Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-45489 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-06T20:16:28.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/vuln03/blob/main/linksys/E5600/CI_ddnsStatus_DynDNS_hostname/CI_ddnsStatus_DynDNS_hostname.pdf - https://github.com/JZP018/vuln03/blob/main/linksys/E5600/CI_ddnsStatus_DynDNS_hostname/CI_ddnsStatus_DynDNS_hostname.py
CVE ID: CVE-2025-45490 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-06T20:18:43.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/vuln03/blob/main/linksys/E5600/CI_ddnsStatus_DynDNS_password/CI_ddnsStatus_DynDNS_password.pdf - https://github.com/JZP018/vuln03/blob/main/linksys/E5600/CI_ddnsStatus_DynDNS_password/CI_ddnsStatus_DynDNS_password.py
CVE ID: CVE-2025-45491 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-07T13:24:21.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/vuln03/blob/main/linksys/E5600/CI_ddnsStatus_DynDNS_username/CI_ddnsStatus_DynDNS_username.pdf - https://github.com/JZP018/vuln03/blob/main/linksys/E5600/CI_ddnsStatus_DynDNS_username/CI_ddnsStatus_DynDNS_username.py
CVE ID: CVE-2025-45492 State: PUBLISHED Published: 2025-05-06T00:00:00.000Z Last Updated: 2025-05-06T20:19:53.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JZP018/vuln03/blob/main/netgear/EX8000/cve-netgear_EX8000_CI_action_wireless.pdf - https://github.com/JZP018/vuln03/blob/main/netgear/EX8000/netgear_EX8000_CI_action_wireless.mp4
CVE ID: CVE-2025-45512 State: PUBLISHED Published: 2025-08-05T00:00:00.000Z Last Updated: 2025-08-07T21:17:53.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AzhariRamadhan/uboot-cve - https://gist.github.com/AzhariRamadhan/a5c9644861f46b1eadb1f2a15c7950fe
CVE ID: CVE-2025-45513 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-10T02:08:20.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.P2pListFilter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Eu21ka/cve_report/blob/master/The%20router%20Tenda%20FH451%20V1.0.0.9%20of%20Shenzhen%20Jixiang%20Tenda%20Technology%20Co.%2C%20Ltd.%20has%20a%20stack%20overflow%20vulnerability.md
CVE ID: CVE-2025-45514 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-12T18:36:24.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.frmL7ImForm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Eu21ka/cve_report/blob/master/The_router_Tenda_FH451_V1.0.0.9_of_Shenzhen_Jixiang_Tenda_Technology_Co.%2C_Ltd._has_a_stack_overflow_vulnerability_2.md
CVE ID: CVE-2025-45525 State: PUBLISHED Published: 2025-06-17T00:00:00.000Z Last Updated: 2025-08-26T18:51:45.895Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: asvd Products: microlight Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library fails to validate the result of a regular expression match before accessing its properties, leading to an uncaught TypeError and potential application crash. NOTE: this is disputed by multiple parties because there
ding to an uncaught TypeError and potential application crash. NOTE: this is disputed by multiple parties because there is no common scenario in which an adversary can insert those non-standard values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Rootingg/843368931f70886bed3cf982f10a4424 - https://github.com/github/advisory-database/pull/5730
CVE ID: CVE-2025-45526 State: PUBLISHED Published: 2025-06-17T00:00:00.000Z Last Updated: 2025-06-26T16:10:51.373Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: asvd Products: microlight Problem Types: CWE-770 Description: A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content (e.g., 100 million characters) is processed, the reset function in microlight.js consumes excessive memory and CPU resources, causing browser crashes or unre
cessed, the reset function in microlight.js consumes excessive memory and CPU resources, causing browser crashes or unresponsiveness. An attacker can exploit this vulnerability by tricking a user into visiting a malicious web page containing a microlight element with large content, resulting in a denial of service. NOTE: this is disputed by multiple parties because a large amount of memory and CPU resources is expected to be needed for content of that size. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Rootingg/483b09b760d031b62b172f2153f3ed2a - https://github.com/github/advisory-database/pull/5730
CVE ID: CVE-2025-45529 State: PUBLISHED Published: 2025-05-27T00:00:00.000Z Last Updated: 2025-05-27T20:21:20.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sec-Kode/cve/blob/main/cve2.md - https://gist.github.com/sec-Kode/000fbab6dc649888bc196e76a4076b57
CVE ID: CVE-2025-45542 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-03T16:03:33.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mathurvishal/CloudClassroom-PHP-Project - https://medium.com/@sanjay70023/cve-2025-45542-time-based-blind-sql-injection-in-cloudclassroom-php-project-v1-0-1fa0efc8a94a
CVE ID: CVE-2025-45582 State: PUBLISHED Published: 2025-07-11T00:00:00.000Z Last Updated: 2025-11-02T00:12:55.951Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L) Vendors: GNU Products: Tar Problem Types: CWE-24 Description: GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and ov
at begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than
g on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md - https://www.gnu.org/software/tar/ - https://www.gnu.org/software/
/github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md - https://www.gnu.org/software/tar/ - https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html - https://www.gnu.org/software/tar/manual/html_node/Integrity.html - https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
