deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46430
Published: 2025-11-10
Description: Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the Installer. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-250
References: https://www.dell.com/support/kbdoc/en-us/000384546/dsa-2025-411
CVE: CVE-2025-63152
Published: 2025-11-10
Description: Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the wpapsk_crypto parameter of the wlSetExternParameter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/4/1.md
CVE: CVE-2025-63153
Published: 2025-11-10
Description: TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/6/1.md
CVE: CVE-2025-63154
Published: 2025-11-10
Description: TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/TOTOLINK/A7000/4/1.md
CVE: CVE-2025-63147
Published: 2025-11-10
Description: Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/5/1.md
CVE: CVE-2025-63455
Published: 2025-11-10
Description: Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/6/1.md
CVE: CVE-2025-63456
Published: 2025-11-10
Description: Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/3/1.md
CVE: CVE-2025-63457
Published: 2025-11-10
Description: Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the sub_4F55C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/1/1.md
CVE: CVE-2025-63497
Published: 2025-11-10
Description: The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vulnerability. The pat_number GET parameter is directly concatenated into SQL queries without proper sanitization, allowing authenticated attackers (doctor role) to execute arbitrary SQL queries.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://github.com/cristibtz/security-research/blob/main/CVE-2025-63497/report.md; https://github.com/cristibtz/security-research/tree/main/rickxy-Hospital-Management-System
CVE: CVE-2025-63834
Published: 2025-11-10
Description: A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/wifiset_ssid_xss/README.md
CVE: CVE-2025-63835
Published: 2025-11-10
Description: A stack-based buffer overflow vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the guestSsid parameter of the /goform/WifiGuestSet interface. Remote attackers can exploit this vulnerability by sending oversized data to the guestSsid parameter, leading to denial of service (device crash) or potential remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-121
References: https://github.com/babraink/cve_report/blob/main/cve_report/tenda/tendaAC18/2_wifiguest_guestssid_overflow/README.md
CVE: CVE-2025-12967
Published: 2025-11-10
Description: An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

We recommend customers upgrade to the following versions: AWS JDBC Wrapper to v2.6.5, AWS Go Wrapper to 2025-10-17, AWS NodeJS Wrapper to v2.0.1, AWS Python Wrapper to v1.4.0 and AWS PGSQL ODBC driver to v1.0.1
CVSS Score: 8.0 (HIGH)
CWE: CWE-470
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-028/; https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2025-10-17; https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9
CVE: CVE-2025-43079
Published: 2025-11-10
Description: The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-426
References: https://www.qualys.com/security-advisories/cve-2025-43079
CVE: CVE-2025-43723
Published: 2025-11-10
Description: Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000390206/dsa-2025-381-security-update-for-dell-powerscale-onefs-multiple-vulnerabilities
CVE: CVE-2025-47286
Published: 2025-11-10
Description: Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on it.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://github.com/Combodo/iTop/security/advisories/GHSA-4w93-rw6g-5m9c
CVE: CVE-2025-47773
Published: 2025-11-10
Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-9qmf-5457-9xp3
CVE: CVE-2025-63288
Published: 2025-11-10
Description: In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/open5gs/open5gs/commit/be765fe2b03e350836272eee5afb3931bdfb86d5; https://github.com/open5gs/open5gs/issues/4087
CVE: CVE-2025-12428
Published: 2025-11-10
Description: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/447613211
CVE: CVE-2025-12429
Published: 2025-11-10
Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/450618029
CVE: CVE-2025-12430
Published: 2025-11-10
Description: Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/442860743
CVE: CVE-2025-12431
Published: 2025-11-10
Description: Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/436887350
CVE: CVE-2025-12432
Published: 2025-11-10
Description: Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/439522866
CVE: CVE-2025-12433
Published: 2025-11-10
Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 4.3 (MEDIUM)
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/449760249
CVE: CVE-2025-12434
Published: 2025-11-10
Description: Race in Storage in Google Chrome on Windows prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/337356054
CVE: CVE-2025-12435
Published: 2025-11-10
