deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6108
Published: 2025-06-16
Description: A vulnerability was found in hansonwang99 Spring-Boot-In-Action up to 807fd37643aa774b94fd004cc3adbd29ca17e9aa. It has been declared as critical. Affected by this vulnerability is the function watermarkTest of the file /springbt_watermark/src/main/java/cn/codesheep/springbt_watermark/service/ImageUploadService.java of the component File Upload. The manipulation of the argument filename leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-01.md; https://vuldb.com/?ctiid.312577; https://vuldb.com/?id.312577
CVE: CVE-2025-6109
Published: 2025-06-16
Description: A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulation of the argument artifactId leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md; https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250607-02.md#steps-to-reproduce; https://vuldb.com/?ctiid.312578
CVE: CVE-2025-6110
Published: 2025-06-16
Description: A vulnerability classified as critical has been found in Tenda FH1201 1.2.0.14(408). This affects an unknown part of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-FH1201-fromSafeUrlFilter-20b53a41781f80bc8687e3887f536120?source=copy_link; https://vuldb.com/?ctiid.312579; https://vuldb.com/?id.312579
CVE: CVE-2025-6111
Published: 2025-06-16
Description: A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromVirtualSer-20b53a41781f809180a7d46f12f0417f?source=copy_link; https://vuldb.com/?ctiid.312580; https://vuldb.com/?id.312580
CVE: CVE-2025-6169
Published: 2025-06-16
Description: The WIMP website co-construction management platform from HAMASTAR Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10184-f29ca-2.html; https://www.twcert.org.tw/tw/cp-132-10183-99ce1-1.html
CVE: CVE-2025-4987
Published: 2025-06-16
Description: A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2025-6112
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7. This issue affects the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-FH1205-fromadvsetlanip-20b53a41781f80bf850ff39f88ad7f2b?source=copy_link; https://vuldb.com/?ctiid.312581; https://vuldb.com/?id.312581
CVE: CVE-2025-6113
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. Affected is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-FH1203-fromadvsetlanip-20b53a41781f8070bc65ffadd1ed6bf1?source=copy_link; https://vuldb.com/?ctiid.312582; https://vuldb.com/?id.312582
CVE: CVE-2025-2091
Published: 2025-06-16
Description: An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://empower.m-files.com/security-advisories/CVE-2025-2091; https://product.m-files.com/security-advisories/cve-2025-2091
CVE: CVE-2025-3464
Published: 2025-06-16
Description: A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass.
Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CWE: CWE-367
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2150; https://www.asus.com/content/asus-product-security-advisory/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2150
CVE: CVE-2025-40726
Published: 2025-06-16
Description: Reflected Cross-Site Scripting (XSS) vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-reflected-nosto
CVE: CVE-2025-40727
Published: 2025-06-16
Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-phoenix-cms
CVE: CVE-2025-40728
Published: 2025-06-16
Description: SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-customer-support-system
CVE: CVE-2025-40729
Published: 2025-06-16
Description: Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-customer-support-system
CVE: CVE-2025-6114
Published: 2025-06-16
Description: A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this vulnerability is the function form_portforwarding of the file /goform/form_portforwarding. The manipulation of the argument ingress_name_%d/sched_name_%d/name_%d leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_60/60.md#poc; https://vuldb.com/?ctiid.312583
CVE: CVE-2025-6115
Published: 2025-06-16
Description: A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. Affected by this issue is the function form_macfilter. The manipulation of the argument mac_hostname_%d/sched_name_%d leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md; https://github.com/wudipjq/my_vuln/blob/main/D-Link6/vuln_62/62.md#poc; https://vuldb.com/?ctiid.312584
CVE: CVE-2025-6172
Published: 2025-06-16
Description: Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://security.tecno.com/SRC/blogdetail/424?lang=en_US; https://security.tecno.com/SRC/securityUpdates
CVE: CVE-2025-25264
Published: 2025-06-16
Description: An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-942
References: https://certvde.com/en/advisories/VDE-2025-018/
CVE: CVE-2025-25265
Published: 2025-06-16
Description: A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-306
References: https://certvde.com/en/advisories/VDE-2025-018/
CVE: CVE-2025-6116
Published: 2025-06-16
Description: A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been classified as critical. This affects an unknown part of the file /IntraFieldVehicle/Search of the component API. The manipulation of the argument Value leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E5%81%9C%E8%BD%A6%E5%9C%BA%E7%B3%BB%E7%BB%9FIntraFieldVehicle-Search.md; https://vuldb.com/?ctiid.312585; https://vuldb.com/?id.312585
CVE: CVE-2025-6117
Published: 2025-06-16
Description: A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been declared as critical. This vulnerability affects unknown code of the file /Reservations/Search of the component API. The manipulation of the argument Value leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E5%81%9C%E8%BD%A6%E5%9C%BA%E7%B3%BB%E7%BB%9FReservations-Search.md; https://vuldb.com/?ctiid.312586; https://vuldb.com/?id.312586
CVE: CVE-2025-40916
Published: 2025-06-16
Description: Mojolicious::Plugin::CaptchaPNG version 1.05 for Perl uses a weak random number source for generating the captcha.

