deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1354
Published: 2025-02-16
Description: A cross-site scripting (XSS)  vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validation and can be triggered via the manipulation of the SSID argument in the sysinfo.asp file, leading to disclosure of sensitive information. Note: All versions of RT-N10E and RT-N12E are unsupported (End-of-Life, EOL). Consumers can mitigate this vulnerability by disabling the remote access features from WAN
CWE: CWE-79
References: https://vuldb.com/?ctiid.295962; https://vuldb.com/?id.295962; https://vuldb.com/?submit.496013
CVE: CVE-2025-1355
Published: 2025-02-16
Description: A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /signup.php of the component Add Picture. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.295963; https://vuldb.com/?id.295963; https://vuldb.com/?submit.496075
CVE: CVE-2025-1356
Published: 2025-02-16
Description: A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file card.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.295964; https://vuldb.com/?id.295964; https://vuldb.com/?submit.496087
CVE: CVE-2025-1357
Published: 2025-02-16
Description: A vulnerability classified as problematic has been found in Seventh D-Guard up to 20250206. This affects an unknown part of the component HTTP GET Request Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.295965; https://vuldb.com/?id.295965; https://vuldb.com/?submit.496137
CVE: CVE-2025-1358
Published: 2025-02-16
Description: A vulnerability classified as problematic was found in Pix Software Vivaz 6.0.10. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://vuldb.com/?ctiid.295966; https://vuldb.com/?id.295966; https://vuldb.com/?submit.496141
CVE: CVE-2025-1359
Published: 2025-02-16
Description: A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown processing of the file /qrcode.jsp. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.295967; https://vuldb.com/?id.295967; https://vuldb.com/?submit.496171
CVE: CVE-2025-1360
Published: 2025-02-16
Description: A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msg_to leads to cross site scripting. It is possible to launch the attack remotely. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.295968; https://vuldb.com/?id.295968; https://vuldb.com/?submit.496469
CVE: CVE-2024-44044
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandexponents Oshine Modules oshine-modules allows Reflected XSS.This issue affects Oshine Modules: from n/a through < 3.3.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/oshine-modules/vulnerability/wordpress-oshine-modules-plugin-3-3-8-reflected-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-1364
Published: 2025-02-16
Description: A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is the function passPrompt of the component USB Protection Service. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md; https://vuldb.com/?ctiid.295969; https://vuldb.com/?id.295969
CVE: CVE-2025-22284
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-unishippers-edition/vulnerability/wordpress-ltl-freight-quotes-unishippers-edition-plugin-2-5-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22286
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.21.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-worldwide-express-edition/vulnerability/wordpress-ltl-freight-quotes-worldwide-express-edition-plugin-5-0-21-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22289
Published: 2025-02-16
Description: Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-unishippers-edition/vulnerability/wordpress-ltl-freight-quotes-unishippers-edition-plugin-2-5-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22290
Published: 2025-02-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows SQL Injection.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-freightquote-edition/vulnerability/wordpress-ltl-freight-quotes-freightquote-edition-plugin-2-3-11-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22291
Published: 2025-02-16
Description: Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-worldwide-express-edition/vulnerability/wordpress-ltl-freight-quotes-worldwide-express-edition-plugin-5-0-20-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-22676
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in upcasted AWS S3 for WordPress Plugin – Upcasted upcasted-s3-offload allows Stored XSS.This issue affects AWS S3 for WordPress Plugin – Upcasted: from n/a through <= 3.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/upcasted-s3-offload/vulnerability/wordpress-upcasted-s3-offload-plugin-3-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22680
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Ad Inserter Pro allows Reflected XSS. This issue affects Ad Inserter Pro: from n/a through 2.7.39.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/ad-inserter-pro/vulnerability/wordpress-ad-inserter-pro-plugin-2-7-39-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22689
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Levan Tarbor Forex Calculators fx-calculators allows Stored XSS.This issue affects Forex Calculators: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fx-calculators/vulnerability/wordpress-forex-calculators-plugin-1-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23975
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/botnet-attack-blocker/vulnerability/wordpress-botnet-attack-blocker-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26755
Published: 2025-02-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider allows Blind SQL Injection.This issue affects WP Airbnb Review Slider: from n/a through <= 3.9.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-airbnb-review-slider/vulnerability/wordpress-wp-airbnb-review-slider-plugin-3-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26759
Published: 2025-02-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet Manager: from n/a through <= 1.1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/content-snippet-manager/vulnerability/wordpress-content-snippet-manager-plugin-1-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26761
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26765
