deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-59244
Published: 2025-10-14
Description: External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59244
CVE: CVE-2025-59248
Published: 2025-10-14
Description: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59248
CVE: CVE-2025-59249
Published: 2025-10-14
Description: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1390
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59249
CVE: CVE-2025-59250
Published: 2025-10-14
Description: Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250
CVE: CVE-2025-59253
Published: 2025-10-14
Description: Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59253
CVE: CVE-2025-59254
Published: 2025-10-14
Description: Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59254
CVE: CVE-2025-59255
Published: 2025-10-14
Description: Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59255
CVE: CVE-2025-59257
Published: 2025-10-14
Description: Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59257
CVE: CVE-2025-59258
Published: 2025-10-14
Description: Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-532
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59258
CVE: CVE-2025-59259
Published: 2025-10-14
Description: Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59259
CVE: CVE-2025-59260
Published: 2025-10-14
Description: Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59260
CVE: CVE-2025-59261
Published: 2025-10-14
Description: Time-of-check time-of-use (toctou) race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59261
CVE: CVE-2025-59275
Published: 2025-10-14
Description: Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-125, CWE-1287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59275
CVE: CVE-2025-59277
Published: 2025-10-14
Description: Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59277
CVE: CVE-2025-59278
Published: 2025-10-14
Description: Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59278
CVE: CVE-2025-59280
Published: 2025-10-14
Description: Improper authentication in Windows SMB Client allows an unauthorized attacker to perform tampering over a network.
CVSS Score: 3.1 (LOW)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59280
CVE: CVE-2025-59281
Published: 2025-10-14
Description: Improper link resolution before file access ('link following') in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59281
CVE: CVE-2025-59282
Published: 2025-10-14
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Inbox COM Objects allows an unauthorized attacker to execute code locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59282; https://www.vicarius.io/vsociety/posts/cve-2025-59282-detection-script-race-condition-in-microsoft-inbox-com-objects; https://www.vicarius.io/vsociety/posts/cve-2025-59282-mitigation-script-race-condition-in-microsoft-inbox-com-objects
CVE: CVE-2025-59284
Published: 2025-10-14
Description: Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59284
CVE: CVE-2025-59285
Published: 2025-10-14
Description: Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59285
CVE: CVE-2025-59287
Published: 2025-10-14
Description: Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287; https://hawktrace.com/blog/CVE-2025-59287; https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-server-wsus-flaw-exploited-in-attacks/
CVE: CVE-2025-59288
Published: 2025-10-14
Description: Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59288
CVE: CVE-2025-59289
Published: 2025-10-14
Description: Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59289
CVE: CVE-2025-59290
Published: 2025-10-14
Description: Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59290
CVE: CVE-2025-59291
Published: 2025-10-14
Description: External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
CVSS Score: 8.2 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59291
CVE: CVE-2025-59292
Published: 2025-10-14
Description: External control of file name or path in Confidential Azure Container Instances allows an authorized attacker to elevate privileges locally.
CVSS Score: 8.2 (HIGH)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59292
CVE: CVE-2025-59294
Published: 2025-10-14
Description: Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59294
CVE: CVE-2025-59295
Published: 2025-10-14
Description: Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59295
CVE: CVE-2025-59494
Published: 2025-10-14
Description: Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59494
CVE: CVE-2025-59497
Published: 2025-10-14
Description: Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59497
CVE: CVE-2025-59502
Published: 2025-10-14
Description: Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59502
CVE: CVE-2025-60535
Published: 2025-10-14
Description: A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352
References: http://wallos.com; https://github.com/ellite/Wallos/; https://github.com/vityuasd/VulList/blob/main/CVE-2025-60535.md
CVE: CVE-2025-8430
Published: 2025-10-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored 

XSS by users with elevated privileges.

This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8430-centreon-web-all-versions-medium-severity-5118
CVE: CVE-2025-11736
Published: 2025-10-14
Description: A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/iMayday-Yee/Vulnerability/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.328220
CVE: CVE-2025-23356
Published: 2025-10-14
Description: NVIDIA Isaac Lab contains a vulnerability in SB3 configuration parsing. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
CVSS Score: 8.4 (HIGH)
CWE: CWE-306
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5708
CVE: CVE-2025-57563
Published: 2025-10-14
Description: A path traversal in StarNet Communications Corporation FastX v.4 through v4.1.51 allows unauthenticated attackers to read arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-24
References: https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md?ref_type=heads; https://www.starnet.com/fastx/
CVE: CVE-2025-57618
Published: 2025-10-14
Description: A path traversal vulnerability in FastX3 thru 3.3.67 allows an unauthenticated attacker to read arbitrary files on the server. By leveraging this vulnerability, it is possible to access the application's configuration files, which contain the secret key used to sign JSON Web Tokens as well as existing JTIs. With this information, an attacker can forge valid JWTs, impersonate the root user, and achieve remote code execution in privileged context via authenticated endpoints.
