deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9743
Published: 2025-08-31
Description: A security flaw has been discovered in code-projects Human Resource Integrated System 1.0. Impacted is an unknown function of the file login_attendance2.php. Performing manipulation of the argument employee_id/date results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/cooorgi/cve/blob/main/hris_sql_login_attendance2.md; https://vuldb.com/?ctiid.322042
CVE: CVE-2025-9744
Published: 2025-08-31
Description: A weakness has been identified in Campcodes Online Loan Management System 1.0. The affected element is an unknown function of the file /ajax.php?action=login. Executing manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/gggg6886/CVE/issues/1; https://vuldb.com/?ctiid.322043; https://vuldb.com/?id.322043
CVE: CVE-2025-9745
Published: 2025-08-31
Description: A security vulnerability has been detected in D-Link DI-500WF 14.04.10A1T. The impacted element is an unknown function of the file /version_upgrade.asp of the component jhttpd. The manipulation of the argument path leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/physicszq/Routers/blob/main/tmp/01/poc.py; https://github.com/physicszq/Routers/tree/main/tmp/01; https://vuldb.com/?ctiid.322044
CVE: CVE-2025-9746
Published: 2025-08-31
Description: A vulnerability was detected in Campcodes Hospital Management System 1.0. This affects an unknown function of the file /admin/edit-doctor-specialization.php of the component Edit Doctor Specialization Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Yashh-G/zero-day-research/blob/main/HMS_Stored_Cross-site_Scripting.docx; https://vuldb.com/?ctiid.322045; https://vuldb.com/?id.322045
CVE: CVE-2025-9747
Published: 2025-08-31
Description: A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrf_protection_controller.js. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 is able to address this issue. The name of the patch is 9ab8562d3f1e953da93fed63f9ee802c7ea26a9a. It is suggested to upgrade the affected component. The vendor explains: "I ended up switching to a newer CSRF handling using stateless token."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/benjaminjonard/koillection/commit/9ab8562d3f1e953da93fed63f9ee802c7ea26a9a; https://github.com/benjaminjonard/koillection/issues/1393; https://github.com/benjaminjonard/koillection/issues/1393#issue[PII_REDACTED]
CVE: CVE-2025-9748
Published: 2025-08-31
Description: A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/physicszq/Routers/tree/main/tmp/02; https://vuldb.com/?ctiid.322049; https://vuldb.com/?id.322049
CVE: CVE-2025-9749
Published: 2025-08-31
Description: A vulnerability was identified in HKritesh009 Grocery List Management Web App up to f491b681eb70d465f445c9a721415c965190f83b. This affects an unknown part of the file /src/update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://gist.github.com/0xSebin/a163239e0132d7d58ef1300f321da819; https://gist.github.com/0xSebin/a163239e0132d7d58ef1300f321da819#steps-to-reproduce; https://vuldb.com/?ctiid.322050
CVE: CVE-2025-9750
Published: 2025-08-31
Description: A security flaw has been discovered in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/gggg6886/CVE/issues/2; https://vuldb.com/?ctiid.322051; https://vuldb.com/?id.322051
CVE: CVE-2025-9751
Published: 2025-09-01
Description: A weakness has been identified in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /login.php. This manipulation of the argument Username causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/HAO-RAY/HCR-CVE/issues/1; https://vuldb.com/?ctiid.322052; https://vuldb.com/?id.322052
CVE: CVE-2025-9752
Published: 2025-09-01
Description: A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. Impacted is the function soapcgi_main of the file soap.cgi of the component SOAP Service. Such manipulation of the argument service leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/i-Corner/cve/issues/18; https://vuldb.com/?ctiid.322053; https://vuldb.com/?id.322053
CVE: CVE-2025-9753
Published: 2025-09-01
Description: A vulnerability was detected in Campcodes Online Hospital Management System 1.0. The affected element is an unknown function of the file /admin/patient-search.php of the component Patient Search Module. Performing manipulation of the argument Search by Name Mobile No results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Yashh-G/zero-day-research/blob/main/HMS_XSS_In_Patient_search_Feild.pdf; https://vuldb.com/?ctiid.322054; https://vuldb.com/?id.322054
CVE: CVE-2025-9754
Published: 2025-09-01
Description: A flaw has been found in Campcodes Online Hospital Management System 1.0. The impacted element is an unknown function of the file /edit-profile.php of the component Edit Profile Page. Executing manipulation of the argument Username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Yashh-G/zero-day-research/blob/main/HMS_Stored_XSS_In_UserName_Field.pdf; https://vuldb.com/?ctiid.322055; https://vuldb.com/?id.322055
CVE: CVE-2025-9755
Published: 2025-09-01
Description: A vulnerability has been found in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24. This affects an unknown function of the file /index.php. The manipulation of the argument msg leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/0xSebin/147e7f57daf7f270d957927892b0a51d; https://vuldb.com/?ctiid.322056; https://vuldb.com/?id.322056
CVE: CVE-2025-9756
Published: 2025-09-01
Description: A vulnerability was found in PHPGurukul User Management System 1.0. This impacts an unknown function of the file /admin/change-emailid.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/CSentinel/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.322057
CVE: CVE-2025-9567
Published: 2025-09-01
Description: The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html; https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html
CVE: CVE-2025-9568
Published: 2025-09-01
Description: The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html; https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html
CVE: CVE-2025-9569
Published: 2025-09-01
Description: The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html; https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html
CVE: CVE-2025-9757
Published: 2025-09-01
Description: A vulnerability was determined in Campcodes/SourceCodester Courier Management System 1.0. Affected is the function Login of the file /ajax.php. This manipulation of the argument email causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lrjbsyh/CVE_Hunter/issues/8#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322058; https://vuldb.com/?id.322058
CVE: CVE-2025-7405
Published: 2025-09-01
Description: Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.
