deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21474
Published: 2025-09-03
Description: Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilege.
CVSS Score: 6.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21475
Published: 2025-09-03
Description: Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21476
Published: 2025-09-03
Description: Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrary code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21477
Published: 2025-09-03
Description: Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
CVSS Score: 7.9 (HIGH)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21478
Published: 2025-09-03
Description: Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.
CVSS Score: 6.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21479
Published: 2025-09-03
Description: Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule.
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21480
Published: 2025-09-03
Description: Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities.
CVSS Score: 8.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2023&month=04
CVE: CVE-2023-21481
Published: 2025-09-03
Description: Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitive information.
CVSS Score: 5.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=04
CVE: CVE-2023-21482
Published: 2025-09-03
Description: Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13  allows physical attackers to install package through Galaxy store before completion of Setup wizard.
CVSS Score: 6.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=04
CVE: CVE-2023-21483
Published: 2025-09-03
Description: Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exported service.
CVSS Score: 6.4 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=04
CVE: CVE-2023-3666
Published: 2025-09-03
Description: The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 3.3 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c37f1708-c154-41dc-9[PII_REDACTED]eed1b/
CVE: CVE-2025-21025
Published: 2025-09-03
Description: Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execution management.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21026
Published: 2025-09-03
Description: Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21027
Published: 2025-09-03
Description: Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21028
Published: 2025-09-03
Description: Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21029
Published: 2025-09-03
Description: Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies to messages from the cover display.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21030
Published: 2025-09-03
Description: Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows local attackers to execute arbitrary application in the background.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21031
Published: 2025-09-03
Description: Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21032
Published: 2025-09-03
Description: Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditions.
CVSS Score: 5.9 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21033
Published: 2025-09-03
Description: Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21034
Published: 2025-09-03
Description: Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09
CVE: CVE-2025-21035
Published: 2025-09-03
Description: Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data across multiple user profiles.
CVSS Score: 4.6 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-21036
Published: 2025-09-03
Description: Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. User interaction is required for triggering this vulnerability.
CVSS Score: 5.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-21037
Published: 2025-09-03
Description: Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. User interaction is required for triggering this vulnerability.
CVSS Score: 4.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-21038
Published: 2025-09-03
Description: Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-21039
Published: 2025-09-03
Description: Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-21040
Published: 2025-09-03
Description: Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information.
CVSS Score: 5.1 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-21041
Published: 2025-09-03
Description: Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-922
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=09
CVE: CVE-2025-58272
Published: 2025-09-03
Description: Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker, the settings of the product may be unintentionally changed.
CVSS Score: 3.7 (LOW)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN65839588/; https://www.ntt-east.co.jp/info/detail/220903_01.html; https://www.ntt-west.co.jp/info/support/oshirase20250903.html
CVE: CVE-2024-32444
Published: 2025-09-03
Description: Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Theme/realhomes/vulnerability/wordpress-real-homes-plugin-4-3-6-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-58210
Published: 2025-09-03
Description: Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/makeaholic/vulnerability/wordpress-makeaholic-theme-1-8-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-8663
Published: 2025-09-03
Description: Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.0.0 before 5.2.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://support.upkeeper.se/hc/en-us/articles/[PII_REDACTED]8252-CVE-2025-8663-Insertion-of-Sensitive-Information-into-Log-File
CVE: CVE-2025-9378
Published: 2025-09-03
Description: The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/vayu-blocks/tags/1.3.5/trunk/inc/render/lottie/lottie.php#L102; https://plugins.trac.wordpress.org/changeset/3351839/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a92d53ab-9c59-4c9c-93e5-32dd05246249?source=cve
CVE: CVE-2025-9817
Published: 2025-09-03
Description: SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://gitlab.com/wireshark/wireshark/-/issues/20642; https://www.wireshark.org/security/wnpa-sec-2025-03.html
CVE: CVE-2014-125127
Published: 2025-09-03
Description: The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application needs it. An attacker can exploit this by sending requests with large payloads, causing excessive memory consumption and potentially exhausting available server memory, leading to application crashes or service unavailability. The vulnerability was fixed in v1.2 by implementing lazy loading of request bodies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127; https://github.com/mikecao/flight/commit/da40e03eb4a[PII_REDACTED]2dffe926a8fce0d38dc; https://github.com/mikecao/flight/pull/125
CVE: CVE-2024-13063
Published: 2025-09-03
Description: Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft MyRezzta allows Forceful Browsing.This issue affects MyRezzta: from s2.02.02 before v2.05.01.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0205
CVE: CVE-2024-13064
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft MyRezzta allows Cross-Site Scripting (XSS).This issue affects MyRezzta: from s2.02.02 before v2.05.01.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0205
CVE: CVE-2024-13065
Published: 2025-09-03
Description: Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 - Flooding.This issue affects MyRezzta: from s2.02.02 before v2.05.01.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-400, CWE-841
References: https://www.usom.gov.tr/bildirim/tr-25-0205
CVE: CVE-2024-43115
Published: 2025-09-03
Description: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.