CVE ID: CVE-2025-45583 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T15:11:36.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the FTP protocol of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to authenticate into the service using any combination of username and password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE ID: CVE-2025-45584 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T15:11:31.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the web service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to download car information without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE ID: CVE-2025-45585 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T15:11:24.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the wifi_sta_ssid or wifi_ap_ssid parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE ID: CVE-2025-45586 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T15:11:18.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to arbitrarily overwrite files via supplying a crafted PUT request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE ID: CVE-2025-45587 State: PUBLISHED Published: 2025-09-12T00:00:00.000Z Last Updated: 2025-09-15T15:41:46.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow in the FTP service of Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732f8b9
CVE ID: CVE-2025-45607 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T14:01:35.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/michaelliao/itranswarp/issues/73
CVE ID: CVE-2025-45608 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T13:59:26.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zykzhangyukang/Xinguan/issues/26
CVE ID: CVE-2025-45609 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T13:57:14.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LianjiaTech/kob/issues/29
CVE ID: CVE-2025-45610 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T13:55:10.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jackson0714/PassJava-Platform/issues/48
CVE ID: CVE-2025-45611 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T13:53:00.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/java-aodeng/hope-boot/issues/86
CVE ID: CVE-2025-45612 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T13:51:22.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Exrick/xmall/issues/96
CVE ID: CVE-2025-45613 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T13:39:27.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zhaojun1998/Shiro-Action/issues/24
CVE ID: CVE-2025-45614 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:11:32.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lcw2004/one/issues/44
CVE ID: CVE-2025-45615 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:09:56.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/user-xiangpeng/yaoqishan/issues/29
CVE ID: CVE-2025-45616 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:08:10.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baidu/brcc/issues/194
CVE ID: CVE-2025-45617 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:06:42.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/megagao/production_ssm/issues/33
CVE ID: CVE-2025-45618 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-06T03:04:43.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive information via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/huangjian888/jeeweb-mybatis-springboot/issues/31
CVE ID: CVE-2025-45619 State: PUBLISHED Published: 2025-07-30T00:00:00.000Z Last Updated: 2025-07-30T19:02:51.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://aver.com - http://ptc310uv2.com - https://github.com/weedl/CVE-2025-45619
CVE ID: CVE-2025-45620 State: PUBLISHED Published: 2025-07-30T00:00:00.000Z Last Updated: 2025-07-30T19:00:49.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://aver.com - http://ptc310uv2.com - https://github.com/weedl/CVE-2025-45620
CVE ID: CVE-2025-45661 State: PUBLISHED Published: 2025-06-18T00:00:00.000Z Last Updated: 2025-06-18T14:29:31.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload into the id parameter at /members/edit.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ambiguous.aniyu.net/ - https://github.com/nekocari/miniTCG - https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-45661
CVE ID: CVE-2025-45662 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-11T17:52:18.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shinovon/mpgram-web - https://mp.nnchan.ru/login.php - https://github.com/J4cky1028/vulnerability-research/tree/main/CVE-2025-45662
CVE ID: CVE-2025-45663 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-04T16:51:18.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fysac/netsurf-disclosure/tree/main/CVE-2025-45663 - https://www.netsurf-browser.org/
CVE ID: CVE-2025-45702 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T19:47:46.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://softperfect.com - https://raw.githubusercontent.com/christiankold/Vulnerabilities/refs/heads/main/CVE-2025-45702
CVE ID: CVE-2025-45729 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T20:02:28.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kdev.site/2025/04/02/d-link-823_pro-unauthorized-telnet-access/
CVE ID: CVE-2025-45731 State: PUBLISHED Published: 2025-07-24T00:00:00.000Z Last Updated: 2025-07-24T19:40:24.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Bubka/2FAuth/security/advisories/GHSA-ph6w-q992-7qrx
CVE ID: CVE-2025-45737 State: PUBLISHED Published: 2025-06-27T00:00:00.000Z Last Updated: 2025-06-27T19:51:37.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to the NeacSafe64.sys component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/za233/NeacController
CVE ID: CVE-2025-45746 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-21T14:01:59.112Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: ZKTeco Products: ZKBio CVSecurity Problem Types: CWE-321 Description: In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.
the service console does not result in login access or data access in the context of the application software platform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2025-45746.md
CVE ID: CVE-2025-45751 State: PUBLISHED Published: 2025-05-05T00:00:00.000Z Last Updated: 2025-05-07T18:57:24.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Web Based Pharmacy Product Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add-admin.php via the Fullname text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/17883/web-based-product-alert-system.html - https://github.com/sw8y/vulnerability_research/blob/main/CVE-2025-45751/CVE-2025-45751.md
CVE ID: CVE-2025-45752 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-22T18:08:46.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Extension Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.simonjuguna.com/cve-2025-45752-authenticated-remote-code-execution-vulnerability-in-seeddms-v6-0-32/