Description: Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-451
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/446463993
CVE: CVE-2025-12436
Published: 2025-11-10
Description: Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-306
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/40054742
CVE: CVE-2025-12437
Published: 2025-11-10
Description: Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/446294487
CVE: CVE-2025-12438
Published: 2025-11-10
Description: Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/433027577
CVE: CVE-2025-12439
Published: 2025-11-10
Description: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/382234536
CVE: CVE-2025-12440
Published: 2025-11-10
Description: Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/430555440
CVE: CVE-2025-12441
Published: 2025-11-10
Description: Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/444049512
CVE: CVE-2025-12443
Published: 2025-11-10
Description: Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/452071845
CVE: CVE-2025-12444
Published: 2025-11-10
Description: Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-306
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/390571618
CVE: CVE-2025-12445
Published: 2025-11-10
Description: Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/428397712
CVE: CVE-2025-12446
Published: 2025-11-10
Description: Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/444932667
CVE: CVE-2025-12447
Published: 2025-11-10
Description: Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-306
References: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html; https://issues.chromium.org/issues/442636157
CVE: CVE-2025-12725
Published: 2025-11-10
Description: Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/443906252
CVE: CVE-2025-12726
Published: 2025-11-10
Description: Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 7.5 (HIGH)
CWE: CWE-269
References: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/447172715
CVE: CVE-2025-12727
Published: 2025-11-10
Description: Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/454485895
CVE: CVE-2025-12728
Published: 2025-11-10
Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/452392032
CVE: CVE-2025-12729
Published: 2025-11-10
Description: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/454354281
CVE: CVE-2025-33150
Published: 2025-11-10
Description: IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://www.ibm.com/support/pages/node/7250395
CVE: CVE-2025-47932
Published: 2025-11-10
Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting  when a dashboard is rendered via an AJAX call. Versions 2.7.13 and 3.2.2 sanitize the var responsible for the attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-rmxq-fx69-7wg5
CVE: CVE-2025-56503
Published: 2025-11-10
Description: An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Administrator via replacing the uninstall file with a crafted binary in the installation folder. NOTE: this is disputed by the Supplier because replacing the uninstall file requires administrator permissions, i.e., there is no privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://drive.google.com/file/d/1QDi9_RKJO-Gi_8jkHJKi7QV1Tajqh4WT/view?usp=sharing; https://drive.google.com/file/d/1aP4S-WdFUL9ocNOucioIqxOgzreZ6Ey7/view?usp=sharing; https://github.com/secxplorers/CVE-2025-56503
CVE: CVE-2025-60876
Published: 2025-11-10
Description: BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092; https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm; https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm
CVE: CVE-2025-63149
Published: 2025-11-10
Description: Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-3/3/1.md
CVE: CVE-2025-63384
Published: 2025-11-10
Description: A vulnerability was discovered in RISC-V Rocket-Chip v1.6 and before implementation where the SRET (Supervisor-mode Exception Return) instruction fails to correctly transition the processor's privilege level. Instead of downgrading from Machine-mode (M-mode) to Supervisor-mode (S-mode) as specified by the sstatus.SPP bit, the processor incorrectly remains in M-mode, leading to a critical privilege retention vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://github.com/107040503/RISC-V-Vulnerability-Disclosure_SRET; https://github.com/chipsalliance/rocket-chip.git
CVE: CVE-2025-48055
Published: 2025-11-10
Description: Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-684h-f39j-5gq8
CVE: CVE-2025-48065
Published: 2025-11-10
Description: Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-292c-hgcf-2g22
CVE: CVE-2025-48878
Published: 2025-11-10
Description: Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/Combodo/iTop/security/advisories/GHSA-rj75-7cgw-4556
CVE: CVE-2025-63296
Published: 2025-11-10
Description: KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anyka_service.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/t4e-3/082cdd0b7ee6b650c7aaae97fd4e016c; https://github.com/t4e-3/CVE-2025-63296