deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-43756
Published: 2025-08-21
Description: <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43756
CVE: CVE-2025-55521
Published: 2025-08-21
Description: An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/akaunting/akaunting; https://github.com/vityuasd/VulList/blob/main/vul_2.md; https://nvd.nist.gov/vuln/detail/CVE-2021-36802
CVE: CVE-2025-55522
Published: 2025-08-21
Description: Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/akaunting/akaunting/tree/3.1.18; https://github.com/vityuasd/VulList/blob/main/vul_1.md
CVE: CVE-2025-57754
Published: 2025-08-21
Description: eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-260
References: https://github.com/kristoferfannar/eslint-ban-moment/commit/bc2d2f9d23e6ae961a23e0d769e0722870b11108; https://github.com/kristoferfannar/eslint-ban-moment/security/advisories/GHSA-2486-4cjg-pw98
CVE: CVE-2025-57755
Published: 2025-08-21
Description: claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data. The issue has been patched in v1.0.34.
CWE: CWE-200, CWE-942
References: https://github.com/musistudio/claude-code-router/security/advisories/GHSA-8hmm-4crw-vm2c
CVE: CVE-2025-57761
Published: 2025-08-21
Description: WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulnerability in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.4.10.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://github.com/LabRedesCefetRJ/WeGIA/commit/baec5c70620b05a09b130a94db8216e3bfe7e4ce; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxwc-r5m4-hj62; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxwc-r5m4-hj62
CVE: CVE-2025-57762
Published: 2025-08-21
Description: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.4.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/fb1ab404c564e4dce32796b4b68cd192731207f3; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-494r-43f3-p828; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-494r-43f3-p828
CVE: CVE-2025-57763
Published: 2025-08-21
Description: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the insere_despacho.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the cpf sccs. This vulnerability is fixed in 3.4.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-67w3-jf96-f754; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-67w3-jf96-f754
CVE: CVE-2025-57764
Published: 2025-08-21
Description: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/4e9a1c170a495eb8a8433052de19990d355cb098; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qx7f-q867-cgx2; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qx7f-q867-cgx2
CVE: CVE-2025-57765
Published: 2025-08-21
Description: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the pre_cadastro_adotante.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/4e9a1c170a495eb8a8433052de19990d355cb098; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-39r5-c63f-99mx; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-39r5-c63f-99mx
CVE: CVE-2025-6465
Published: 2025-08-21
Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to sanitize file names which allows users with file upload permission to overwrite file attachment thumbnails via path traversal in file streaming APIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://mattermost.com/security-updates
CVE: CVE-2025-7969
Published: 2025-08-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/renderer.mjs.

This issue affects markdown-it: 14.1.0. NOTE: the Supplier does not consider this issue to be a vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/fito; https://github.com/markdown-it/markdown-it; https://github.com/markdown-it/markdown-it/issues/1122
CVE: CVE-2025-8402
Published: 2025-08-21
Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476, CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-9309
Published: 2025-08-21
Description: A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing manipulation results in hard-coded credentials. The attack needs to be approached locally. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made public and could be used.
