deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13415
Published: 2025-11-19
Description: A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/icret/EasyImages2.0/issues/260; https://vuldb.com/?ctiid.332940; https://vuldb.com/?id.332940
CVE: CVE-2025-13420
Published: 2025-11-19
Description: A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventStore.php. This manipulation of the argument eventSubject causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f14g-orz/CVE/issues/8; https://itsourcecode.com/; https://vuldb.com/?ctiid.332942
CVE: CVE-2025-13421
Published: 2025-11-19
Description: A security vulnerability has been detected in itsourcecode Human Resource Management System 1.0. Impacted is an unknown function of the file /src/store/NoticeStore.php. Such manipulation of the argument noticeDesc leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f14g-orz/CVE/issues/9; https://itsourcecode.com/; https://vuldb.com/?ctiid.332943
CVE: CVE-2025-4042
Published: 2025-11-19
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-13422
Published: 2025-11-20
Description: A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file /dashboard/admin/change_s_pwd.php. Performing manipulation of the argument login_id results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f14g-orz/CVE/issues/10; https://vuldb.com/?ctiid.332944; https://vuldb.com/?id.332944
CVE: CVE-2025-13423
Published: 2025-11-20
Description: A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Abxery/cveee/issues/6; https://vuldb.com/?ctiid.332945; https://vuldb.com/?id.332945
CVE: CVE-2025-13424
Published: 2025-11-20
Description: A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulation of the argument txtProductName leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/arpcyber070/CVE/issues/3; https://vuldb.com/?ctiid.332946; https://vuldb.com/?id.332946
CVE: CVE-2025-0643
Published: 2025-11-20
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Stored XSS.This issue affects Pyxis Signage: through 31012025.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0404
CVE: CVE-2025-0645
Published: 2025-11-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Pyxis Signage: through 31012025.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-25-0404
CVE: CVE-2025-11676
Published: 2025-11-20
Description: Improper input validation vulnerability in TP-Link System Inc. TL-WR940N V6 (UPnP modules), which allows unauthenticated adjacent attackers to perform DoS attack. This issue affects TL-WR940N V6 <= Build 220801.
CWE: CWE-20
References: https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware; https://www.tp-link.com/en/support/faq/4755/; https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware
CVE: CVE-2025-12414
Published: 2025-11-20
Description: An attacker could take over a Looker account in a Looker instance configured with OIDC authentication, due to email address string normalization.Looker-hosted and Self-hosted were found to be vulnerable.

This issue has already been mitigated for Looker-hosted.


Self-hosted instances must be upgraded as soon as possible. This vulnerability has been patched in all supported versions of Self-hosted.
The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page   https://download.looker.com/ :
  *  24.12.100+
  *  24.18.193+
  *  25.0.69+
  *  25.6.57+
  *  25.8.39+
  *  25.10.22+
  *  25.12.0+
CWE: CWE-290
References: https://cloud.google.com/support/bulletins#GCP-2025-067
CVE: CVE-2025-12502
Published: 2025-11-20
Description: The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks
CVSS Score: 6.8 (MEDIUM)
References: https://wpscan.com/vulnerability/75e63134-4c8a-45fd-b7fc-db40644ddb8c/; https://wpscan.com/vulnerability/75e63134-4c8a-45fd-b7fc-db40644ddb8c/
CVE: CVE-2025-12778
Published: 2025-11-20
Description: The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_filter_users function in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to extract partial metadata of all WordPress users, including their first name, last name and email addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3397029/ultimate-member-widgets-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/a917a24b-09cc-48e9-844a-e1ed573a708f?source=cve
CVE: CVE-2025-13433
Published: 2025-11-20
Description: A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. The attack is only possible with local access. A high complexity level is associated with this attack. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-428
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/Musehub.md; https://vuldb.com/?ctiid.332977; https://vuldb.com/?id.332977
CVE: CVE-2025-13434
Published: 2025-11-20
Description: A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the component HTTP Host Header Handler. This manipulation of the argument $_SERVER['HOST'] causes improper neutralization of http headers for scripting syntax. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-644
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/hush.md; https://vuldb.com/?ctiid.332978; https://vuldb.com/?id.332978
CVE: CVE-2025-13435
Published: 2025-11-20
Description: A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-22
References: https://github.com/Xzzz111/exps/blob/main/archives/Resty-PathTraversal-01/cve_application.md; https://vuldb.com/?ctiid.332979; https://vuldb.com/?id.332979
CVE: CVE-2025-13442
Published: 2025-11-20
Description: A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/alc9700jmo/CVE/issues/20; https://vuldb.com/?ctiid.333015; https://vuldb.com/?id.333015
CVE: CVE-2025-13443
Published: 2025-11-20
Description: A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/Hwwg/cve/issues/15; https://vuldb.com/?ctiid.333016; https://vuldb.com/?id.333016
CVE: CVE-2025-13445
Published: 2025-11-20
Description: A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN7.md; https://vuldb.com/?ctiid.333017; https://vuldb.com/?id.333017
CVE: CVE-2025-13446
Published: 2025-11-20
Description: A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN8.md; https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN9.md; https://vuldb.com/?ctiid.333018
CVE: CVE-2025-13449
Published: 2025-11-20
Description: A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument Password results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/xiaojuzirr/cve/issues/3; https://vuldb.com/?ctiid.333019
CVE: CVE-2025-13450
