deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7597
Published: 2025-07-14
Description: A vulnerability classified as critical has been found in Tenda AX1803 1.0.0.1. Affected is the function formSetMacFilterCfg of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/panda666-888/vuls/blob/main/tenda/ax1803/formSetMacFilterCfg.md; https://github.com/panda666-888/vuls/blob/main/tenda/ax1803/formSetMacFilterCfg.md#poc; https://vuldb.com/?ctiid.316296
CVE: CVE-2025-7598
Published: 2025-07-14
Description: A vulnerability classified as critical was found in Tenda AX1803 1.0.0.1. Affected by this vulnerability is the function formSetWifiMacFilterCfg of the file /goform/setWifiFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/panda666-888/vuls/blob/main/tenda/ax1803/formSetWifiMacFilterCfg.md; https://github.com/panda666-888/vuls/blob/main/tenda/ax1803/formSetWifiMacFilterCfg.md#poc; https://vuldb.com/?ctiid.316297
CVE: CVE-2025-7618
Published: 2025-07-14
Description: A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerability to inject malicious scripts into the applications, which may then access cookies or other sensitive information retained by the browser and used with the affected applications.
Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier, and Text Editor 1.0.0.r112 and earlier.
CWE: CWE-79
References: https://www.asustor.com/security/security_advisory_detail?id=45
CVE: CVE-2025-7599
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected by this issue is some unknown functionality of the file /invoice.php. The manipulation of the argument del leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/139; https://phpgurukul.com/; https://vuldb.com/?ctiid.316298
CVE: CVE-2025-7600
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Online Library Management System 3.0. This affects an unknown part of the file /admin/student-history.php. The manipulation of the argument stdid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/141; https://phpgurukul.com/; https://vuldb.com/?ctiid.316299
CVE: CVE-2025-7601
Published: 2025-07-14
Description: A vulnerability has been found in PHPGurukul Online Library Management System 3.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/student-history.php. The manipulation of the argument stdid leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/f1rstb100d/myCVE/issues/142; https://phpgurukul.com/; https://vuldb.com/?ctiid.316300
CVE: CVE-2025-7602
Published: 2025-07-14
Description: A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/XiDP0/MyCVE/blob/main/CVE/D-Link%20DI_8100-16.07.26A1/arp_sys_asp/arp_sys_asp.md; https://vuldb.com/?ctiid.316301; https://vuldb.com/?id.316301
CVE: CVE-2025-27582
Published: 2025-07-14
Description: The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts to restrict privileged actions by overriding the native window.print() function. However, this protection can be bypassed by an attacker who accesses the Password Self-Service site from the lock screen and navigates to an attacker-controlled webpage via the Help function. By hosting a crafted web page with JavaScript, the attacker can restore and invoke the window.print() function, launching a SYSTEM-privileged print dialog. From this dialog, the attacker can exploit standard Windows functionality - such as the Print to PDF or Add Printer wizard - to spawn a command prompt with SYSTEM privileges. Successful exploitation allows a local attacker (with access to a locked workstation) to gain SYSTEM-level privileges, granting full control over the affected device.
CVSS Score: 7.6 (HIGH)
CWE: CWE-829
References: https://www.cyberis.com/article/password-manager-privilege-escalation; https://www.cyberis.com/article/password-manager-privilege-escalation
CVE: CVE-2025-7603
Published: 2025-07-14
Description: A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. Affected is an unknown function of the file /jingx.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/XiDP0/MyCVE/blob/main/CVE/D-Link%20DI_8100-16.07.26A1/jingx_asp/D-Link%20DI_8100-16.07.26A1%20jingx_asp.md; https://vuldb.com/?ctiid.316302; https://vuldb.com/?id.316302
CVE: CVE-2025-7604
Published: 2025-07-14
Description: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /user-login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/143; https://phpgurukul.com/; https://vuldb.com/?ctiid.316303
CVE: CVE-2025-7605
Published: 2025-07-14
Description: A vulnerability was found in code-projects AVL Rooms 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument first_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/sunhuiHi666/cve/issues/2; https://vuldb.com/?ctiid.316304
CVE: CVE-2025-7606
Published: 2025-07-14
Description: A vulnerability classified as critical has been found in code-projects AVL Rooms 1.0. This affects an unknown part of the file /city.php. The manipulation of the argument city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/sunhuiHi666/cve/issues/1; https://vuldb.com/?ctiid.316305
CVE: CVE-2025-7519
Published: 2025-07-14
Description: A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/security/cve/CVE-2025-7519; https://bugzilla.redhat.com/show_bug.cgi?id=2379675; https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245
CVE: CVE-2025-7607
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, has been found in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Customers/save_order.php. The manipulation of the argument order_price leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/20; https://vuldb.com/?ctiid.316307
CVE: CVE-2025-7608
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, was found in code-projects Simple Shopping Cart 1.0. Affected is an unknown function of the file /userlogin.php. The manipulation of the argument user_email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/19; https://vuldb.com/?ctiid.316308
CVE: CVE-2025-7609
Published: 2025-07-14
Description: A vulnerability has been found in code-projects Simple Shopping Cart 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument ruser_email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/18; https://vuldb.com/?ctiid.316309
CVE: CVE-2025-7610
