Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5337 State: PUBLISHED Published: 2025-06-14T09:23:33.099Z Last Updated: 2025-06-17T18:38:34.447Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: metaslider Products: Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider Problem Types: CWE-79 Description: The Slider, Gallery, and Carousel by MetaSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘aria-label’ parameter in all versions up to, and including, 3.98.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts
makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e6492e5-a506-4d77-96d2-08f700b6ee76?source=cve - https://plugins.trac.wordpress.org/browser/ml-slider/tags/3.98.0/assets/metaslider/script.js#L11 - https://wordpress.org/plugins/ml-slider/#developers - https://plugins.trac.wordpress.org/changeset/3309932/ml-slider/tags/3.99.0/assets/metaslider/script.js
CVE ID: CVE-2025-5338 State: PUBLISHED Published: 2025-06-26T09:22:02.905Z Last Updated: 2025-06-26T13:10:11.925Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-79 Description: The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.1024 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/201ff7b6-d72a-43c3-a7b1-c4f917c9d27f?source=cve - https://wordpress.org/plugins/royal-elementor-addons/#developers - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1022/assets/js/frontend.js - https://plugins.trac.wordpress.org/changeset/3309082/
CVE ID: CVE-2025-5339 State: PUBLISHED Published: 2025-07-02T03:47:26.086Z Last Updated: 2025-07-02T13:18:15.567Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-89 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addi
of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5e4e1e3-61a6-4c37-80dd-93b5cea440e3?source=cve - http://localhost:1337/wp-content/plugins/ap-plugin-scripteo/lib/BSA_PRO_Model.php
CVE ID: CVE-2025-5340 State: PUBLISHED Published: 2025-06-03T11:22:25.063Z Last Updated: 2025-06-03T13:13:25.619Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smartwpress Products: Music Player for Elementor – Audio Player & Podcast Player Problem Types: CWE-79 Description: The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/193d9625-34ab-497f-987e-5a53ca01e73e?source=cve - https://wordpress.org/plugins/music-player-for-elementor/#developers - https://plugins.trac.wordpress.org/browser/music-player-for-elementor/tags/2.4.6/classes/widgets/slide-music-player-free.php#L1205 - https://plugins.trac.wordpress.org/changeset/3304812/
CVE ID: CVE-2025-5341 State: PUBLISHED Published: 2025-06-05T11:15:06.223Z Last Updated: 2025-06-05T14:28:14.441Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-79 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje
nd output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/415bfddb-5223-439f-8a08-535f79631ff0?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.44.1/assets/forminator-ui/js/forminator-form.js#L985 - https://wordpress.org/plugins/forminator/#developers - https://plugins.trac.wordpress.org/changeset/3306475
CVE ID: CVE-2025-5342 State: PUBLISHED Published: 2025-10-30T14:20:53.989Z Last Updated: 2025-10-30T14:46:13.685Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-400 Description: Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5342.html
CVE ID: CVE-2025-5343 State: PUBLISHED Published: 2025-10-30T14:28:20.681Z Last Updated: 2025-10-30T14:46:41.725Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the Instant Search option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5343.html
CVE ID: CVE-2025-5344 State: PUBLISHED Published: 2025-07-17T12:45:52.289Z Last Updated: 2025-07-17T13:48:07.955Z Vendors: Bluebird Products: com.bluebird.kiosk.launcher Problem Types: CWE-926 Description: Bluebird devices contain a pre-loaded kiosk application. This application exposes an unsecured service provider "com.bluebird.kiosk.launcher.IpartnerKioskRemoteService". A local attacker can bind to the AIDL-type service to modify device's global settings and wallpaper image. This issue affects all versions before 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/07/CVE-2025-5344
CVE ID: CVE-2025-5345 State: PUBLISHED Published: 2025-07-17T12:45:47.997Z Last Updated: 2025-07-17T13:51:53.408Z Vendors: Bluebird Products: com.bluebird.filemanagers Problem Types: CWE-926 Description: Bluebird devices contain a pre-loaded file manager application. This application exposes an unsecured service provider "com.bluebird.system.koreanpost.IsdcardRemoteService". A local attacker can bind to the AIDL-type service to copy and delete arbitrary files from device's storage with system-level permissions. Version 1.4.4 is vulnerable, vendor reverted vulnerable versions to older version: 1.3.6 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025
s to older version: 1.3.6 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/07/CVE-2025-5344
CVE ID: CVE-2025-5346 State: PUBLISHED Published: 2025-07-17T12:45:56.546Z Last Updated: 2025-07-17T13:44:05.369Z Vendors: Bluebird Products: kr.co.bluebird.android.bbsettings Problem Types: CWE-926 Description: Bluebird devices contain a pre-loaded barcode scanner application. This application exposes an unsecured broadcast receiver "kr.co.bluebird.android.bbsettings.BootReceiver". A local attacker can call the receiver to overwrite file containing ".json" keyword with default barcode config file. It is possible to overwrite file in any location due to lack of protection against path traversal in name of the file. This issue affects all versions before 1.3.3. Additional Analyst Notes: - CIS
gainst path traversal in name of the file. This issue affects all versions before 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/07CVE-2025-5344
CVE ID: CVE-2025-5347 State: PUBLISHED Published: 2025-10-30T14:31:51.240Z Last Updated: 2025-10-30T14:46:50.399Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: Zohocorp Products: ManageEngine Exchange Reporter Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the reports module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/exchange-reports/advisory/CVE-2025-5347.html
CVE ID: CVE-2025-5349 State: PUBLISHED Published: 2025-06-17T12:32:24.670Z Last Updated: 2025-06-26T03:55:22.631Z Vendors: NetScaler Products: ADC Problem Types: CWE-1284 Description: Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
