deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7570
Published: 2025-07-14
Description: A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rated as critical. Affected by this issue is some unknown functionality of the file /goform/aspRemoteApConfTempSend. The manipulation of the argument remoteSrcTemp leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/d2pq/cve/blob/main/616/7.md; https://github.com/d2pq/cve/blob/main/616/7.md#poc; https://vuldb.com/?ctiid.316268
CVE: CVE-2025-7619
Published: 2025-07-14
Description: BatchSignCS, a background Windows application developed by WellChoose, has an Arbitrary File Write vulnerability. If a user visits a malicious website while the application is running, remote attackers can write arbitrary files to any path and potentially lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-10240-00f86-2.html; https://www.twcert.org.tw/tw/cp-132-10239-770ab-1.html
CVE: CVE-2025-7620
Published: 2025-07-14
Description: The cross-browser document creation component produced by Digitware System Integration Corporation has a Remote Code Execution vulnerability. If a user visits a malicious website while the component is active, remote attackers can cause the system to download and execute arbitrary programs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://www.twcert.org.tw/en/cp-139-10242-5ab42-2.html; https://www.twcert.org.tw/tw/cp-132-10241-2ec07-1.html
CVE: CVE-2025-29606
Published: 2025-07-14
Description: py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/libp2p/py-libp2p/compare/v0.2.2...v0.2.3; https://github.com/libp2p/py-libp2p/issues/526; https://github.com/libp2p/py-libp2p/pull/531/files
CVE: CVE-2025-7571
Published: 2025-07-14
Description: A vulnerability classified as critical has been found in UTT HiPER 840G up to 3.1.1-190328. This affects an unknown part of the file /goform/aspApBasicConfigUrcp. The manipulation of the argument Username leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/d2pq/cve/blob/main/616/6.md; https://github.com/d2pq/cve/blob/main/616/6.md#poc; https://vuldb.com/?ctiid.316269
CVE: CVE-2025-7572
Published: 2025-07-14
Description: A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bs_GetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Information_Exposure_Vulnerabilities_in_Various_Blink_Router_Models.md; https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Information_Exposure_Vulnerabilities_in_Various_Blink_Router_Models.md#poc; https://vuldb.com/?ctiid.316270
CVE: CVE-2025-7573
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This issue affects the function bs_GetManPwd in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Web_Interface_Login_Credential_Disclosure_Risk_in_Various_Blink_Router_Models.md; https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Web_Interface_Login_Credential_Disclosure_Risk_in_Various_Blink_Router_Models.md#poc; https://vuldb.com/?ctiid.316271
CVE: CVE-2025-7574
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Interface. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.md; https://github.com/waiwai24/0101/blob/main/CVEs/Blink/Privilege_Control_Defect_in_Blink_Router_Web_Interface_Permits_Arbitrary_Sensitive_Operation_Execution.md#poc; https://vuldb.com/?ctiid.316272
CVE: CVE-2025-7380
Published: 2025-07-14
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder name field while creating a new shared folder. These scripts are not properly sanitized and will be executed when the folder name is subsequently displayed in the user interface. This allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive data.
Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.
CWE: CWE-79
References: https://www.asustor.com/security/security_advisory_detail?id=44
CVE: CVE-2025-7575
Published: 2025-07-14
Description: A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://github.com/Zavy86/WikiDocs/commit/98ea9ee4a2052c4327f89d2f7688cc1b5749450d; https://github.com/Zavy86/WikiDocs/pull/258; https://github.com/Zavy86/WikiDocs/releases/tag/1.0.78
CVE: CVE-2025-7576
Published: 2025-07-14
Description: A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16 and classified as critical. Affected by this issue is some unknown functionality of the file /priv/production/production.html of the component Production Tools. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-284
