Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9237 State: PUBLISHED Published: 2025-08-20T17:32:08.708Z Last Updated: 2025-08-20T18:50:38.214Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: CodeAstro Products: Ecommerce Website Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_account of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
motely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320770 - https://vuldb.com/?ctiid.320770 - https://vuldb.com/?submit.631136 - https://gist.github.com/0xSebin/bb6781e5977bda36610fda20861a5bbe - https://gist.github.com/0xSebin/bb6781e5977bda36610fda20861a5bbe#steps-to-reproduce - https://codeastro.com/
CVE ID: CVE-2025-9238 State: PUBLISHED Published: 2025-08-20T18:02:06.312Z Last Updated: 2025-08-20T18:36:13.359Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Swatadru Products: Exam-Seating-Arrangement Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in Swatadru Exam-Seating-Arrangement up to 97335ccebf95468d92525f4255a2241d2b0b002f. Affected is an unknown function of the file /student.php of the component Student Login. Executing manipulation of the argument email can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of r
h the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320771 - https://vuldb.com/?ctiid.320771 - https://vuldb.com/?submit.631142 - https://gist.github.com/0xSebin/81ce7a296b4220db5ebfdb22fa78c3b3 - https://gist.github.com/0xSebin/81ce7a296b4220db5ebfdb22fa78c3b3#steps-to-reproduce
CVE ID: CVE-2025-9239 State: PUBLISHED Published: 2025-08-20T18:02:08.454Z Last Updated: 2025-08-20T18:46:33.829Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R) Vendors: elunez Products: eladmin Problem Types: CWE-326, CWE-310 Description: A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The manipulation of the argument STR_PARAM with the input Passw0rd leads to inadequate encryption strength. The attack can be initiated remotely. The attack is considered to have high complexi
to inadequate encryption strength. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320772 - https://vuldb.com/?ctiid.320772 - https://vuldb.com/?submit.631393 - https://github.com/elunez/eladmin/issues/884
CVE ID: CVE-2025-9240 State: PUBLISHED Published: 2025-08-20T18:32:06.364Z Last Updated: 2025-08-20T18:54:39.582Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: elunez Products: eladmin Problem Types: CWE-200, CWE-284 Description: A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320773 - https://vuldb.com/?ctiid.32
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320773 - https://vuldb.com/?ctiid.320773 - https://vuldb.com/?submit.631424 - https://github.com/elunez/eladmin/issues/885 - https://github.com/elunez/eladmin/issues/885#issue-3307153708
CVE ID: CVE-2025-9241 State: PUBLISHED Published: 2025-08-20T19:32:05.488Z Last Updated: 2025-08-20T20:21:38.082Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: elunez Products: eladmin Problem Types: CWE-1236, CWE-74 Description: A weakness has been identified in elunez eladmin up to 2.7. This affects the function exportUser. This manipulation causes csv injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320774 - https://vuldb.com/?ctiid.320774 - https://vuldb.com/?submit.631473 - https://github.com/elu
tps://vuldb.com/?id.320774 - https://vuldb.com/?ctiid.320774 - https://vuldb.com/?submit.631473 - https://github.com/elunez/eladmin/issues/886 - https://github.com/elunez/eladmin/issues/886#issue-3307309824
CVE ID: CVE-2025-9242 State: PUBLISHED Published: 2025-09-17T07:29:23.738Z Last Updated: 2025-11-14T22:30:31.226Z Vendors: WatchGuard Products: Fireware OS Problem Types: CWE-787 Description: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psi
12.11.3 and 2025.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015
CVE ID: CVE-2025-9243 State: PUBLISHED Published: 2025-10-04T02:24:36.330Z Last Updated: 2025-10-06T14:16:47.715Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: stylemix Products: Cost Calculator Builder Problem Types: CWE-862 Description: The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status. Additional Analyst Notes: - CISA ADP Vu
access and above, to access order management functions and modify order status. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa46bdb3-6bbe-4f2f-8e1a-fbb54c5b39fd?source=cve - https://plugins.trac.wordpress.org/changeset/3371684/cost-calculator-builder#file388 - https://plugins.trac.wordpress.org/changeset/3371684/cost-calculator-builder#file389
CVE ID: CVE-2025-9244 State: PUBLISHED Published: 2025-08-20T19:32:08.090Z Last Updated: 2025-08-20T20:16:52.674Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-78, CWE-77 Description: A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function addStaticRoute of the file /goform/addStaticRoute. Such manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting/staticR
gument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting/staticRoute_destType_setting leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320775 - https://vuldb.com/?ctiid.320775 - https://vuldb.com/?submit.631517 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_11/11.md - https://www.linksys.com/
CVE ID: CVE-2025-9245 State: PUBLISHED Published: 2025-08-20T20:02:06.507Z Last Updated: 2025-08-20T20:28:52.492Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This issue affects the function WPSSTAPINEnr of the file /goform/WPSSTAPINEnr. Performing manipulation of the argument ssid results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used
in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320776 - https://vuldb.com/?ctiid.320776 - https://vuldb.com/?submit.631518 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_14/14.md - https://www.linksys.com/
CVE ID: CVE-2025-9246 State: PUBLISHED Published: 2025-08-20T20:02:08.900Z Last Updated: 2025-08-20T20:27:15.340Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Impacted is the function check_port_conflict of the file /goform/check_port_conflict. Executing manipulation of the argument single_port_rule/port_range_rule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been pu
le/port_range_rule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320777 - https://vuldb.com/?ctiid.320777 - https://vuldb.com/?submit.631519 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_15/15.md - https://www.linksys.com/
CVE ID: CVE-2025-9247 State: PUBLISHED Published: 2025-08-20T20:32:06.545Z Last Updated: 2025-08-21T14:48:36.379Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. The affected element is the function setVlan of the file /goform/setVlan. The manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public