CVSS Score: 2.5 (LOW)
CWE: CWE-259, CWE-798
References: https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC10/V4.0si_V16.03.10.13.md; https://github.com/XXRicardo/iot-cve/blob/main/Tenda/AC10/V4.0si_V16.03.10.13.md#steps-to-reproduce; https://vuldb.com/?ctiid.320914
CVE: CVE-2025-9310
Published: 2025-08-21
Description: A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d[PII_REDACTED]63980301d6f99866b3. Affected by this vulnerability is an unknown functionality of the file /carRental_war/druid/login.html of the component Druid. Executing manipulation can lead to hard-coded credentials. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-259, CWE-798, CWE-798
References: https://github.com/caigo8/CVE-md/blob/main/carRentalV1.0/druid%E6%9C%AA%E6%8E%88%E6%9D%83.md; https://vuldb.com/?ctiid.320915; https://vuldb.com/?id.320915
CVE: CVE-2025-9311
Published: 2025-08-21
Description: A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /fair/addfair.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/42; https://itsourcecode.com/; https://vuldb.com/?ctiid.320916
CVE: CVE-2024-50641
Published: 2025-08-21
Description: An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://github.com/RacerZ-fighting/CVE-vulns/blob/main/PandoraNext-TokensTool-Vuln.md
CVE: CVE-2025-43754
Published: 2025-08-21
Description: Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43754
CVE: CVE-2025-52351
Published: 2025-08-21
Description: Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL (e.g., https://domain.com/activate=xyz). This practice can result in password exposure via browser history, proxy logs, referrer headers, and email caching. The vulnerability impacts user credential confidentiality during initial onboarding.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319
References: https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve3-activation-link-password.md; https://www.aikaan.io
CVE: CVE-2025-52352
Published: 2025-08-21
Description: Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to register accounts via APIs even when the feature is disabled. This leads to authentication bypass and unauthorized access to admin portals, violating intended access controls.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/Shubhangborkar/aikaan-vulnerabilities/blob/main/cve4-signup-api-bypass.md; https://www.aikaan.io
CVE: CVE-2025-55523
Published: 2025-08-21
Description: An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/agent0ai/agent-zero/issues/687; https://github.com/frdel/agent-zero/blob/v0.8.7/python/api/download_work_dir_file.py; https://www.cve.org/CVERecord?id=CVE-2025-6166
CVE: CVE-2025-55524
Published: 2025-08-21
Description: Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://github.com/frdel/agent-zero/blob/v0.8.7/python/api/restart.py; https://github.com/vityuasd/VulList/blob/main/vul_3.md
CVE: CVE-2025-57768
Published: 2025-08-21
Description: Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Planned Hours field when creating a new project. When sending a POST request to /issues/new/, the value provided in the Planned Hours field is included in the server response without any HTML encoding or sanitization. Because of this, an attacker can craft a malicious payload such as <script>alert(1)</script> and include it in the planned_hours parameter. The server reflects the input directly in the HTML of the project creation page, causing the browser to interpret and execute it. This vulnerability is fixed in 1.8.3.
CWE: CWE-79
References: https://github.com/Alanaktion/phproject/security/advisories/GHSA-mhhg-qx37-g369
CVE: CVE-2025-7051
Published: 2025-08-21
Description: On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2025.2_Release_Notes.htm
CVE: CVE-2025-38742
Published: 2025-08-21
Description: Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://www.dell.com/support/kbdoc/en-us/000359617/dsa-2025-311-security-update-for-dell-idrac-service-module-vulnerabilities
CVE: CVE-2025-38743
Published: 2025-08-21
Description: Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-805
References: https://www.dell.com/support/kbdoc/en-us/000359617/dsa-2025-311-security-update-for-dell-idrac-service-module-vulnerabilities
CVE: CVE-2025-57751
Published: 2025-08-21
Description: pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk parameter verification, the jk parameter input by the user is directly determined as dykpy.evaljs(), resulting in the server CPU being fully occupied and the web-ui becoming unresponsive. This vulnerability is fixed in 0.5.0b3.dev92.
CWE: CWE-400
References: https://github.com/pyload/pyload/security/advisories/GHSA-9gjj-6gj7-c4wj
CVE: CVE-2010-10015
Published: 2025-08-21
Description: AOL versions up to and including 9.5 includes an ActiveX control (Phobos.dll) that exposes a method called Import() via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attackers to execute arbitrary code in the context of the user, but only when the malicious HTML file is opened locally, due to the control not being marked safe for scripting or initialization. AOL remains an active and supported brand offering services like AOL Mail and AOL Desktop Gold, but the legacy AOL 9.5 desktop software—specifically the version containing the vulnerable Phobos.dll ActiveX control—is long discontinued and no longer maintained.
