deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7693
Published: 2025-08-18
Description: A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF015. To recover, clear the fault.
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1736.html
CVE: CVE-2025-43731
Published: 2025-08-18
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows an remote authenticated user to inject JavaScript in message board threads and categories.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43731
CVE: CVE-2025-32992
Published: 2025-08-18
Description: Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control.
CVSS Score: 8.5 (HIGH)
CWE: CWE-284
References: https://assets.thermofisher.com/TFS-Assets/CORP/Product-Guides/Thermo_Scientific_ePort_software.pdf; https://www.thermofisher.com/us/en/home/industrial/environmental/environmental-learning-center/environmental-resource-library/fast5-issues/iq-series-eport-versus-iport.html
CVE: CVE-2025-4371
Published: 2025-08-18
Description: A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitrary firmware updates to the device over a USB connection.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-347
References: https://support.lenovo.com/us/en/product_security/LEN-194466
CVE: CVE-2025-53192
Published: 2025-08-18
Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.

This issue affects Apache Commons OGNL: all versions.



When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,
 etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. 
Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.


NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-146
References: https://lists.apache.org/thread/2gj8tjl6vz949nnp3yxz3okm9xz2k7sp; http://www.openwall.com/lists/oss-security/2025/08/18/4
CVE: CVE-2025-55213
Published: 2025-08-18
Description: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( openfga-0.2.40 <= Helm chart <= openfga-0.2.41, v1.9.3 <= docker <= v.1.9.4) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This vulnerability is fixed in 1.9.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/openfga/openfga/commit/1a7e0e37fc4777c824b2386cac4867a66f3480b0; https://github.com/openfga/openfga/security/advisories/GHSA-mgh9-4mwp-fg55
CVE: CVE-2025-55584
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain insecure credentials for the telnet service and root account.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1391
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Telnet/PoC.md
CVE: CVE-2025-55585
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain an eval injection vulnerability via the eval() function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-95
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Eval%20Injection/PoC.md
CVE: CVE-2025-55586
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20BOF/formFilter%20PoC.md
CVE: CVE-2025-55587
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20BOF/formMapDelDevice%20PoC.md
CVE: CVE-2025-55588
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20BOF/formPortFw%20PoC.md
CVE: CVE-2025-55589
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters at /boafrm/formMapDelDevice.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%201.md
CVE: CVE-2025-55590
Published: 2025-08-18
Description: TOTOLINK A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain an command injection vulnerability via the component bupload.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%203.md
CVE: CVE-2025-55591
Published: 2025-08-18
Description: TOTOLINK-A3002R v4.0.0-B20[PII_REDACTED] was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/goldenGlow21/softwares_PoC/blob/main/A3002R_V4/Boa%20-%20Command%20Injection/PoC%202.md
CVE: CVE-2025-8098
Published: 2025-08-18
Description: An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://iknow.lenovo.com.cn/detail/430658
CVE: CVE-2025-41392
Published: 2025-08-18
Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE: CVE-2025-53705
Published: 2025-08-18
Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE: CVE-2025-9119
Published: 2025-08-18
Description: A vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Page. This manipulation of the argument SSID with the input <img/src/onerror=prompt(8)> causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.320456; https://vuldb.com/?id.320456; https://vuldb.com/?submit.628410
CVE: CVE-2025-46269
Published: 2025-08-18
Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE: CVE-2025-52584
Published: 2025-08-18
Description: In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01
CVE: CVE-2025-53948
Published: 2025-08-18
Description: The Sante PACS Server allows a remote attacker to crash the main thread by sending a crafted HL7 message, causing a denial-of-service condition. The application would require a manual restart and no authentication is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE: CVE-2025-54156
Published: 2025-08-18
Description: The Sante PACS Server Web Portal sends credential information without encryption.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319, CWE-522
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE: CVE-2025-54759
Published: 2025-08-18
Description: Sante PACS Server is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and stealing the user's cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE: CVE-2025-54862
Published: 2025-08-18
Description: Sante PACS Server web portal is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and stealing the user's cookie.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-224-01
CVE: CVE-2025-7496
Published: 2025-08-19
Description: The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including, 6.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340004%40woo-smart-compare&new=3340004%40woo-smart-compare&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c01f7892-5ca2-4bc8-91c2-dfebb685aff8?source=cve
CVE: CVE-2025-5417
Published: 2025-08-19
Description: An insufficient access control vulnerability was found in the Red Hat
Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the
rhdh/rhdh-hub-rhel9 container image and modify the image's content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-266
References: https://access.redhat.com/errata/RHSA-2025:14090; https://access.redhat.com/security/cve/CVE-2025-5417; https://bugzilla.redhat.com/show_bug.cgi?id=2369602
CVE: CVE-2025-8357
Published: 2025-08-19
Description: The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the _process_mla_download_file function in all versions up to, and including, 3.27. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server from the /wp-content/uploads/ directory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/media-library-assistant/tags/3.26/includes/class-mla-main.php#L924; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336915%40media-library-assistant&new=3336915%40media-library-assistant&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8726375f-de67-4c92-9cf8-1bfb7330f327?source=cve
CVE: CVE-2025-38553
Published: 2025-08-19
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: Restrict conditions for adding duplicating netems to qdisc tree

netem_enqueue's duplication prevention logic breaks when a netem
resides in a qdisc tree with other netems - this can lead to a
soft lockup and OOM loop in netem_dequeue, as seen in [1].
Ensure that a duplicating netem cannot exist in a tree with other
netems.