That version uses the built-in rand() function for generating the captcha text as well as image noise, which is insecure.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-338, CWE-804
References: https://metacpan.org/pod/perlfunc#rand; https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.04/diff/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.05/lib/Mojolicious/Plugin/CaptchaPNG.pm; https://metacpan.org/release/GRYPHON/Mojolicious-Plugin-CaptchaPNG-1.06/changes
CVE: CVE-2025-47868
Published: 2025-06-16
Description: Out-of-bounds Write resulting in possible Heap-based Buffer Overflow vulnerability was discovered in tools/bdf-converter font conversion utility that is part of Apache NuttX RTOS repository. This standalone program is optional and neither part of NuttX RTOS nor Applications runtime, but active bdf-converter users may be affected when this tool is exposed to external provided user data data (i.e. publicly available automation).

This issue affects Apache NuttX: from 6.9 before 12.9.0.

Users are recommended to upgrade to version 12.9.0, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: https://github.com/apache/nuttx/pull/16000; https://lists.apache.org/thread/p4o2lcqgspx3ws1n2p4wmoqbqow1w1pw; http://www.openwall.com/lists/oss-security/2025/06/14/1
CVE: CVE-2025-47869
Published: 2025-06-16
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability was discovered in Apache NuttX RTOS apps/exapmles/xmlrpc application. In this example application device stats structure that stored remotely provided parameters had hardcoded buffer size which could lead to buffer overflow. Structure members buffers were updated to valid size of CONFIG_XMLRPC_STRINGSIZE+1.

This issue affects Apache NuttX RTOS users that may have used or base their code on example application as presented in releases from 6.22 before 12.9.0.

Users of XMLRPC in Apache NuttX RTOS are advised to review their code 
for this pattern and update buffer sizes as presented in the version of 
the example in release 12.9.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/apache/nuttx-apps/pull/3027; https://lists.apache.org/thread/306qcqyc3bpb2ozh015yxjo9kqs4jbvj; http://www.openwall.com/lists/oss-security/2025/06/14/2
CVE: CVE-2025-4748
Published: 2025-06-16
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.

