deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0932
Published: 2025-08-04
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This issue affects Bifrost GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Userspace Driver: from r48p0 through r49p3, from r50p0 through r54p0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://developer.arm.com/documentation/110626/latest/
CVE: CVE-2025-6204
Published: 2025-08-04
Description: An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6204
CVE: CVE-2025-6205
Published: 2025-08-04
Description: A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6205
CVE: CVE-2025-8515
Published: 2025-08-04
Description: A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoint. Executing manipulation can lead to information disclosure. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.
CVSS Score: 3.1 (LOW)
CWE: CWE-200, CWE-284
References: https://backend.intelbras.com/sites/default/files/2025-08/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.60%20e%202.21.61%20PT-IN%20.pdf; https://vuldb.com/?ctiid.318641; https://vuldb.com/?id.318641
CVE: CVE-2025-36604
Published: 2025-08-04
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities; https://github.com/watchtowrlabs/watchTowr-vs-Dell-UnityVSA-PreAuth-CVE-2025-36604; https://labs.watchtowr.com/its-never-simple-until-it-is-dell-unityvsa-pre-auth-command-injection-cve-2025-36604/
CVE: CVE-2025-36605
Published: 2025-08-04
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-36606
Published: 2025-08-04
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nfssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-36607
Published: 2025-08-04
Description: Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-si/000350756/dsa-2025-281-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-8109
Published: 2025-08-04
Description: Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-280
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-26065
Published: 2025-08-04
Description: A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX1500.html; https://manuais.intelbras.com.br/manual-linha-rx/ChangeLogRX3000.html; https://seclists.org/fulldisclosure/2025/Jul/26
CVE: CVE-2025-30096
Published: 2025-08-04
Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE: CVE-2025-30097
Published: 2025-08-04
Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE: CVE-2025-30098
Published: 2025-08-04
Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE: CVE-2025-30099
Published: 2025-08-04
Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the DDSH CLI. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE: CVE-2025-36594
Published: 2025-08-04
Description: Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions 7.10.1.0 through 7.10.1.60, contain an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Remote unauthenticated user can create account that potentially expose customer info, affect system integrity and availability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
CVE: CVE-2025-44643
Published: 2025-08-04
Description: Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.
CVSS Score: 8.6 (HIGH)
CWE: CWE-276, CWE-798
References: http://draytek.com; https://www.notion.so/Misconfiguration-in-Draytek-AP903-23a54a1113e780aca7f2d21dbdab9db8
CVE: CVE-2025-51536
Published: 2025-08-04
Description: Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-1392
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-standard-adminkonto-mit-hartcodiertem-passwort/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-38739
Published: 2025-08-04
Description: Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to Information Disclosure.
CVSS Score: 7.2 (HIGH)
CWE: CWE-522
References: https://www.dell.com/support/kbdoc/en-us/000349489/dsa-2025-302
CVE: CVE-2025-44955
Published: 2025-08-04
Description: RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-259
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44955; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-5988
Published: 2025-08-04
Description: A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://access.redhat.com/errata/RHSA-2025:12772; https://access.redhat.com/security/cve/CVE-2025-5988; https://bugzilla.redhat.com/show_bug.cgi?id=2371644
CVE: CVE-2025-8516
Published: 2025-08-04
Description: A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!\kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the component IIS-K3CloudMiniApp. The manipulation of the argument filePath leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The vendor recommends as a short-term measure to "[t]emporarily disable external network access to the Kingdee Cloud Galaxy Retail System or set up an IP whitelist for access control." The long-term remediation will be: "Install the security patch provided by the Starry Sky system, with the specific solutions being: i) Adding authentication to the vulnerable CMKAppWebHandler.ashx interface; ii) Removing the file reading function."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://vip.kingdee.com/link/s/ZgAmJ; https://vuldb.com/?ctiid.318642; https://vuldb.com/?id.318642
CVE: CVE-2025-8517
Published: 2025-08-04
Description: A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.0.7 is recommended to address this issue. The patch is identified as d4b1e030066417b77d15b4ac505eed5ae7bf2c5e. You should upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-384
References: https://github.com/givanz/Vvveb/commit/d4b1e030066417b77d15b4ac505eed5ae7bf2c5e; https://github.com/givanz/Vvveb/issues/312; https://github.com/givanz/Vvveb/issues/312#issuecomment[PII_REDACTED]
CVE: CVE-2025-44954
Published: 2025-08-04
Description: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-1394
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44954; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-44957
Published: 2025-08-04
Description: Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers.