Published: 2025-02-16
Description: Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.22.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-22-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26766
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows Stored XSS.This issue affects Leyka: from n/a through <= 3.31.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/leyka/vulnerability/wordpress-leyka-plugin-3-31-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26767
Published: 2025-02-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/qubely/vulnerability/wordpress-qubely-advanced-gutenberg-blocks-plugin-1-8-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26768
Published: 2025-02-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field 3-word-address-validation-field allows Stored XSS.This issue affects what3words Address Field: from n/a through <= 4.0.15.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/3-word-address-validation-field/vulnerability/wordpress-what3words-address-field-plugin-4-0-15-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26779
Published: 2025-02-16
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Path Traversal.This issue affects Keep Backup Daily: from n/a through <= 2.1.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/keep-backup-daily/vulnerability/wordpress-keep-backup-daily-plugin-2-1-0-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-0591
Published: 2025-02-17
Description: Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf; https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf
CVE: CVE-2025-1365
Published: 2025-02-17
Description: A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://sourceware.org/bugzilla/attachment.cgi?id=15925; https://sourceware.org/bugzilla/show_bug.cgi?id=32654; https://sourceware.org/bugzilla/show_bug.cgi?id=32654#c2
CVE: CVE-2025-1366
Published: 2025-02-17
Description: A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this issue is the function strcpy of the component VirusPopUp. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md; https://vuldb.com/?ctiid.295970; https://vuldb.com/?id.295970
CVE: CVE-2025-1367
Published: 2025-02-17
Description: A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been classified as critical. This affects the function sprintf of the component USB Password Handler. The manipulation leads to buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md; https://vuldb.com/?ctiid.295971; https://vuldb.com/?id.295971
CVE: CVE-2025-1368
Published: 2025-02-17
Description: A vulnerability was found in MicroWord eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects the function ReadConfiguration of the file /opt/MicroWorld/etc/mwav.conf. The manipulation of the argument BasePath leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.3 (LOW)
CWE: CWE-119, CWE-120
References: https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md; https://vuldb.com/?ctiid.295972; https://vuldb.com/?id.295972
CVE: CVE-2025-1369
Published: 2025-02-17
Description: A vulnerability classified as critical was found in MicroWord eScan Antivirus 7.0.32 on Linux. Affected by this vulnerability is an unknown functionality of the component USB Password Handler. The manipulation leads to os command injection. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md; https://vuldb.com/?ctiid.295975; https://vuldb.com/?id.295975
CVE: CVE-2025-1370
Published: 2025-02-17
Description: A vulnerability, which was classified as critical, has been found in MicroWorld eScan Antivirus 7.0.32 on Linux. Affected by this issue is the function sprintf of the file epsdaemon of the component Autoscan USB. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/dmknght/FIS_RnD/blob/main/escan_av_usb_protection_multiple_vulns.md; https://vuldb.com/?ctiid.295976; https://vuldb.com/?id.295976
CVE: CVE-2025-1371
Published: 2025-02-17
Description: A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476, CWE-476
References: https://sourceware.org/bugzilla/attachment.cgi?id=15926; https://sourceware.org/bugzilla/show_bug.cgi?id=32655; https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2
CVE: CVE-2025-1372
Published: 2025-02-17
Description: A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://sourceware.org/bugzilla/attachment.cgi?id=15927; https://sourceware.org/bugzilla/show_bug.cgi?id=32656; https://sourceware.org/bugzilla/show_bug.cgi?id=32656#c3
CVE: CVE-2025-26700
Published: 2025-02-17
Description: Authentication bypass using an alternate path or channel issue exists in ”RoboForm Password Manager" App for Android versions prior to 9.7.4, which may allow an attacker with access to a device where the application is installed to bypass the lock screen and obtain sensitive information.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-288
References: https://jvn.jp/en/vu/JVNVU92071645/; https://www.roboform.com/news-android
CVE: CVE-2025-1373
Published: 2025-02-17
Description: A vulnerability was found in FFmpeg up to 7.1. It has been rated as problematic. Affected by this issue is the function mov_read_trak of the file libavformat/mov.c of the component MOV Parser. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The patch is identified as 43be8d07281caca2e88bfd8ee2333633e1fb1a13. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://ffmpeg.org/; https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/43be8d07281caca2e88bfd8ee2333633e1fb1a13; https://trac.ffmpeg.org/attachment/ticket/11460/poc
CVE: CVE-2025-1374
Published: 2025-02-17
Description: A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /search.php. The manipulation of the argument StateName/CityName/AreaName/CatId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/1337g/realestatepropertymanagement_poc/blob/main/sql-gu2.pdf; https://vuldb.com/?ctiid.295983
CVE: CVE-2025-1387
Published: 2025-02-17
Description: Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1390
References: https://www.twcert.org.tw/en/cp-139-8428-59a9a-2.html; https://www.twcert.org.tw/tw/cp-132-8427-daea8-1.html
CVE: CVE-2025-1388
Published: 2025-02-17
Description: Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-8430-32513-2.html; https://www.twcert.org.tw/tw/cp-132-8429-07d7e-1.html