CVE ID: CVE-2025-5350 State: PUBLISHED Published: 2025-10-24T10:08:07.719Z Last Updated: 2025-10-24T12:16:49.892Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: WSO2 Products: WSO2 Identity Server, WSO2 Enterprise Integrator, WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 API Control Plane, WSO2 Open Banking AM, WSO2 Open Banking IAM, WSO2 Identity Server as Key Manager, org.wso2.carbon:org.wso2.carbon.ui Problem Types: CWE-918, CWE-79 Description: SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-sup
within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a si
manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk. Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4124/
CVE ID: CVE-2025-5351 State: PUBLISHED Published: 2025-07-04T08:16:47.122Z Last Updated: 2025-11-20T21:12:34.709Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-415 Description: A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double
to serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-5351 - https://bugzilla.redhat.com/show_bug.cgi?id=2369367
CVE ID: CVE-2025-5352 State: PUBLISHED Published: 2025-08-23T06:56:09.029Z Last Updated: 2025-08-25T18:15:34.006Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-79 Description: A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is directly injected into the DOM using dangerouslySetInnerHTML without any sanitization or validation. This allows arbitrary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment o
rary JavaScript execution in all users' browsers if an attacker can control the environment variable during deployment or through server compromise. The vulnerability can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f1d3dbce-3c3e-480e-b81e-0e8afa05c491 - https://github.com/lunary-ai/lunary/commit/e2e43e88cecf742bacb639ab880507bbfdfd065c
CVE ID: CVE-2025-5353 State: PUBLISHED Published: 2025-06-10T14:39:34.206Z Last Updated: 2025-06-11T04:01:30.576Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Workspace Control Problem Types: CWE-321 Description: A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-CVE-2025-5353-CVE-CVE-2025-22463-CVE-2025-22455
CVE ID: CVE-2025-5356 State: PUBLISHED Published: 2025-05-30T16:31:04.446Z Last Updated: 2025-05-30T16:45:07.793Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been classified as critical. Affected is an unknown function of the component BYE Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310650 - https://vuldb.com/?ctiid.310650 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310650 - https://vuldb.com/?ctiid.310650 - https://vuldb.com/?submit.585639 - https://fitoxs.com/exploit/exploit-a9c9f7b4f50efc4b4be32e7ec4d3f7dfd7390e9be4ff168d9ab7a0eb911f8f3a.txt
CVE ID: CVE-2025-5357 State: PUBLISHED Published: 2025-05-30T17:31:04.859Z Last Updated: 2025-05-30T17:56:29.344Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in FreeFloat FTP Server 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component PWD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310651 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310651 - https://vuldb.com/?ctiid.310651 - https://vuldb.com/?submit.585641 - https://fitoxs.com/exploit/exploit-c15b3c9a2d7b1618fc5a30df50e5a13d6275f109f1fba20465d4cdd76ee8772b.txt
CVE ID: CVE-2025-5358 State: PUBLISHED Published: 2025-05-30T18:00:06.477Z Last Updated: 2025-05-30T18:15:18.480Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul, Campcodes Products: Cyber Cafe Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vu
launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310652 - https://vuldb.com/?ctiid.310652 - https://vuldb.com/?submit.586569 - https://github.com/ASantsSec/CVE/issues/1
CVE ID: CVE-2025-5359 State: PUBLISHED Published: 2025-05-30T18:31:04.660Z Last Updated: 2025-05-30T20:36:17.101Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in Campcodes Online Hospital Management System 1.0. This affects an unknown part of the file /appointment-history.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310653 - https://vuldb.com/?ctiid.310653 - https://vuldb.com/?submit.586590 - https://github.com/ASantsSec/CVE/issues/7 - https://www.campcodes.com/
CVE ID: CVE-2025-5360 State: PUBLISHED Published: 2025-05-30T19:31:05.566Z Last Updated: 2025-05-30T20:44:58.532Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in Campcodes Online Hospital Management System 1.0. This vulnerability affects unknown code of the file /book-appointment.php. The manipulation of the argument doctor leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310654 - https://vuldb.com/?ctiid.310654 - https://vuldb.com/?submit.586591 - https://github.com/ASantsSec/CVE/issues/8 - https://www.campcodes.com/
CVE ID: CVE-2025-5361 State: PUBLISHED Published: 2025-05-30T20:00:10.316Z Last Updated: 2025-05-30T20:46:56.433Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in Campcodes Online Hospital Management System 1.0. This issue affects some unknown processing of the file /contact.php. The manipulation of the argument fullname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310655 - https://vuldb.com/?ctiid.310655 - https://vuldb.com/?submit.586592 - https://github.com/ASantsSec/CVE/issues/9 - https://www.campcodes.com/
CVE ID: CVE-2025-5362 State: PUBLISHED Published: 2025-05-30T20:31:05.324Z Last Updated: 2025-05-30T20:47:30.162Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
ely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310656 - https://vuldb.com/?ctiid.310656 - https://vuldb.com/?submit.586596 - https://github.com/ASantsSec/CVE/issues/10 - https://www.campcodes.com/
CVE ID: CVE-2025-5363 State: PUBLISHED Published: 2025-05-30T21:00:10.335Z Last Updated: 2025-06-02T15:50:51.210Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /doctor/index.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310657 - https://vuldb.com/?ctiid.310657 - https://vuldb.com/?submit.586698 - https://github.com/yuanchaoxxxxx/CVE/issues/3 - https://www.campcodes.com/
CVE ID: CVE-2025-5364 State: PUBLISHED Published: 2025-05-30T21:31:05.125Z Last Updated: 2025-06-02T15:50:45.809Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Campcodes Products: Online Hospital Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Campcodes Online Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /doctor/add-patient.php. The manipulation of the argument patname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http