-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320778 - https://vuldb.com/?ctiid.320778 - https://vuldb.com/?submit.631520 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_16/16.md - https://www.linksys.com/
CVE ID: CVE-2025-9248 State: PUBLISHED Published: 2025-08-20T21:02:06.039Z Last Updated: 2025-08-21T14:48:29.940Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. The impacted element is the function RP_pingGatewayByBBS of the file /goform/RP_pingGatewayByBBS. The manipulation of the argument ssidhex results in stack-based buffer overflow. The attack may be performed from a remote location. The exploit has been mad
hex results in stack-based buffer overflow. The attack may be performed from a remote location. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320779 - https://vuldb.com/?ctiid.320779 - https://vuldb.com/?submit.631521 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_17/17.md - https://www.linksys.com/
CVE ID: CVE-2025-9249 State: PUBLISHED Published: 2025-08-20T21:02:08.236Z Last Updated: 2025-08-21T14:48:24.205Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function DHCPReserveAddGroup of the file /goform/DHCPReserveAddGroup. This manipulation of the argument enable_group/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. Th
oup/name_group/ip_group/mac_group causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320780 - https://vuldb.com/?ctiid.320780 - https://vuldb.com/?submit.631522 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_18/18.md - https://www.linksys.com/
CVE ID: CVE-2025-9250 State: PUBLISHED Published: 2025-08-20T21:32:06.411Z Last Updated: 2025-08-21T14:48:17.998Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This impacts the function setPWDbyBBS of the file /goform/setPWDbyBBS. Such manipulation of the argument hint leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The
buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320781 - https://vuldb.com/?ctiid.320781 - https://vuldb.com/?submit.631523 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_19/19.md - https://www.linksys.com/
CVE ID: CVE-2025-9251 State: PUBLISHED Published: 2025-08-20T22:02:06.683Z Last Updated: 2025-08-21T14:47:48.174Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A security flaw has been discovered in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function sta_wps_pin of the file /goform/sta_wps_pin. Performing manipulation of the argument Ssid results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may
stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320782 - https://vuldb.com/?ctiid.320782 - https://vuldb.com/?submit.631524 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_20/20.md - https://www.linksys.com/
CVE ID: CVE-2025-9252 State: PUBLISHED Published: 2025-08-20T22:02:09.003Z Last Updated: 2025-08-21T14:47:42.019Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A weakness has been identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function DisablePasswordAlertRedirect of the file /goform/DisablePasswordAlertRedirect. Executing manipulation of the argument hint can lead to stack-based buffer overflow. The attack can be launched remotely. Th
uting manipulation of the argument hint can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320783 - https://vuldb.com/?ctiid.320783 - https://vuldb.com/?submit.631525 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_21/21.md - https://www.linksys.com/
CVE ID: CVE-2025-9253 State: PUBLISHED Published: 2025-08-20T22:32:06.493Z Last Updated: 2025-08-21T14:47:34.751Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Linksys Products: RE6250, RE6300, RE6350, RE6500, RE7000, RE9000 Problem Types: CWE-121, CWE-119 Description: A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RP_doSpecifySiteSurvey of the file /goform/RP_doSpecifySiteSurvey. The manipulation of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has
tion of the argument ssidhex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320784 - https://vuldb.com/?ctiid.320784 - https://vuldb.com/?submit.631526 - https://github.com/wudipjq/my_vuln/blob/main/Linksys/vuln_22/22.md - https://www.linksys.com/
CVE ID: CVE-2025-9254 State: PUBLISHED Published: 2025-08-22T11:21:29.444Z Last Updated: 2025-08-22T11:42:27.784Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Uniong Products: WebITR Problem Types: CWE-306 Description: WebITR developed by Uniong has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to log into the system as arbitrary users by exploiting a specific functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html - https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html
CVE ID: CVE-2025-9255 State: PUBLISHED Published: 2025-08-22T11:25:34.673Z Last Updated: 2025-08-22T11:43:11.075Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Uniong Products: WebITR Problem Types: CWE-89 Description: WebITR developed by Uniong has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html - https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html
CVE ID: CVE-2025-9256 State: PUBLISHED Published: 2025-08-22T11:34:04.022Z Last Updated: 2025-08-22T11:44:47.272Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Uniong Products: WebITR Problem Types: CWE-36 Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html - https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html
CVE ID: CVE-2025-9257 State: PUBLISHED Published: 2025-08-22T11:41:36.824Z Last Updated: 2025-08-22T13:34:36.241Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Uniong Products: WebITR Problem Types: CWE-36 Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html - https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html
CVE ID: CVE-2025-9258 State: PUBLISHED Published: 2025-08-22T11:43:44.536Z Last Updated: 2025-08-22T13:31:36.972Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Uniong Products: WebITR Problem Types: CWE-36 Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html - https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html
CVE ID: CVE-2025-9259 State: PUBLISHED Published: 2025-08-22T11:46:53.952Z Last Updated: 2025-08-22T13:30:26.939Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Uniong Products: WebITR Problem Types: CWE-36 Description: WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10328-dbc35-1.html - https://www.twcert.org.tw/en/cp-139-10329-a1c5d-2.html
CVE ID: CVE-2025-9260 State: PUBLISHED Published: 2025-09-02T23:22:45.796Z Last Updated: 2025-09-03T18:57:31.656Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: techjewel Products: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Problem Types: CWE-502 Description: The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP