deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9797
Published: 2025-09-01
Description: A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 2.4 (LOW)
CWE: CWE-74, CWE-707
References: https://github.com/mrvautin/expressCart/issues/288; https://github.com/mrvautin/expressCart/issues/288#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322112
CVE: CVE-2025-9799
Published: 2025-09-01
Description: A security flaw has been discovered in Langfuse up to 3.88.0. Affected by this vulnerability is the function promptChangeEventSourcing of the file web/src/features/prompts/server/routers/promptRouter.ts of the component Webhook Handler. Performing manipulation results in server-side request forgery. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://github.com/langfuse/langfuse/issues/8522; https://github.com/langfuse/langfuse/issues/8522#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322114
CVE: CVE-2025-9800
Published: 2025-09-01
Description: A weakness has been identified in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. Affected by this issue is the function Import of the file apps/sim/app/api/files/upload/route.ts of the component HTML File Parser. Executing manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called 45372aece5e05e04b[PII_REDACTED]16a52e90ba174. A patch should be applied to remediate this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/simstudioai/sim/commit/45372aece5e05e04b[PII_REDACTED]16a52e90ba174; https://github.com/simstudioai/sim/issues/958; https://github.com/simstudioai/sim/issues/958#issue[PII_REDACTED]
CVE: CVE-2025-9801
Published: 2025-09-01
Description: A security vulnerability has been detected in SimStudioAI sim up to ed9b9ad83f1a7c61f4392787fb51837d34eeb0af. This affects an unknown part. The manipulation of the argument filePath leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 45372aece5e05e04b[PII_REDACTED]16a52e90ba174. To fix this issue, it is recommended to deploy a patch.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/simstudioai/sim/commit/45372aece5e05e04b[PII_REDACTED]16a52e90ba174; https://github.com/simstudioai/sim/issues/959; https://github.com/simstudioai/sim/issues/959#issue[PII_REDACTED]
CVE: CVE-2025-9802
Published: 2025-09-02
Description: A vulnerability was detected in RemoteClinic 2.0. This vulnerability affects unknown code of the file /staff/profile.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/03hice-collab/CVE/issues/3; https://vuldb.com/?ctiid.322117; https://vuldb.com/?id.322117
CVE: CVE-2025-57808
Published: 2025-09-02
Description: ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-303
References: https://github.com/esphome/esphome/commit/2aceb56606ec8afec5f49c92e140c8050a6ccbe5; https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635; https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635
CVE: CVE-2025-58161
Published: 2025-09-02
Description: MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9; https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v
CVE: CVE-2025-58162
Published: 2025-09-02
Description: MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9; https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3
CVE: CVE-2025-58178
Published: 2025-09-02
Description: SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to the action are treated as shell expressions, allowing potential execution of arbitrary commands. A fix has been released in SonarQube Scan GitHub Action 5.3.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://community.sonarsource.com/t/security-advisory-sonarqube-scanner-github-action/147696; https://github.com/SonarSource/sonarqube-scan-action/commit/016cabf33a6b7edf0733e179a03ad408ad4e88ba; https://github.com/SonarSource/sonarqube-scan-action/pull/200
CVE: CVE-2025-9805
Published: 2025-09-02
Description: A vulnerability was found in SimStudioAI sim up to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2. This issue affects some unknown processing of the file apps/sim/app/api/proxy/image/route.ts. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 3424a338b763115f0269b209e777608e4cd31785. Applying a patch is advised to resolve this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/simstudioai/sim/commit/3424a338b763115f0269b209e777608e4cd31785; https://github.com/simstudioai/sim/issues/1128; https://github.com/simstudioai/sim/issues/1128#issue[PII_REDACTED]
CVE: CVE-2025-9806
Published: 2025-09-02
Description: A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded credentials. The attack can only be executed locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 1.9 (LOW)
CWE: CWE-259, CWE-798
References: https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md; https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e9.md#steps-to-reproduce; https://vuldb.com/?ctiid.322130
CVE: CVE-2025-8662
Published: 2025-09-02
Description: OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM: from 14.0.0 through 14.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://openam-jp.github.io/Advisories/CVE-2025-8662/
CVE: CVE-2025-9811
Published: 2025-09-02
Description: A vulnerability was found in Campcodes Farm Management System 1.0. This affects an unknown part of the file /reviewInput.php. Performing manipulation of the argument rating results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhaodaojie/cve/issues/10; https://vuldb.com/?ctiid.322138; https://vuldb.com/?id.322138
CVE: CVE-2025-9812
Published: 2025-09-02
Description: A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/csgii/cve/issues/1; https://vuldb.com/?ctiid.322139; https://vuldb.com/?id.322139
CVE: CVE-2025-9813
Published: 2025-09-02
Description: A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/csgii/cve/issues/2; https://vuldb.com/?ctiid.322140; https://vuldb.com/?id.322140
CVE: CVE-2025-9814
Published: 2025-09-02
Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/contact-us.php. The manipulation of the argument mobnumber results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/dad-zm/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.322141
CVE: CVE-2025-9815
Published: 2025-09-02
Description: A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-306, CWE-306
References: https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md; https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-concepts; https://vuldb.com/?ctiid.322142
CVE: CVE-2025-41690
Published: 2025-09-02
Description: A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
CVSS Score: 7.4 (HIGH)
CWE: CWE-532
References: https://certvde.com/en/advisories/VDE-2025-068
CVE: CVE-2025-44017
Published: 2025-09-02
Description: "Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT (JSON Web Token).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201
References: https://jvn.jp/en/jp/JVN47404248/
CVE: CVE-2025-41030
Published: 2025-09-02
Description: Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TInnova_v2/Integrantes_Recurso_v2_1/llamadaAjax/buscarPersona’ using the ‘dni’ parameter.