Previous approaches suggested in discussions in chronological order:

1) Track duplication status or ttl in the sk_buff struct. Considered
too specific a use case to extend such a struct, though this would
be a resilient fix and address other previous and potential future
DOS bugs like the one described in loopy fun [2].

2) Restrict netem_enqueue recursion depth like in act_mirred with a
per cpu variable. However, netem_dequeue can call enqueue on its
child, and the depth restriction could be bypassed if the child is a
netem.

3) Use the same approach as in 2, but add metadata in netem_skb_cb
to handle the netem_dequeue case and track a packet's involvement
in duplication. This is an overly complex approach, and Jamal
notes that the skb cb can be overwritten to circumvent this
safeguard.

4) Prevent the addition of a netem to a qdisc tree if its ancestral
path contains a netem. However, filters and actions can cause a
packet to change paths when re-enqueued to the root from netem
duplication, leading us to the current solution: prevent a
duplicating netem from inhabiting the same tree as other netems.

[1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/
[2] https://lwn.net/Articles/719297/
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/09317dfb681ac5a96fc69bea0c54441cf91b8270; https://git.kernel.org/stable/c/103c4e27ec9f5fe53022e46e976abf52c7221baf; https://git.kernel.org/stable/c/250f8796006c0f2bc638ce545f601d49ae8d528b
CVE: CVE-2025-6758
Published: 2025-08-19
Description: The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779; https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b24858-dfcd-46f3-9552-c7acc63a1ee7?source=cve
CVE: CVE-2025-8218
Published: 2025-08-19
Description: The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://themeforest.net/item/real-spaces-wordpress-real-estate-theme/8219779; https://www.wordfence.com/threat-intel/vulnerabilities/id/2d07880b-9af1-4b1e-aa70-b95ef10a6e33?source=cve
CVE: CVE-2025-7654
Published: 2025-08-19
Description: Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make privilege escalation possible.

Please note both FunnelKit – Funnel Builder for WooCommerce Checkout AND FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce are affected by this.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.11.0.2/woofunnels/includes/class-bwf-data-tags.php#L52; https://plugins.trac.wordpress.org/browser/wp-marketing-automations/tags/3.6.3/woofunnels/includes/class-bwf-data-tags.php#L52; https://www.wordfence.com/threat-intel/vulnerabilities/id/bc0983d7-6c7e-41cb-8997-578d362d9c9f?source=cve
CVE: CVE-2025-7670
Published: 2025-08-19
Description: The JS Archive List plugin for WordPress is vulnerable to time-based SQL Injection via the build_sql_where() function in all versions up to, and including, 6.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/Skatox/jquery-archive-list/commit/1c4a5749b187cc65d2c4b192b9c9890a36bf1fd2; https://plugins.trac.wordpress.org/browser/jquery-archive-list-widget/tags/6.1.5/classes/class-jq-archive-list-datasource.php; https://plugins.trac.wordpress.org/changeset/3341291/
CVE: CVE-2025-8622
Published: 2025-08-19
Description: The Flexible Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flexible Maps shortcode in all versions up to, and including, 1.18.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/webaware/flexible-map/commit/1cbae2fa98e10c82d82a68e2bacfbdb7231117db; https://plugins.trac.wordpress.org/changeset/3341890/; https://wordpress.org/plugins/wp-flexible-map/#developers
CVE: CVE-2025-8723
Published: 2025-08-19
Description: The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary PHP into the codebase, achieving remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/3337593/; https://plugins.trac.wordpress.org/changeset/3341917/; https://wordpress.org/plugins/cf-image-resizing/#developers
CVE: CVE-2025-41685
Published: 2025-08-19
Description: A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-359
References: https://certvde.com/en/advisories/VDE-2025-050
CVE: CVE-2025-41689
Published: 2025-08-19
Description: An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://certvde.com/en/advisories/VDE-2025-067
CVE: CVE-2025-8567
Published: 2025-08-19
Description: The Nexter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3342664/; https://wordpress.org/plugins/the-plus-addons-for-block-editor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/ca9ad8ca-aad1-4950-b540-64ffc4a07c12?source=cve
CVE: CVE-2025-8783
Published: 2025-08-19
Description: The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title’ parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/contact-manager/trunk/admin-pages-functions.php#L524; https://plugins.trac.wordpress.org/changeset/3345750/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e52a487-8e87-49b7-a044-9fb8452f3dd1?source=cve
CVE: CVE-2025-9134
Published: 2025-08-19
Description: A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper export of android application components. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and replied: "After reviewing your report, we have confirmed that this vulnerability does indeed exist and we are actively working to fix it."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md; https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce; https://vuldb.com/?ctiid.320514
CVE: CVE-2025-9135
Published: 2025-08-19
Description: A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1(258) on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 12.1.2(259) is sufficient to resolve this issue. Upgrading the affected component is recommended. The vendor was contacted early and fixed the issue by "[r]emoving the task affinity of the app so it can't be copied".
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md; https://github.com/KMov-g/androidapps/blob/main/de.hafas.android.vvt.md#steps-to-reproduce; https://vuldb.com/?ctiid.320515