deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1202
Published: 2025-02-12
Description: A vulnerability classified as critical has been found in SourceCodester Best Church Management Software 1.1. Affected is an unknown function of the file /admin/edit_slider.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Yesec/Best-church-management-software/blob/main/edit_slider.php.md; https://vuldb.com/?ctiid.295110; https://vuldb.com/?id.295110
CVE: CVE-2025-1206
Published: 2025-02-12
Description: A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/viewdetailroutine.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/sekaino-sakura/CVE/blob/main/CVE_1.md; https://vuldb.com/?ctiid.295143; https://vuldb.com/?id.295143
CVE: CVE-2025-1212
Published: 2025-02-12
Description: An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://gitlab.com/gitlab-org/gitlab/-/issues/502196
CVE: CVE-2025-1244
Published: 2025-02-12
Description: A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://access.redhat.com/errata/RHSA-2025:1915; https://access.redhat.com/errata/RHSA-2025:1917; https://access.redhat.com/errata/RHSA-2025:1961
CVE: CVE-2024-11343
Published: 2025-02-12
Description: In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.
CVSS Score: 8.3 (HIGH)
CWE: CWE-22
References: https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-path-traversal-cve-2024-11343
CVE: CVE-2024-12629
Published: 2025-02-12
Description: In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-1321
References: https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-protoype-pollution-2024-12629
CVE: CVE-2024-9870
Published: 2025-02-12
Description: An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-441, CWE-918
References: https://gitlab.com/gitlab-org/gitlab/-/issues/498911; https://hackerone.com/reports/2734142
CVE: CVE-2025-0332
Published: 2025-02-12
Description: In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://docs.telerik.com/devtools/winforms/knowledge-base/kb-security-path-traversal-cve-2025-0332
CVE: CVE-2025-0516
Published: 2025-02-12
Description: Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/513540; https://hackerone.com/reports/2914644
CVE: CVE-2025-0556
Published: 2025-02-12
Description: In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319
References: https://docs.telerik.com/report-server/knowledge-base/kb-security-cleartext-transmission-cve-2025-0556
CVE: CVE-2025-1207
Published: 2025-02-12
Description: A vulnerability was found in phjounin TFTPD64 4.64. It has been declared as problematic. This vulnerability affects unknown code of the component DNS Handler. The manipulation leads to denial of service. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.1 (LOW)
CWE: CWE-404
References: https://github.com/DMCERTCE/TFTPD64_DOS; https://github.com/DMCERTCE/TFTPD64_DOS/blob/main/poc.py; https://vuldb.com/?ctiid.295144
CVE: CVE-2025-1208
Published: 2025-02-12
Description: A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /Profile.php. The manipulation of the argument postcontent leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/nanguawuming/CVE2/blob/main/cve1.pdf; https://vuldb.com/?ctiid.295145
CVE: CVE-2025-25349
Published: 2025-02-12
Description: PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Daily%20Expense%20Tracker%20System/SQL%20Injection%20item%20add-expense%20costitem%20parameter.pdf
CVE: CVE-2025-25351
Published: 2025-02-12
Description: PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Daily%20Expense%20Tracker%20System/SQL%20Injection%20dateexpense%20daily%20expense.pdf
CVE: CVE-2024-11628
Published: 2025-02-12
Description: In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-1321
References: https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-protoype-pollution-2024-11628
CVE: CVE-2024-11629
Published: 2025-02-12
Description: In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.
CVSS Score: 7.1 (HIGH)
CWE: CWE-552
References: https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-rtf-filecontent-export-cve-2024-11629
CVE: CVE-2025-0919
Published: 2025-02-12
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-0818. Reason: This candidate is a reservation duplicate of CVE-2025-0818. Notes: All CVE users should reference CVE-2025-0818 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-0925
Published: 2025-02-12
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-0818. Reason: This candidate is a reservation duplicate of CVE-2025-0818. Notes: All CVE users should reference CVE-2025-0818 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-1209
Published: 2025-02-12
Description: A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is the function searchuser of the file /search_resualts.php. The manipulation of the argument firstname/lastname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. There is a typo in the affected file name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/nanguawuming/CVE2/blob/main/cve2.pdf; https://vuldb.com/?ctiid.295146
CVE: CVE-2025-1210
Published: 2025-02-12
Description: A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /controllers/control.php. The manipulation of the argument to leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/nanguawuming/CVE2/blob/main/cve3.pdf; https://vuldb.com/?ctiid.295147
CVE: CVE-2025-25182
Published: 2025-02-12
Description: Stroom is a data processing, storage and analysis platform. A vulnerability exists starting in version 7.2-beta.53 and prior to versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2 that allows authentication bypass to a Stroom system when configured with ALB and installed in a way that the application is accessible not through the ALB itself. This vulnerability may also allow for server-side request forgery which may lead to code execution or further privileges escalations when using the AWS metadata URL. This scenario assumes that Stroom must be configured to use ALB Authentication integration and the application is network accessible. The vulnerability has been fixed in versions 7.2.24, 7.3-beta.22, 7.4.4, and 7.5-beta.2.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-290
References: https://github.com/gchq/stroom/pull/4320; https://github.com/gchq/stroom/security/advisories/GHSA-x489-xx2m-vc43
