790Z Last Updated: 2025-07-11T18:16:27.962Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: letseeqiji Products: gorobbs Problem Types: CWE-22 Description: A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controller/api/v1/user.go of the component API. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316095 - https://vuldb.com/?ctiid.316095 - https://vuldb.com/?submit.607799 - https://github.com/letseeqiji/gorobbs/issues/18
CVE ID: CVE-2025-7451 State: PUBLISHED Published: 2025-07-14T02:35:39.554Z Last Updated: 2025-07-14T14:44:00.805Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hgiga Products: iSherlock-maillog-4.5, iSherlock-smtp-4.5, iSherlock-maillog-5.5, iSherlock-smtp-5.5 Problem Types: CWE-78 Description: The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10237-9e0
ediately. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10237-9e0f7-1.html - https://www.twcert.org.tw/en/cp-139-10238-f2bba-2.html
CVE ID: CVE-2025-7452 State: PUBLISHED Published: 2025-07-11T17:32:05.202Z Last Updated: 2025-07-11T18:12:17.950Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: kone-net Products: go-chat Problem Types: CWE-22 Description: A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/file_controller.go of the component Endpoint. The manipulation of the argument fileName leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolli