deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12597
Published: 2025-11-02
Description: A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the file /admin_class.php. Performing manipulation of the argument Name results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/321190176/Best-house-rental-management-system/blob/main/report.md; https://vuldb.com/?ctiid.330892; https://vuldb.com/?id.330892
CVE: CVE-2025-12598
Published: 2025-11-02
Description: A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.php. Executing manipulation of the argument firstname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Other parameters might be affected as well.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/321190176/Best-house-rental-management-system-2/blob/main/report.md; https://vuldb.com/?ctiid.330893; https://vuldb.com/?id.330893
CVE: CVE-2025-12604
Published: 2025-11-02
Description: A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation of the argument loan_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/cintahue/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.330894
CVE: CVE-2025-12605
Published: 2025-11-02
Description: A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/cintahue/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.330895
CVE: CVE-2025-12606
Published: 2025-11-03
Description: A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/cintahue/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.330896
CVE: CVE-2025-12607
Published: 2025-11-03
Description: A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/cintahue/CVE/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.330897
CVE: CVE-2025-12608
Published: 2025-11-03
Description: A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/cintahue/CVE/issues/5; https://itsourcecode.com/; https://vuldb.com/?ctiid.330898
CVE: CVE-2025-12609
Published: 2025-11-03
Description: A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. Performing a manipulation of the argument id/ini_weight results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/iamzzzzz/iam/issues/1; https://vuldb.com/?ctiid.330904
CVE: CVE-2025-12610
Published: 2025-11-03
Description: A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/danz0424/loudong/issues/1; https://vuldb.com/?ctiid.330905
CVE: CVE-2025-12611
Published: 2025-11-03
Description: A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument startIp leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/LX-LX88/cve/issues/10; https://vuldb.com/?ctiid.330906; https://vuldb.com/?id.330906
CVE: CVE-2025-12612
Published: 2025-11-03
Description: A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_course. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ProgramShowMaker/CVE/issues/1; https://vuldb.com/?ctiid.330907; https://vuldb.com/?id.330907
CVE: CVE-2025-12614
Published: 2025-11-03
Description: A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/321190176/Best-house-rental-management-system-3/blob/main/report.md; https://vuldb.com/?ctiid.330908; https://vuldb.com/?id.330908
CVE: CVE-2025-12615
Published: 2025-11-03
Description: A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-320, CWE-321
References: https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Hard-coded%20Cryptographic%20Key.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.330909
CVE: CVE-2025-12616
Published: 2025-11-03
Description: A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Performing a manipulation results in insertion of sensitive information into debugging code. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-215
References: https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%20Mode.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.330910
CVE: CVE-2025-12617
Published: 2025-11-03
Description: A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://itsourcecode.com/; https://vuldb.com/?ctiid.330911; https://vuldb.com/?id.330911
CVE: CVE-2025-12503
Published: 2025-11-03
Description: EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10476-c8448-2.html; https://www.twcert.org.tw/tw/cp-132-10475-01c6d-1.html
CVE: CVE-2025-12618
Published: 2025-11-03
Description: A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://pan.baidu.com/s/11fdpTujKw6Xz0yPE2l4cMw; https://vuldb.com/?ctiid.330912; https://vuldb.com/?id.330912
CVE: CVE-2025-12619
Published: 2025-11-03
Description: A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. The manipulation of the argument wpapsk_crypto2_4g results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://pan.baidu.com/s/1N5pzWOYFGl7KGuh9yjlDHg; https://vuldb.com/?ctiid.330913; https://vuldb.com/?id.330913
CVE: CVE-2025-12622
Published: 2025-11-03
Description: A vulnerability was determined in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function formSysRunCmd of the file /goform/SysRunCmd. This manipulation of the argument getui causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://pan.baidu.com/s/1Jl1zy5niigg1XYm8ZCh_Lg; https://vuldb.com/?ctiid.330914; https://vuldb.com/?id.330914
CVE: CVE-2025-12623
Published: 2025-11-03
Description: A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS Score: 3.1 (LOW)
CWE: CWE-285, CWE-639
References: https://github.com/fushengqian/fuint/issues/67; https://vuldb.com/?ctiid.330915; https://vuldb.com/?id.330915
CVE: CVE-2025-48396
Published: 2025-11-03
Description: Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
CVSS Score: 8.3 (HIGH)
CWE: CWE-434
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1021.pdf
CVE: CVE-2025-48397
Published: 2025-11-03
Description: The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004).
CVSS Score: 7.1 (HIGH)
CWE: CWE-306
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1030.pdf
CVE: CVE-2025-0987
Published: 2025-11-03
Description: Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection.This issue affects CVLand: from 2.1.0 through 20251103. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0371
CVE: CVE-2025-12626
Published: 2025-11-03
Description: A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The root cause was initially fixed but can be evaded with additional encoding.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/jeecgboot/jeewx-boot/issues/17; https://github.com/jeecgboot/jeewx-boot/issues/47; https://vuldb.com/?ctiid.330916
CVE: CVE-2025-40107
Published: 2025-11-03
Description: In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

This issue is similar to the vulnerability in the `mcp251x` driver,
which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
sleep before interface was brought up").

In the `hi311x` driver, when the device resumes from sleep, the driver
schedules `priv->restart_work`. However, if the network interface was
not previously enabled, the `priv->wq` (workqueue) is not allocated and
initialized, leading to a null pointer dereference.

To fix this, we move the allocation and initialization of the workqueue
from the `hi3110_open` function to the `hi3110_can_probe` function.
This ensures that the workqueue is properly initialized before it is
used during device resume. And added logic to destroy the workqueue
in the error handling paths of `hi3110_can_probe` and in the
`hi3110_can_remove` function to prevent resource leaks.
References: https://git.kernel.org/stable/c/1d2ef21f02baff0c109ad78b9e835fb4acb14533; https://git.kernel.org/stable/c/6b[PII_REDACTED]97b77b888f50bc789a3bae077743; https://git.kernel.org/stable/c/d1fc4c041459e2d4856c1b2501486ba4f0cbf96b
CVE: CVE-2025-64294
Published: 2025-11-03
Description: Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Snow Effect: from n/a through <= 1.1.19.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-snow-effect/vulnerability/wordpress-wp-snow-effect-plugin-1-1-15-broken-access-control-to-notice-dismissal-vulnerability?_s_id=cve
CVE: CVE-2024-51317
Published: 2025-11-03
Description: An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Fysac/netsurf-disclosure/tree/main/CVE-2024-51317; https://www.netsurf-browser.org/
CVE: CVE-2025-29699
Published: 2025-11-03
Description: NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/Fysac/netsurf-disclosure/tree/main/CVE-2025-29699; https://www.netsurf-browser.org/
CVE: CVE-2025-45663
Published: 2025-11-03
Description: An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-244
References: https://github.com/Fysac/netsurf-disclosure/tree/main/CVE-2025-45663; https://www.netsurf-browser.org/
CVE: CVE-2025-60892
Published: 2025-11-03
Description: An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintentionally re-adds a user's id_rsa.pub key from their local Windows machine to the authorized_keys file on the Raspberry Pi, even after the user explicitly deletes the key from the user interface. This creates an unintended attack surface, as it could allow an attacker to use a different key than the intended one to login to the device.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: https://github.com/raspberrypi/rpi-imager/issues/1185
CVE: CVE-2025-63442
Published: 2025-11-03
Description: Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-5
CVE: CVE-2025-63443
Published: 2025-11-03
Description: School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-6
CVE: CVE-2025-8900
Published: 2025-11-03
Description: The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/doccure-medical-wordpress-theme/34329202; https://www.wordfence.com/threat-intel/vulnerabilities/id/49e133c9-5d3b-4a2a-8385-e2db44baa217?source=cve
CVE: CVE-2025-11761
Published: 2025-11-03
Description: A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://support.hp.com/us-en/document/ish_13[PII_REDACTED]7675-16/hpsbhf04058
CVE: CVE-2025-36091
Published: 2025-11-03
Description: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-283
References: https://www.ibm.com/support/pages/node/7249999
CVE: CVE-2025-36092
Published: 2025-11-03
Description: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1284
References: https://www.ibm.com/support/pages/node/7249999
CVE: CVE-2025-36093
Published: 2025-11-03
Description: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7249999
CVE: CVE-2025-60503
Published: 2025-11-03
Description: A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session, which could lead to session hijacking or other malicious actions.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/H4zaz/CVE-2025-60503; https://ultimatefosters.com
CVE: CVE-2025-60785
Published: 2025-11-03
Description: A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://zdaylabs.com/CVE-2025-60785.html
CVE: CVE-2025-63446
Published: 2025-11-03
Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-7
CVE: CVE-2025-63447
Published: 2025-11-03
Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-8
CVE: CVE-2025-63448
Published: 2025-11-03
Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-9
CVE: CVE-2025-63449
Published: 2025-11-03
Description: Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-9
CVE: CVE-2025-63450
Published: 2025-11-03
Description: Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-11; https://www.linkedin.com/in/shuvo-ahmed-sanin/
CVE: CVE-2025-63451
Published: 2025-11-03
Description: Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-12
CVE: CVE-2025-63452
Published: 2025-11-03
Description: Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-13
CVE: CVE-2025-63453
Published: 2025-11-03
Description: Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-14
CVE: CVE-2025-10280
Published: 2025-11-03
Description: IdentityIQ
8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and
all 8.3 patch levels including 8.3p5, and all prior versions allows some
IdentityIQ web services that provide non-HTML content to be accessed via a URL
path that will set the Content-Type to HTML allowing a requesting browser to
interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.sailpoint.com/security-advisories/sailpoint-identityiq-incorrect-content-type-cross-site-scripting-vulnerability-cve-2025-10280
CVE: CVE-2025-11953
Published: 2025-11-03
Description: The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547; https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability; https://x.com/SzymonRybczak/status/[PII_REDACTED]00566848