CVE: CVE-2025-25184
Published: 2025-02-12
Description: Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-93, CWE-117
References: https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e; https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg; https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
CVE: CVE-2025-25742
Published: 2025-02-12
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-3-1812386a664480feaf1ceab444b132b3
CVE: CVE-2025-25743
Published: 2025-02-12
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-77
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR[PII_REDACTED]a[PII_REDACTED]10c137ded2d3f1
CVE: CVE-2025-25744
Published: 2025-02-12
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-4-1812386a[PII_REDACTED]26cc13b98e18f5
CVE: CVE-2025-25746
Published: 2025-02-12
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-5-1812386a66448044b489f223b8c2e78a
CVE: CVE-2024-6097
Published: 2025-02-12
Description: In Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-36, CWE-22
References: https://docs.telerik.com/reporting/knowledge-base/kb-security-absolute-path-traversal-CVE-2024-6097
CVE: CVE-2025-1213
Published: 2025-02-12
Description: A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/janssensjelle/published-pocs/blob/main/pihome_xss_index.md; https://vuldb.com/?ctiid.295172; https://vuldb.com/?id.295172
CVE: CVE-2025-1214
Published: 2025-02-12
Description: A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://github.com/janssensjelle/published-pocs/blob/main/pihomehvac-improper-access-control.md; https://vuldb.com/?ctiid.295173; https://vuldb.com/?id.295173
CVE: CVE-2025-25198
Published: 2025-02-12
Description: mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601
References: https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3mvx-qw4r-fcqf
CVE: CVE-2025-25199
Published: 2025-02-12
Description: go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation (CNG). Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to `cng.TLS1PRF` don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41 contains a fix for the issue. The fix is included in versions 1.23.6-2 and 1.22.12-2 of the Microsoft build of go, as well as in the pseudoversion 0.0.0[PII_REDACTED]4640-f49c8e1379ea of the `github.com/microsoft/go-crypto-winnative` Go package.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/microsoft/go-crypto-winnative/commit/f49c8e1379ea4b147d5bff1b3be5b0ff45792e41; https://github.com/microsoft/go-crypto-winnative/security/advisories/GHSA-29c6-3hcj-89cf
CVE: CVE-2025-25200
Published: 2025-02-12
Description: Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack. Versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3 fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/koajs/koa/blob/master/lib/request.js#L259; https://github.com/koajs/koa/blob/master/lib/request.js#L404; https://github.com/koajs/koa/commit/5054af6e31ffd451a4151a1fe144cef6e5d0d83c
CVE: CVE-2025-25741
Published: 2025-02-12
Description: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettings module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-121
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-853-7-1812386a664480b7ac54d281afa629f5
CVE: CVE-2025-0937
Published: 2025-02-12
Description: Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.
CVSS Score: 7.1 (HIGH)
CWE: CWE-863
References: https://discuss.hashicorp.com/t/hcsec-2025-02-nomad-vulnerable-to-event-stream-namespace-acl-policy-bypass-through-wildcard-namespace/73191
CVE: CVE-2025-1146
Published: 2025-02-12
Description: CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.

 
CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. 


Windows and Mac sensors are not affected by this.
CVSS Score: 8.1 (HIGH)
CWE: CWE-296
References: https://www.crowdstrike.com/security-advisories/cve-2025-1146/
CVE: CVE-2025-1215
Published: 2025-02-12
Description: A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b[PII_REDACTED]7bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.
CVSS Score: 2.8 (LOW)
CWE: CWE-119
References: https://github.com/vim/vim/commit/c5654b[PII_REDACTED]7bb7b69ebc97c174c91185e9; https://github.com/vim/vim/issues/16606; https://github.com/vim/vim/releases/tag/v9.1.1097
CVE: CVE-2025-1216
Published: 2025-02-12
Description: A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/r1bbit/yimioa/issues/IBI74K; https://vuldb.com/?ctiid.295175; https://vuldb.com/?id.295175
CVE: CVE-2025-25201
Published: 2025-02-12
Description: Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the application. An attacker without access to the proper administration key would be able to generate new keys and overwrite certificates. Such an attacker would not be able to read-out or extract existing private data, nor would they be able to gain access to cryptographic operations that would normally require PIN-based authentication. The issue is fixed in piv-authenticator 0.3.9, and in Nitrokey's firmware 1.8.1.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: https://github.com/Nitrokey/nitrokey-3-firmware/releases/tag/v1.8.1; https://github.com/Nitrokey/nitrokey-3-firmware/security/advisories/GHSA-jfhm-ppq8-7hgx; https://www.nitrokey.com/blog/2025/nitrokey-3-firmware-v181-security-update
CVE: CVE-2025-25205
Published: 2025-02-12
Description: Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.
CVSS Score: 8.2 (HIGH)
CWE: CWE-202, CWE-287, CWE-400
References: https://github.com/advplyr/audiobookshelf/blob/1a3d70d04100924d41391acb55bd8ddca486a4fa/server/Auth.js#L17-L41; https://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1c; https://github.com/advplyr/audiobookshelf/commit/ec[PII_REDACTED]a43871b07cfee12c9f383844d224
CVE: CVE-2025-25283
Published: 2025-02-12
Description: parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/jkroso/parse-duration/commit/9e88421bfd41806fa4b473bfb28a9ee9dafc27d7; https://github.com/jkroso/parse-duration/releases/tag/v2.1.3; https://github.com/jkroso/parse-duration/security/advisories/GHSA-hcrg-fc28-fcg5
CVE: CVE-2025-25343
Published: 2025-02-12
Description: Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://github.com/wy876/cve/issues/4