Published: 2025-07-14
Description: A vulnerability was found in code-projects Electricity Billing System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user/change_password.php. The manipulation of the argument new_password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/17; https://vuldb.com/?ctiid.316310
CVE: CVE-2025-50756
Published: 2025-07-14
Description: Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WN535K3/set_sys_adm_newpass/readme.md
CVE: CVE-2025-7611
Published: 2025-07-14
Description: A vulnerability was found in code-projects Wedding Reservation 1.0. It has been classified as critical. This affects an unknown part of the file /global.php. The manipulation of the argument lu leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/16; https://vuldb.com/?ctiid.316311
CVE: CVE-2025-7612
Published: 2025-07-14
Description: A vulnerability was found in code-projects Mobile Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/21; https://vuldb.com/?ctiid.316312
CVE: CVE-2025-7613
Published: 2025-07-14
Description: A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md; https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md#poc; https://vuldb.com/?ctiid.316313
CVE: CVE-2025-7614
Published: 2025-07-14
Description: A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md; https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md#poc; https://vuldb.com/?ctiid.316314
CVE: CVE-2025-7615
Published: 2025-07-14
Description: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/ElvisBlue/Public/blob/main/Vuln/6.md; https://github.com/ElvisBlue/Public/blob/main/Vuln/6.md#poc; https://vuldb.com/?ctiid.316315
CVE: CVE-2025-7616
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, has been found in gmg137 snap7-rs up to 1.142.1. Affected by this issue is the function pthread_cond_destroy of the component Public API. The manipulation leads to memory corruption. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://gitee.com/gmg137/snap7-rs/issues/ICBIOB; https://vuldb.com/?ctiid.316316; https://vuldb.com/?id.316316
CVE: CVE-2024-42646
Published: 2025-07-14
Description: A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/nanomq/nanomq; https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42646.md
CVE: CVE-2024-42648
Published: 2025-07-14
Description: NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-122
References: https://github.com/nanomq/nanomq; https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42648.md
CVE: CVE-2024-42649
Published: 2025-07-14
Description: NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://github.com/nanomq/nanomq; https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42649.md
CVE: CVE-2025-51650
Published: 2025-07-14
Description: An arbitrary file upload vulnerability in the component /controller/PicManager.php of FoxCMS v1.2.6 allows attackers to execute arbitrary code via uploading a crafted template file.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-77
References: https://github.com/Y4y17/Foxcms/blob/main/Foxcms%20%3C%3D%20v1.2.6%20RCE.md
CVE: CVE-2025-51651
Published: 2025-07-14
Description: An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-598
References: https://github.com/Y4y17/CVE/blob/main/Arbitrary%20file%20download%20vulnerability.md
CVE: CVE-2025-51652
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_1.md; https://www.sem-cms.com/
CVE: CVE-2025-51653
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_2.md; https://www.sem-cms.com/
CVE: CVE-2025-51654
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_3.md; https://www.sem-cms.com/
CVE: CVE-2025-51655
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_4.md; https://www.sem-cms.com/
CVE: CVE-2025-51656
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_5.md; https://www.sem-cms.com/
CVE: CVE-2025-51657
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_6.md; https://www.sem-cms.com/
CVE: CVE-2025-51658
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_7.md; https://www.sem-cms.com/
CVE: CVE-2025-51659
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_8.md; https://www.sem-cms.com/
CVE: CVE-2025-51660
Published: 2025-07-14
Description: SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://semcms.com; https://github.com/Y4y17/CVE/blob/main/SemCms/SQL_Injection_9.md; https://www.sem-cms.com/
CVE: CVE-2025-7625
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/12; https://vuldb.com/?ctiid.316326; https://vuldb.com/?id.316326
CVE: CVE-2025-7626
Published: 2025-07-14
Description: A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/13; https://vuldb.com/?ctiid.316327; https://vuldb.com/?id.316327
CVE: CVE-2025-52363
Published: 2025-07-14
Description: Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative access
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://cybermaya.in/posts/Post-39/; https://www.tendacn.com/product/download/cp3pro.html
CVE: CVE-2025-53014
Published: 2025-07-14
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-125, CWE-193
References: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hm4x-r5hc-794f; https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html
CVE: CVE-2025-7627
Published: 2025-07-14
Description: A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue is the function fileUpload of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/14; https://vuldb.com/?ctiid.316328; https://vuldb.com/?id.316328
CVE: CVE-2025-7628
Published: 2025-07-14
Description: A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. It has been classified as critical. This affects the function deleteFile of the file /deleteFile. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/YiJiuSmile/kkFileViewOfficeEdit/issues/15; https://vuldb.com/?ctiid.316329; https://vuldb.com/?id.316329
CVE: CVE-2025-53015
Published: 2025-07-14
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0, infinite lines occur when writing during a specific XMP file conversion command. Version 7.1.2-0 fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://drive.google.com/file/d/1iegkwlTjqnJTtM4XkiheYsjKsC6pxtId/view?usp=sharing; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmhh-8rxq-fp9g