CWE: CWE-121
References: http://www.exploit-db.com/exploits/11190; https://appdb.winehq.org/objectManager.php?sClass=version&iId=20354; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/aol_phobos_bof.rb
CVE: CVE-2010-20109
Published: 2025-08-21
Description: Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerability in the view_help.cgi endpoint. The locale parameter fails to properly sanitize user input, allowing attackers to inject traversal sequences and null-byte terminators to access arbitrary files on the underlying system. By exploiting this flaw, unauthenticated remote attackers can retrieve sensitive configuration files such as /mail/snapshot/config.snapshot, potentially exposing credentials, internal settings, and other critical data.
CWE: CWE-22
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb; https://web.archive.org/web/[PII_REDACTED]1244/http://secunia.com/advisories/41609/; https://www.exploit-db.com/exploits/15130
CVE: CVE-2010-20111
Published: 2025-08-21
Description: Digital Music Pad v8.2.3.3.4 contains a stack-based buffer overflow vulnerability in its playlist file parser. When opening a .pls file containing an excessively long string in the File1 field, the application fails to properly validate input length, resulting in corruption of the Structured Exception Handler (SEH) on the stack. This flaw may allow an attacker to control execution flow when the file is opened, potentially leading to arbitrary code execution.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/digital_music_pad_pls.rb; https://web.archive.org/web/[PII_REDACTED]4433/http://secunia.com:80/advisories/41519; https://www.exploit-db.com/exploits/15134
CVE: CVE-2010-20112
Published: 2025-08-21
Description: Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments
CWE: CWE-121
References: https://advisories.checkpoint.com/defense/advisories/public/2013/cpai-2013-1344.html; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/amlibweb_webquerydll_app.rb; https://www.amlib.co.uk/product/product.aspx?menuId=top_products
CVE: CVE-2010-20119
Published: 2025-08-21
Description: CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll  and AOSMTP.dll  ActiveX controls, specifically within the AddAttachments() method. This method fails to properly validate the length of input strings, allowing data to exceed the bounds of a fixed-size stack buffer. When invoked with an overly long string, the control can corrupt adjacent memory structures, including exception handlers, leading to potential control flow disruption.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/browser/communicrypt_mail_activex.rb; https://softwarelode.com/4185/details-communicrypt-mail.html; https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=24374
CVE: CVE-2010-20121
Published: 2025-08-21
Description: EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb; https://seclists.org/bugtraq/2010/Feb/202
CVE: CVE-2025-24489
Published: 2025-08-21
Description: An attacker could exploit this vulnerability by uploading arbitrary 
files via a specific service, which could lead to system compromise.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01
CVE: CVE-2025-27714
Published: 2025-08-21
Description: An attacker could exploit this vulnerability by uploading arbitrary 
files via the a specific endpoint, leading to unauthorized remote code 
execution or system compromise.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01
CVE: CVE-2025-27721
Published: 2025-08-21
Description: Unauthorized users can access INFINITT PACS System Manager without proper authorization, 
which could lead to unauthorized access to system resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01
CVE: CVE-2025-3128
Published: 2025-08-21
Description: A remote unauthenticated attacker who has bypassed authentication could 
execute arbitrary OS commands to disclose, tamper with, destroy or 
delete information in Mitsubishi Electric smartRTU, or cause a denial-of
 service condition on the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://emea.mitsubishielectric.com/fa/products/quality/quality-news-information; https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09
CVE: CVE-2025-41415
Published: 2025-08-21
Description: The vulnerability, if exploited, could allow an authenticated miscreant 
(with privileges to access publication targets) to retrieve sensitive 
information that could then be used to gain additional access to 
downstream resources.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2025-004.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-04
CVE: CVE-2025-51989
Published: 2025-08-21
Description: HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "keresztnév" (firstname) field, which will be sent out in an email resulting in possible Phishing scenarios against any, previously not registered, email address.
CVSS Score: 7.0 (HIGH)
CWE: CWE-80
References: http://evolution.com; http://hrmaster.com; https://github.com/Apor/Vulnerabilities/tree/main/CVE-2025-51989
CVE: CVE-2025-53763
Published: 2025-08-21
Description: Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53763
CVE: CVE-2025-53795
Published: 2025-08-21
Description: Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53795