CVSS Score: 8.5 (HIGH)
CWE: CWE-288
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44957; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-44958
Published: 2025-08-04
Description: RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-257
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44958; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-44960
Published: 2025-08-04
Description: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44960; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-44961
Published: 2025-08-04
Description: In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-78
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44961; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-44962
Published: 2025-08-04
Description: RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-24
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44962; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-44963
Published: 2025-08-04
Description: RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-321
References: https://claroty.com/team82/disclosure-dashboard/cve-2025-44963; https://kb.cert.org/vuls/id/613753; https://webresources.commscope.com/download/assets/FAQ+Security+Advisory%3A+ID+20250710/225f44ac3bd311f095821adcaa92e24e
CVE: CVE-2025-50420
Published: 2025-08-04
Description: An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can lead to a Denial of Service (DoS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: http://freedesktop.com; http://poppler.com; https://github.com/Landw-hub/CVE-2025-50420
CVE: CVE-2025-50422
Published: 2025-08-04
Description: Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c.
CVSS Score: 2.9 (LOW)
CWE: CWE-617
References: https://github.com/Landw-hub/CVE-2025-50422; https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/621; https://gitlab.freedesktop.org/poppler/poppler/-/issues/1591
CVE: CVE-2025-51534
Published: 2025-08-04
Description: A cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-stored-nested-xss-delete-button/; https://www.sec4you-pentest.com/schwachstellen/; https://www.sec4you-pentest.com/schwachstelle/openatlas-stored-nested-xss-delete-button/
CVE: CVE-2025-51535
Published: 2025-08-04
Description: Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1392
References: https://www.sec4you-pentest.com/schwachstelle/openatlas-unbeschraenkte-sql-konsole-im-admin-ui/; https://www.sec4you-pentest.com/schwachstellen/
CVE: CVE-2025-8518
Published: 2025-08-04
Description: A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://gist.github.com/0xHamy/f16fb399f8dd3a973acadc18fa07b1cb; https://github.com/givanz/Vvveb/commit/f684f3e374d04db715730fc4796e102f5ebcacb2; https://github.com/givanz/Vvveb/releases/tag/1.0.6
CVE: CVE-2013-10052
Published: 2025-08-04
Description: ZPanel includes a helper binary named zsudo, intended to allow restricted privilege escalation for administrative tasks. However, when misconfigured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This flaw enables local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The vulnerability is particularly impactful in post-exploitation scenarios following web server compromise, where the attacker inherits access to zsudo.
CWE: CWE-269
References: https://github.com/zpanel/zpanelx; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/zpanel_zsudo.rb; https://www.exploit-db.com/exploits/26451
CVE: CVE-2013-10054
Published: 2025-08-04
Description: An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.
CWE: CWE-434
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/libretto_upload_exec.rb; https://sourceforge.net/projects/librettocms/; https://www.exploit-db.com/exploits/26213
CVE: CVE-2024-45183
Published: 2025-08-04
Description: An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400. A lack of a JPEG length check leads to an out-of-bound write.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2024-45183/
CVE: CVE-2025-34147
Published: 2025-08-04
Description: An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in Extender mode via its captive portal, the extap2g SSID field is inserted unescaped into a reboot-time shell script. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root during device reboot, leading to full system compromise.
CWE: CWE-78
References: https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root/; https://www.aliexpress.us/item/[PII_REDACTED].html; https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-ssid
CVE: CVE-2025-46206
Published: 2025-08-04
Description: An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: http://artifex.com; http://mupdf.com; https://bugs.ghostscript.com/show_bug.cgi?id=708521
CVE: CVE-2025-51390
Published: 2025-08-04
Description: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://totolink.com; https://github.com/Luanruy/qianxin/blob/main/CVE-2025-51390.md; https://github.com/Luanruy/qianxin/blob/main/overflow-0x41ca08.md
CVE: CVE-2025-8519
Published: 2025-08-04
Description: A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=editor/editor of the component Drag-and-Drop Editor. The manipulation of the argument url leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The identifier of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.
CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-284
References: https://github.com/givanz/Vvveb/commit/f684f3e374d04db715730fc4796e102f5ebcacb2; https://github.com/givanz/Vvveb/releases/tag/1.0.6; https://hkohi.ca/vulnerability/10