References: https://github.com/waiwai24/0101/blob/main/CVEs/FLIR/Production_html_Management_Backend_Unauthorized_Access.md; https://github.com/waiwai24/0101/blob/main/CVEs/FLIR/Production_html_Management_Backend_Unauthorized_Access.md#poc; https://vuldb.com/?ctiid.316274
CVE: CVE-2025-7577
Published: 2025-07-14
Description: A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been classified as problematic. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-255, CWE-259
References: https://github.com/waiwai24/0101/blob/main/CVEs/FLIR/Root_User_with_Hardcoded_Weak_Password.md; https://github.com/waiwai24/0101/blob/main/CVEs/FLIR/Root_User_with_Hardcoded_Weak_Password.md#poc; https://vuldb.com/?ctiid.316275
CVE: CVE-2025-7578
Published: 2025-07-14
Description: A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been declared as critical. This vulnerability affects the function sendCommand of the file runcmd.sh. The manipulation of the argument cmd leads to command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The researcher highlights, that "[a]lthough this functionality is currently disabled due to server CGI configuration errors, it is essentially a 'time bomb' waiting to be activated". The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/waiwai24/0101/blob/main/CVEs/FLIR/Command_Injection_Vulnerability_in_Developer_Backdoor_Page.md; https://vuldb.com/?ctiid.316276; https://vuldb.com/?id.316276
CVE: CVE-2025-7579
Published: 2025-07-14
Description: A vulnerability was found in chinese-poetry 0.1. It has been rated as problematic. This issue affects some unknown processing of the file rank/server.js. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/chinese-poetry/chinese-poetry/issues/396; https://github.com/chinese-poetry/chinese-poetry/issues/396#issue[PII_REDACTED]; https://vuldb.com/?ctiid.316277
CVE: CVE-2025-7580
Published: 2025-07-14
Description: A vulnerability classified as critical was found in code-projects Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/positions_row.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/7; https://vuldb.com/?ctiid.316279
CVE: CVE-2025-7581
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/positions_edit.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/8; https://vuldb.com/?ctiid.316280
CVE: CVE-2025-7582
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/assigned-requests.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/130; https://phpgurukul.com/; https://vuldb.com/?ctiid.316281
CVE: CVE-2025-7583
Published: 2025-07-14
Description: A vulnerability has been found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This vulnerability affects unknown code of the file /admin/all-requests.php. The manipulation of the argument teamid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/131; https://phpgurukul.com/; https://vuldb.com/?ctiid.316282
CVE: CVE-2025-7584
Published: 2025-07-14
Description: A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2 and classified as critical. This issue affects some unknown processing of the file /admin/add-team.php. The manipulation of the argument teammember leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/132; https://phpgurukul.com/; https://vuldb.com/?ctiid.316283
CVE: CVE-2025-7585
Published: 2025-07-14
Description: A vulnerability was found in PHPGurukul Online Fire Reporting System 1.2. It has been classified as critical. Affected is an unknown function of the file /admin/manage-site.php. The manipulation of the argument webtitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/133; https://phpgurukul.com/; https://vuldb.com/?ctiid.316284
CVE: CVE-2025-7586
Published: 2025-07-14
Description: A vulnerability was found in Tenda AC500 2.0.1.9(1307). It has been declared as critical. Affected by this vulnerability is the function formSetAPCfg of the file /goform/setWtpData. The manipulation of the argument radio_2g_1 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/panda666-888/vuls/blob/main/tenda/ac500/formSetAPCfg.md; https://github.com/panda666-888/vuls/blob/main/tenda/ac500/formSetAPCfg.md#poc; https://vuldb.com/?ctiid.316285
CVE: CVE-2024-26291
Published: 2025-07-14
Description: An Unauthenticated Arbitrary File Read vulnerability affects the
Agent when installed on a system. The parameter filename does not validate the
path thus allowing users to read arbitrary files. As
the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM)
by default attackers are able to obtain sensitive information.