This issue affects OTP from OTP 17.0 until OTP 28.0.1, OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4.
CWE: CWE-22
References: https://cna.erlef.org/cves/CVE-2025-4748.html; https://github.com/erlang/otp/commit/578d4001575aa7647ea1efd4b2b7e3afadcc99a5; https://github.com/erlang/otp/commit/5a55feec10c9b69189d56723d8f237afa58d5d4f
CVE: CVE-2025-6118
Published: 2025-06-16
Description: A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been rated as critical. This issue affects some unknown processing of the file /vehicle/search of the component API. The manipulation of the argument vehicleTypeCode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E5%81%9C%E8%BD%A6%E5%9C%BA%E7%B3%BB%E7%BB%9Fvehicle-search.md; https://vuldb.com/?ctiid.312587; https://vuldb.com/?id.312587
CVE: CVE-2025-6119
Published: 2025-06-16
Description: A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHLoader::ReadNodeChannels in the library assimp/code/AssetLib/BVH/BVHLoader.cpp. The manipulation of the argument pNode leads to use after free. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://github.com/assimp/assimp/issues/6219; https://github.com/assimp/assimp/issues/6219#issuecomment[PII_REDACTED]; https://github.com/user-attachments/files/20604791/reproduce_2.tar.gz
CVE: CVE-2025-24388
Published: 2025-06-16
Description: A vulnerability in the OTRS Admin Interface and Agent Interface (versions before OTRS 8) allow parameter injection due to for an autheniticated agent or admin user.

This issue affects: 

  *  OTRS 7.0.X

  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X
  *  OTRS 2025.X

  *  ((OTRS)) Community Edition: 6.0.x

Products based on the ((OTRS)) Community Edition also very likely to be affected
CVSS Score: 3.8 (LOW)
CWE: CWE-184
References: https://otrs.com/release-notes/otrs-security-advisory-2025-06/
CVE: CVE-2025-46710
Published: 2025-06-16
Description: Possible kernel exceptions caused by reading and writing kernel heap data after free.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-5689
Published: 2025-06-16
Description: A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session.
CVSS Score: 8.5 (HIGH)
CWE: CWE-269
References: https://github.com/ubuntu/authd/security/advisories/GHSA-g8qw-mgjx-rwjr
CVE: CVE-2025-6120
Published: 2025-06-16
Description: A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function read_meshes in the library assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/issues/6220; https://github.com/assimp/assimp/issues/6220#issuecomment[PII_REDACTED]; https://github.com/user-attachments/files/20605340/read_meshes_reproduce.tar.gz
CVE: CVE-2025-6121
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content of the component HTTP POST Request Handler. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content; https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir632-dlink-get_pure_content#poc; https://vuldb.com/?ctiid.312590
CVE: CVE-2025-6122
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, was found in code-projects Restaurant Order System 1.0. This affects an unknown part of the file /table.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/ez-lbz/poc/issues/3; https://vuldb.com/?ctiid.312591
CVE: CVE-2025-6123
Published: 2025-06-16
Description: A vulnerability has been found in code-projects Restaurant Order System 1.0 and classified as critical. This vulnerability affects unknown code of the file /payment.php. The manipulation of the argument tabidNoti leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/ez-lbz/poc/issues/1; https://vuldb.com/?ctiid.312592
CVE: CVE-2025-36632
Published: 2025-06-16
Description: In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.tenable.com/security/tns-2025-11
CVE: CVE-2025-3602
Published: 2025-06-16
Description: Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3602
CVE: CVE-2025-6124
Published: 2025-06-16
Description: A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. This issue affects some unknown processing of the file /tablelow.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/ez-lbz/poc/issues/4; https://vuldb.com/?ctiid.312593
CVE: CVE-2025-6125
Published: 2025-06-16
Description: A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/aboutus.php. The manipulation of the argument pagedes leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/kakalalaww/CVE/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.312594
CVE: CVE-2025-3526
Published: 2025-06-16
Description: SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsupported versions does not restrict the saving of request parameters in the HTTP session, which allows remote attackers to consume system memory leading to denial-of-service (DoS) conditions via crafted HTTP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3526
CVE: CVE-2025-3594
Published: 2025-06-16
Description: Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3594
CVE: CVE-2025-48976
Published: 2025-06-16
Description: Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.

This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.

Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12; http://www.openwall.com/lists/oss-security/2025/06/16/4; https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html