This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj; http://www.openwall.com/lists/oss-security/2025/09/03/1
CVE: CVE-2025-1740
Published: 2025-09-03
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force.This issue affects MyRezzta: from s2.03.01 before v2.05.01.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0205
CVE: CVE-2025-2415
Published: 2025-09-03
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass.This issue affects MyRezzta: from s2.03.01 before v2.05.01.
CVSS Score: 8.6 (HIGH)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0205
CVE: CVE-2025-9219
Published: 2025-09-03
Description: The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L1858; https://plugins.trac.wordpress.org/changeset/3353624/; https://www.wordfence.com/threat-intel/vulnerabilities/id/65914bbf-6563-4bf2-a358-885e182a1365?source=cve
CVE: CVE-2024-43166
Published: 2025-09-03
Description: Incorrect Default Permissions vulnerability in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://lists.apache.org/thread/8zd69zkkx55qp365xp4tml1xh9og5lhk; http://www.openwall.com/lists/oss-security/2025/09/03/2
CVE: CVE-2025-9821
Published: 2025-09-03
Description: SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed

DetailsWhen sending webhooks, the destination is not validated, causing SSRF.


ImpactBypass of firewalls to interact with internal services.
See  https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/  for more potential impact.

Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html  for more information on SSRF and its fix.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://github.com/mautic/mautic/security/advisories/GHSA-hj6f-7hp7-xg69
CVE: CVE-2025-41000
Published: 2025-09-03
Description: Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat to web application security. This vulnerability only works in older browsers.
CWE: CWE-1021
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-boomcms
CVE: CVE-2024-13066
Published: 2025-09-03
Description: Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking.This issue affects LimonDesk: from s1.02.14 before v1.02.17.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://www.usom.gov.tr/bildirim/tr-25-0206
CVE: CVE-2025-38678
Published: 2025-09-03
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject duplicate device on updates

A chain/flowtable update with duplicated devices in the same batch is
possible. Unfortunately, netdev event path only removes the first
device that is found, leaving unregistered the hook of the duplicated
device.

Check if a duplicated device exists in the transaction batch, bail out
with EEXIST in such case.

WARNING is hit when unregistering the hook:

 [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150
 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S                  6.16.0+ #170 PREEMPT(full)
 [...]
 [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0521e694d5b80899fba8695881a6349f9bc538cb; https://git.kernel.org/stable/c/3f358a66a[PII_REDACTED]8ea4b40f5064e253d8386; https://git.kernel.org/stable/c/4681960bc0f4f8bcc782cbf2fd205f48ad314dfd
CVE: CVE-2025-3701
Published: 2025-09-03
Description: Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through <= 16.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-malware-removal/vulnerability/wordpress-malcure-malware-scanner-plugin-16-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53691
Published: 2025-09-03
Description: Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/; https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE: CVE-2025-53693
Published: 2025-09-03
Description: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-470
References: https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/; https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
CVE: CVE-2025-53694
Published: 2025-09-03
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/; https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734
CVE: CVE-2025-9901
Published: 2025-09-03
Description: A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-524
References: https://access.redhat.com/security/cve/CVE-2025-9901; https://bugzilla.redhat.com/show_bug.cgi?id=2392790; https://gitlab.gnome.org/GNOME/libsoup/-/issues/453
CVE: CVE-2024-13068
Published: 2025-09-03
Description: Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing.This issue affects LimonDesk: from s1.02.14 before v1.02.17.
CVSS Score: 7.3 (HIGH)
CWE: CWE-346
References: https://www.usom.gov.tr/bildirim/tr-25-0206
CVE: CVE-2025-0878
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS).This issue affects LimonDesk: from s1.02.14 before v1.02.17.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0206
CVE: CVE-2025-26210
Published: 2025-09-03
Description: DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://deepseek.com; https://hackmd.io/@MrqrFIlhQFi7vUwkqbrXDw/deepseek; https://youtu.be/IgQwy52FVT4
CVE: CVE-2025-2416
Published: 2025-09-03
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass.This issue affects LimonDesk: from s1.02.14 before v1.02.17.
CVSS Score: 8.6 (HIGH)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0206