CVSS Score: 7.3 (HIGH)
CWE: CWE-306
References: https://jvn.jp/vu/JVNVU90041458/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-01; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-011_en.pdf
CVE: CVE-2025-7731
Published: 2025-09-01
Description: Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product and stop the operations of programs by using the obtained credential information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://jvn.jp/vu/JVNVU90041458/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-02; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-012_en.pdf
CVE: CVE-2025-9570
Published: 2025-09-01
Description: The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to exploit Relative Path Traversal to download arbitrary system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-10357-7de41-2.html; https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.html
CVE: CVE-2025-9758
Published: 2025-09-01
Description: A vulnerability was identified in deepakmisal24 Chemical Inventory Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /inventory_form.php. Such manipulation of the argument chem_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gist.github.com/0xSebin/29cb8e043974d996509522cdb738edc6; https://gist.github.com/0xSebin/29cb8e043974d996509522cdb738edc6#proof-of-concept-poc; https://vuldb.com/?ctiid.322059
CVE: CVE-2025-9759
Published: 2025-09-01
Description: A security flaw has been discovered in Campcodes/SourceCodester Courier Management System 1.0. Affected by this issue is the function Signup of the file /ajax.php. Performing manipulation of the argument lastname results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lrjbsyh/CVE_Hunter/issues/9#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322060; https://vuldb.com/?id.322060
CVE: CVE-2025-9760
Published: 2025-09-01
Description: A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Function%20Level%20Authorization%20on%20%60matricula%60%20API%20allows%20deletion%20of%20%E2%80%9Cabandono%E2%80%9D%20status.md#proof-of-concept-poc; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9760.md; https://vuldb.com/?ctiid.322061
CVE: CVE-2025-9761
Published: 2025-09-01
Description: A security vulnerability has been detected in Campcodes Online Feeds Product Inventory System 1.0. This vulnerability affects unknown code of the file /feeds/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/HAO-RAY/HCR-CVE/issues/2; https://vuldb.com/?ctiid.322062; https://vuldb.com/?id.322062
CVE: CVE-2025-9763
Published: 2025-09-01
Description: A vulnerability was detected in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /student_signup.php. The manipulation of the argument Username results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/gggg6886/CVE/issues/3; https://vuldb.com/?ctiid.322063; https://vuldb.com/?id.322063
CVE: CVE-2025-20703
Published: 2025-09-01
Description: In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01599794; Issue ID: MSV-3708.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/September-2025
CVE: CVE-2025-20704
Published: 2025-09-01
Description: In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01516959; Issue ID: MSV-3502.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2025
CVE: CVE-2025-20705
Published: 2025-09-01
Description: In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09989078; Issue ID: MSV-3964.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/September-2025
CVE: CVE-2025-20706
Published: 2025-09-01
Description: In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924624; Issue ID: MSV-3826.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/September-2025
CVE: CVE-2025-20707
Published: 2025-09-01
Description: In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924201; Issue ID: MSV-3820.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/September-2025
CVE: CVE-2025-20708
Published: 2025-09-01
Description: In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01123853; Issue ID: MSV-4131.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/September-2025
CVE: CVE-2025-54857
Published: 2025-09-01
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earlier. If exploited, a remote unauthenticated attacker may execute arbitrary OS commands with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN22016482/; https://www.seiko-sol.co.jp/archives/90289/
CVE: CVE-2025-6507
Published: 2025-09-01
Description: A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vulnerability arises from the ability to bypass regular expression filters intended to prevent malicious parameter injection in JDBC connections. Attackers can manipulate spaces between parameters to evade detection, allowing for unauthorized file access and code execution. The vulnerability is addressed in version 3.46.0.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d; https://huntr.com/bounties/0a9d527a-2d39-4bc0-bf01-1e717587f077
CVE: CVE-2025-9764
Published: 2025-09-01
Description: A flaw has been found in itsourcecode Sports Management System 1.0. Impacted is an unknown function of the file /Admin/resultdetails.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zws128/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.322064
CVE: CVE-2025-9765
Published: 2025-09-01
Description: A vulnerability has been found in itsourcecode Sports Management System 1.0. The affected element is an unknown function of the file /Admin/tournament_details.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/60; https://itsourcecode.com/; https://vuldb.com/?ctiid.322065
CVE: CVE-2025-9766
Published: 2025-09-01
Description: A vulnerability was found in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/facilitator.php. Performing manipulation of the argument code results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/59; https://itsourcecode.com/; https://vuldb.com/?ctiid.322066
CVE: CVE-2025-9767
Published: 2025-09-01
Description: A vulnerability was determined in itsourcecode Sports Management System 1.0. This affects an unknown function of the file /Admin/sporttype.php. Executing manipulation of the argument code can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/58; https://itsourcecode.com/; https://vuldb.com/?ctiid.322067
CVE: CVE-2022-38691
Published: 2025-09-01
Description: In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE: CVE-2022-38692
Published: 2025-09-01
Description: In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE: CVE-2022-38693
Published: 2025-09-01
Description: In FDL1, there is a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE: CVE-2022-38694
Published: 2025-09-01
Description: In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE: CVE-2022-38695
Published: 2025-09-01
Description: In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE: CVE-2022-38696
Published: 2025-09-01
Description: In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.nccgroup.com/research-blog/there-s-another-hole-in-your-soc-unisoc-rom-vulnerabilities/
CVE: CVE-2025-58318
Published: 2025-09-01
Description: Delta Electronics DIAView has an authentication bypass vulnerability.
CWE: CWE-306
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00015_DIAView%20Authentication%20%20Bypass%20Vulnerability.pdf