Published: 2025-11-20
Description: A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of the argument f_name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/xiaojuzirr/cve/issues/5; https://vuldb.com/?ctiid.333020; https://vuldb.com/?id.333020
CVE: CVE-2025-13451
Published: 2025-11-20
Description: A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiaojuzirr/cve/issues/4; https://vuldb.com/?ctiid.333021; https://vuldb.com/?id.333021
CVE: CVE-2025-13468
Published: 2025-11-20
Description: A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://hackmd.io/@mlgzackfly/SourceCodester; https://vuldb.com/?ctiid.333041; https://vuldb.com/?id.333041
CVE: CVE-2025-13469
Published: 2025-11-20
Description: A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument manualInstructions leads to cross site scripting. The attack can be initiated remotely. You should upgrade the affected component.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/pkp/pkp-lib/issues/12022; https://github.com/pkp/pkp-lib/issues/12022#event[PII_REDACTED]0; https://github.com/pkp/pkp-lib/issues/12022#event[PII_REDACTED]0
CVE: CVE-2025-40601
Published: 2025-11-20
Description: A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0016
CVE: CVE-2025-40604
Published: 2025-11-20
Description: Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018
CVE: CVE-2025-40605
Published: 2025-11-20
Description: A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0018
CVE: CVE-2025-41074
Published: 2025-11-20
Description: Vulnerability in LimeSurvey 6.13.0  in the endpoint /optout that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS  attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0
CVE: CVE-2025-41075
Published: 2025-11-20
Description: Vulnerability in LimeSurvey 6.13.0 in the endpoint /optin that causes infinite HTTP redirects when accessed directly. This behavior can be exploited to generate a Denegation of Service (DoS  attack), by exhausting server or client resources. The system is unable to break the redirect loop, which can cause service degradation or browser instability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0
CVE: CVE-2025-41076
Published: 2025-11-20
Description: In version 6.13.0 of LimeSurvey, any external user can cause a 500 error in the survey system by sending a malformed session cookie. Instead of displaying a generic error message, the system exposes internal backend information, including the use of the Yii framework, the MySQL/MariaDB database engine, the table name 'lime_sessions', primary keys, and fragments of the content that caused the conflict. This information can simplify the collection of data about the internal architecture of the application by an attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-limesurvey-0
CVE: CVE-2025-5092
Published: 2025-11-20
Description: Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sachinchoolur/lightGallery; https://plugins.trac.wordpress.org/changeset/3311382/; https://plugins.trac.wordpress.org/changeset/3343557/
CVE: CVE-2025-60794
Published: 2025-11-20
Description: Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-316
References: https://github.com/perfood/couch-auth; https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60794.md; https://www.npmjs.com/package/@perfood/couch-auth
CVE: CVE-2025-60796
Published: 2025-11-20
Description: phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/phppgadmin/phppgadmin/blob/master/admin.php#L35; https://github.com/phppgadmin/phppgadmin/blob/master/indexes.php#L29; https://github.com/phppgadmin/phppgadmin/blob/master/sequences.php#L316
CVE: CVE-2025-60797
Published: 2025-11-20
Description: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to complete database compromise, data theft, or privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/phppgadmin/phppgadmin/blob/master/dataexport.php#L118; https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md
CVE: CVE-2025-60798
Published: 2025-11-20
Description: phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL commands through malicious query manipulation, potentially leading to complete database compromise.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/phppgadmin/phppgadmin/blob/master/display.php#L396; https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60797.md; https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60798.md
CVE: CVE-2025-60799
Published: 2025-11-20
Description: phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attackers can exploit this to store arbitrary SQL queries in $_SESSION['sqlquery'] by manipulating these parameters, potentially leading to session poisoning, stored cross-site scripting, or unauthorized access to sensitive session data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: https://github.com/phppgadmin/phppgadmin/blob/master/sql.php#L68-L76; https://github.com/pr0wl1ng/security-advisories/blob/main/CVE-2025-60799.md
CVE: CVE-2025-62346
Published: 2025-11-20
Description: A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to execute an unwanted, malicious action on a trusted site where the user is authenticated, specifically on one endpoint.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0126459
CVE: CVE-2025-64984
Published: 2025-11-20
Description: Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial CyberSecurity for Linux Nodes (any version with anti-virus databases prior to 18.11.2025), and Kaspersky Endpoint Security for Mac (12.0.0.325, 12.1.0.553, and 12.2.0.694 with anti-virus databases prior to 18.11.2025) that could have allowed a reflected XSS attack to be carried out by an attacker using phishing techniques.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.kaspersky.com/vulnerability/list-of-advisories/12430#181125
CVE: CVE-2025-65220
Published: 2025-11-20
Description: Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN1.md
CVE: CVE-2025-65221
Published: 2025-11-20
Description: Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN2.md
CVE: CVE-2025-65222
Published: 2025-11-20
Description: Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN3.md
CVE: CVE-2025-65223
Published: 2025-11-20
Description: Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN4.md
CVE: CVE-2025-65226
Published: 2025-11-20
Description: Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN5.md
CVE: CVE-2024-31405
Published: 2025-11-20
Description: Rejected reason: Voluntarily withdrawn