CVSS Score: 7.3 (HIGH)
CWE: CWE-24
References: https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md?ref_type=heads; https://www.starnet.com/fastx/; https://www.starnet.com/help/fastx3-3-server-release-notes/
CVE: CVE-2025-60536
Published: 2025-10-14
Description: An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS) via uploading a crafted configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/provectus/kafka-ui; https://github.com/provectus/kafka-ui/blob/v0.7.2/kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/builtin/sr/SchemaRegistrySerde.java; https://github.com/vityuasd/VulList/blob/main/CVE-2025-60536.md
CVE: CVE-2025-60537
Published: 2025-10-14
Description: Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/provectus/kafka-ui; https://github.com/provectus/kafka-ui/blob/v0.7.2/kafka-ui-api/src/main/java/com/provectus/kafka/ui/serdes/CustomSerdeLoader.java; https://github.com/vityuasd/VulList/blob/main/CVE-2025-60537.md
CVE: CVE-2025-8459
Published: 2025-10-14
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Monitoring recurrent downtime scheduler modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8459-centreon-web-all-versions-high-severity-5117
CVE: CVE-2025-33182
Published: 2025-10-14
Description: NVIDIA Jetson Linux contains a vulnerability in UEFI, where improper authentication may allow a privileged user to cause corruption of the Linux Device Tree. A successful exploitation of this vulnerability might lead to data tampering, denial of service.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5716
CVE: CVE-2025-54273
Published: 2025-10-14
Description: Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html
CVE: CVE-2025-54274
Published: 2025-10-14
Description: Substance3D - Viewer versions 0.25.2 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html
CVE: CVE-2025-54275
Published: 2025-10-14
Description: Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to crash the application or make it unavailable. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html
CVE: CVE-2025-54280
Published: 2025-10-14
Description: Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-99.html
CVE: CVE-2025-33177
Published: 2025-10-14
Description: NVIDIA Jetson Linux and IGX OS contain a vulnerability in NvMap, where improper tracking of memory allocations could allow a local attacker to cause memory overallocation. A successful exploitation of this vulnerability might lead to denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5716
CVE: CVE-2025-34267
Published: 2025-10-14
Description: Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) within the nodevm execution environment. An authenticated attacker able to create or run a tool that leverages Puppeteer/Playwright can specify attacker-controlled browser binary paths and parameters. When the tool executes, the attacker-controlled executable/parameters are run on the host and circumvent the intended nodevm sandbox restrictions, resulting in execution of arbitrary code in the context of the host. This vulnerability was incorrectly assigned as a duplicate CVE-2025-26319 by the developers and should be considered distinct from that identifier.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77
References: https://flowiseai.com/; https://github.com/FlowiseAI/Flowise/pull/5231; https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5w3r-f6gm-c25w
CVE: CVE-2025-54276
Published: 2025-10-14
Description: Substance3D - Modeler versions 1.22.3 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d-modeler/apsb25-100.html
CVE: CVE-2025-54281
Published: 2025-10-14
Description: Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/framemaker/apsb25-101.html
CVE: CVE-2025-54282
Published: 2025-10-14
Description: Adobe Framemaker versions 2020.9, 2022.7 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/framemaker/apsb25-101.html
CVE: CVE-2025-54283
Published: 2025-10-14
Description: Illustrator versions 29.7, 28.7.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb25-102.html
CVE: CVE-2025-54284
Published: 2025-10-14
Description: Illustrator versions 29.7, 28.7.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/illustrator/apsb25-102.html
CVE: CVE-2025-59051
Published: 2025-10-14
Description: The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command execution as the asterisk user. Authentication with a known username is required. Updating to Endpoint Manager 16.0.92 or 17.0.6 addresses the issue.
CWE: CWE-78
References: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-qgj3-f9gj-98v9
CVE: CVE-2025-59429
Published: 2025-10-14
Description: FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and is available by default on version 16 via any bound IP address at port 8088. By default on version 17, the binding is only to localhost IP, making it significantly less vulnerable. The vulnerability can be exploited by unauthenticated attackers to obtain cookies from logged-in users, allowing them to hijack a session of an administrative user. The theft of admin session cookies allows attackers to gain control over the FreePBX admin interface, enabling them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruption. This issue has been patched in version 16.0.68.39 for FreePBX 16 and version 17.0.18.38 for FreePBX 17.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-c8g7-475j-fwcc
CVE: CVE-2025-60374
Published: 2025-10-14
Description: Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A different vulnerability than CVE-2024-8867.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/ajansha/CVE-2025-60374
CVE: CVE-2025-60540
Published: 2025-10-14
Description: karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://github.com/karakeep-app/karakeep/; https://github.com/vityuasd/VulList/blob/main/CVE-2025-60540.md
CVE: CVE-2025-61675
Published: 2025-10-14
Description: FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration functionality areas. Authentication with a known username is required to exploit these vulnerabilities. Successful exploitation allows authenticated users to execute arbitrary SQL queries against the database, potentially enabling access to sensitive data or modification of database contents. This issue has been patched in version 16.0.92 for FreePBX 16 and version 17.0.6 for FreePBX 17.
CWE: CWE-89
References: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-292p-rj6h-54cp