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-deporsite-t-innova
CVE: CVE-2025-41031
Published: 2025-09-02
Description: Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other users' profile pictures via a POST request using the parameters ‘IdPersona’ and “Foto” in ‘/ajax/TInnova_c/FotoUsuario/llamadaAjax/uploadImage’.
CWE: CWE-863
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-deporsite-t-innova
CVE: CVE-2025-9573
Published: 2025-09-02
Description: The ns_backup extension through 13.0.2 for TYPO3 allows command injection.
CWE: CWE-78
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-011
CVE: CVE-2024-12972
Published: 2025-09-02
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft OctoCloud allows Cross-Site Scripting (XSS).This issue affects OctoCloud: from s1.09.01 before v1.11.01.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0203
CVE: CVE-2024-12973
Published: 2025-09-02
Description: Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing.This issue affects OctoCloud: from s1.09.01 before v1.11.01.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-346
References: https://www.usom.gov.tr/bildirim/tr-25-0203
CVE: CVE-2024-52284
Published: 2025-09-02
Description: Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
CVSS Score: 7.7 (HIGH)
CWE: CWE-312
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284; https://github.com/advisories/GHSA-6h9x-9j5v-7w9h
CVE: CVE-2024-58259
Published: 2025-09-02
Description: A vulnerability has been identified within Rancher Manager in which it 
did not enforce request body size limits on certain public 
(unauthenticated) and authenticated API endpoints. This allows a 
malicious user to exploit this by sending excessively large payloads, 
which are fully loaded into memory during processing, leading to Denial of Service (DoS).
CVSS Score: 8.2 (HIGH)
CWE: CWE-770
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-58259; https://github.com/rancher/rancher/security/advisories/GHSA-4h45-jpvh-6p5j
CVE: CVE-2025-0640
Published: 2025-09-02
Description: Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure.This issue affects OctoCloud: from s1.09.02 before v1.11.01.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0203
CVE: CVE-2025-2414
Published: 2025-09-02
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass.This issue affects OctoCloud: from s1.09.03 before v1.11.01.
CVSS Score: 8.6 (HIGH)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0203
CVE: CVE-2025-46810
Published: 2025-09-02
Description: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.29.
CWE: CWE-61
References: https://bugzilla.suse.com/show_bug.cgi?id=1245204
CVE: CVE-2025-52543
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-836
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52544
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52545
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52546
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can inject a stored XSS to the floorplan web page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-434
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52547
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52548
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the underlying OS.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-1242
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52549
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52550
Published: 2025-09-02
Description: E3 Site Supervisor Control (firmware version < 2.31F01) firmware upgrade packages are unsigned. An attacker can forge malicious firmware upgrade packages. An attacker with admin access to the application services can install a malicious firmware upgrade.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-52551
Published: 2025-09-02
Description: E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in the file system.
CWE: CWE-306
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2025-56254
Published: 2025-09-02
Description: PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details of other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/rishb0/CVEs-Assigned/blob/main/CVE-2025-56254.md
CVE: CVE-2025-57140
Published: 2025-09-02
Description: rsbi-pom 4.7 is vulnerable to SQL Injection in the /bi/service/model/DatasetService path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/line2222/vuln/issues/5; https://github.com/ruisibi/rsbi-pom
CVE: CVE-2025-5662
Published: 2025-09-02
Description: A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d; https://huntr.com/bounties/057a743b-b2ec-4312-8262-ce0ff8bc161c
CVE: CVE-2025-6519
Published: 2025-09-02
Description: E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password. An attacker can predictably generate the password for ONEDAY. The oneday user cannot be deleted or modified by any user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.armis.com/research/frostbyte10/
CVE: CVE-2024-12974
Published: 2025-09-02
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft ProKuaför allows Cross-Site Scripting (XSS).This issue affects ProKuaför: from s1.02.07 before v1.02.08.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0204
CVE: CVE-2025-0670
Published: 2025-09-02
Description: Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure.This issue affects ProKuafor: from s1.02.07 before v1.02.08.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0204
CVE: CVE-2025-2413
Published: 2025-09-02
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass.This issue affects ProKuafor: from s1.02.08 before v1.02.08.
CVSS Score: 8.6 (HIGH)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0204
CVE: CVE-2025-46047
Published: 2025-09-02
Description: A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/J0ey17/Silverpeas-Username-Enumeration-PoC; https://github.com/Silverpeas/Silverpeas-Core/pull/1399
CVE: CVE-2025-9784
Published: 2025-09-02
Description: A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-404
References: https://access.redhat.com/errata/RHSA-2025:23143; https://access.redhat.com/errata/RHSA-2026:0383; https://access.redhat.com/errata/RHSA-2026:0384
CVE: CVE-2024-48705
Published: 2025-09-02
Description: Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "set_sys_adm" function of the "adm.cgi" binary, and is due to improper santization of the user provided "newpass" field
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://wavlink.com; https://github.com/L41KAA/CVE-2024-48705