This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
CWE: CWE-285
References: https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html; https://resources.avid.com/SupportFiles/attach/AvidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf
CVE: CVE-2024-26292
Published: 2025-07-14
Description: An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files.
This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
CWE: CWE-22
References: https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html; https://resources.avid.com/SupportFiles/attach/AvidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf
CVE: CVE-2025-24391
Published: 2025-07-14
Description: A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses.

This issue affects: 

  *  OTRS 7.0.X

  *  OTRS 8.0.X
  *  OTRS 2023.X
  *  OTRS 2024.X
  *  OTRS 2025.X
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://otrs.com/release-notes/otrs-security-advisory-2025-07/
CVE: CVE-2025-7587
Published: 2025-07-14
Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cover.php. The manipulation of the argument uname/psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/BalanceLee/CVE/issues/1; https://vuldb.com/?ctiid.316286
CVE: CVE-2025-7588
Published: 2025-07-14
Description: A vulnerability classified as critical has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This affects an unknown part of the file edit-product.php. The manipulation of the argument productname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/134; https://phpgurukul.com/; https://vuldb.com/?ctiid.316287
CVE: CVE-2025-7589
Published: 2025-07-14
Description: A vulnerability classified as critical was found in PHPGurukul Dairy Farm Shop Management System 1.3. This vulnerability affects unknown code of the file edit-company.php. The manipulation of the argument companyname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/135; https://phpgurukul.com/; https://vuldb.com/?ctiid.316288
CVE: CVE-2025-7590
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This issue affects some unknown processing of the file edit-category.php. The manipulation of the argument categorycode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/136; https://phpgurukul.com/; https://vuldb.com/?ctiid.316289
CVE: CVE-2025-7591
Published: 2025-07-14
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file view-invoice.php. The manipulation of the argument invid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/137; https://phpgurukul.com/; https://vuldb.com/?ctiid.316290
CVE: CVE-2024-26293
Published: 2025-07-14
Description: The Avid Nexis Agent uses a vulnerable gSOAP
version. An undocumented vulnerability impacting gSOAP v2.8 makes the application vulnerable to an Unauthenticated Path Traversal vulnerability.
This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.
References: https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html; https://resources.avid.com/SupportFiles/attach/AvidNEXIS/AvidNEXIS_2025_5_1_ReadMe.pdf; https://www.genivia.com/changelog.html
CVE: CVE-2025-53689
Published: 2025-07-14
Description: Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.

Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://lists.apache.org/thread/5pf9n76ny13pzzk765og2h3gxdxw7p24; http://www.openwall.com/lists/oss-security/2025/07/14/1
CVE: CVE-2025-7592
Published: 2025-07-14
Description: A vulnerability has been found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file invoices.php. The manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/138; https://phpgurukul.com/; https://vuldb.com/?ctiid.316291
CVE: CVE-2025-7593
Published: 2025-07-14
Description: A vulnerability was found in code-projects Job Diary 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view-all.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/19; https://vuldb.com/?ctiid.316292
CVE: CVE-2025-7594
Published: 2025-07-14
Description: A vulnerability was found in code-projects Job Diary 1.0. It has been classified as critical. This affects an unknown part of the file /view-emp.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/20; https://vuldb.com/?ctiid.316293
CVE: CVE-2024-51767
Published: 2025-07-14
Description: An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE: CVE-2024-51768
Published: 2025-07-14
Description: An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE: CVE-2024-51769
Published: 2025-07-14
Description: An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE: CVE-2024-51770
Published: 2025-07-14
Description: An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE: CVE-2025-7595
Published: 2025-07-14
Description: A vulnerability was found in code-projects Job Diary 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view-cad.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/lzq2000/cve/issues/1; https://vuldb.com/?ctiid.316294
CVE: CVE-2025-7596
Published: 2025-07-14
Description: A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been rated as critical. This issue affects the function formWifiExtraSet of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/panda666-888/vuls/blob/main/tenda/fh1205/formWifiExtraSet.md; https://github.com/panda666-888/vuls/blob/main/tenda/fh1205/formWifiExtraSet.md#poc; https://vuldb.com/?ctiid.316295