deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-46116
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to escape the restricted shell and obtain a root shell on the controller.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46117
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script `.ap_debug.sh` invoked from the restricted CLI does not properly sanitize its input, allowing an authenticated attacker to execute arbitrary commands as root on the controller or specified target.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46118
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials for the ftpuser account provide FTP access to the controller, enabling a remote attacker to upload or retrieve arbitrary files from writable firmware directories and thereby expose sensitive information or compromise the controller.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46119
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an authenticated request to the management endpoint `/admin/_cmdstat.jsp` discloses the administrator password in a trivially reversible obfuscated form. The same obfuscation method persists in configuration prior to 200.18.7.1.302, allowing anyone who obtains the system configuration to recover the plaintext credentials.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-555
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46120
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated attacker who can upload a template (e.g., via FTP) to escalate privileges and run arbitrary template code on the controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46121
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted request to the authenticated endpoint `/admin/_conf.jsp`, or without authentication and without direct network access to the controller by spoofing the MAC address of a favourite station and embedding malicious format specifiers in the DHCP hostname field, resulting in unauthenticated format-string processing and arbitrary code execution on the controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46122
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute arbitrary commands as root.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-46123
Published: 2025-07-21
Description: An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest password to memory with snprintf using the attacker-supplied value as the format string; a crafted password therefore triggers uncontrolled format-string processing and enables remote code execution on the controller.
CVSS Score: 7.2 (HIGH)
CWE: CWE-134
References: https://sector7.computest.nl/post/2025-07-ruckus-unleashed/; https://support.ruckuswireless.com/security_bulletins/330
CVE: CVE-2025-7927
Published: 2025-07-21
Description: A vulnerability has been found in PHPGurukul Online Banquet Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/view-user-queries.php. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/LagonGit/ReportCVE/issues/5; https://github.com/LagonGit/ReportCVE/issues/5#issue[PII_REDACTED]; https://phpgurukul.com/
CVE: CVE-2025-7928
Published: 2025-07-21
Description: A vulnerability was found in code-projects Church Donation System 1.0 and classified as critical. This issue affects some unknown processing of the file /members/edit_user.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/n0name-yang/myCVE/issues/13; https://vuldb.com/?ctiid.317057
CVE: CVE-2024-55040
Published: 2025-07-21
Description: Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tcbutler320/Sensaphone-WEB600-XSS; https://sensaphone.com/products/sensaphone-web600-monitoring-system; https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-55040
CVE: CVE-2025-44647
Published: 2025-07-21
Description: In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks on the openly transmitted hash of the PSK.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1188
References: http://tew-wlc100p.com; https://gist.github.com/TPCchecker/18c32439ed13feaed99f8229d1749892; https://www.notion.so/CVE-2025-44647-24754a1113e780b0a130d4439861bf3c
CVE: CVE-2025-44650
Published: 2025-07-21
Description: In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS attacks when unlimited users are connected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/TPCchecker/d13d15dfa8965ba88a9437718f77f67d; https://www.netgear.com/about/security/; https://www.notion.so/CVE-2025-44650-24754a1113e780dca89dca218b90b1d9
CVE: CVE-2025-44651
Published: 2025-07-21
Description: In TRENDnet TPL-430AP FW1.0, the USERLIMIT_GLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://trendnet.com; https://gist.github.com/TPCchecker/9e27534ec59babcd4fd44d18fe7a56b3; https://www.notion.so/CVE-2025-44651-24754a1113e780da990eec3961100ae0
CVE: CVE-2025-44655
Published: 2025-07-21
Description: In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: http://totolink.com; https://gist.github.com/TPCchecker/d7306649f51ca25e22dd6532546a58f3
CVE: CVE-2025-44657
Published: 2025-07-21
Description: In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
CVSS Score: 3.9 (LOW)
CWE: CWE-284
References: http://ea6350.com; https://gist.github.com/TPCchecker/7839fbd329ebd2f9f6b105c4926d4b0c
CVE: CVE-2025-44658
Published: 2025-07-21
Description: In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/TPCchecker/c72eea7a3f89070dab7dfdbf7504b2d6; https://www.netgear.com/about/security/; https://www.notion.so/CVE-2025-44658-24754a1113e780df8f72c779a108f75b
CVE: CVE-2025-52372
Published: 2025-07-21
Description: An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-200
References: https://github.com/hmailserver/hmailserver; https://github.com/mojibake-dev/hMailEnum; https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52372.md
CVE: CVE-2025-52373
Published: 2025-07-21
Description: Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-321
References: https://github.com/hmailserver/hmailserver; https://github.com/mojibake-dev/hMailEnum; https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52373.md
CVE: CVE-2025-52374
Published: 2025-07-21
Description: Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-321
References: https://github.com/hmailserver/hmailserver; https://github.com/mojibake-dev/hMailEnum; https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52374.md
CVE: CVE-2025-7929
Published: 2025-07-21
Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /members/edit_Members.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/n0name-yang/myCVE/issues/14; https://vuldb.com/?ctiid.317058
CVE: CVE-2025-7930
Published: 2025-07-21
Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /members/add_members.php. The manipulation of the argument mobile leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/n0name-yang/myCVE/issues/15; https://vuldb.com/?ctiid.317059
CVE: CVE-2025-30477
Published: 2025-07-21
Description: Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-327
References: https://www.dell.com/support/kbdoc/en-us/000317419/dsa-2025-192-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
CVE: CVE-2025-32744
Published: 2025-07-21
Description: Dell AppSync, version(s) 4.6.0.0, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434
References: https://www.dell.com/support/kbdoc/en-us/000345331/dsa-2025-277-security-update-for-dell-appsync-vulnerabilities
CVE: CVE-2025-36603
Published: 2025-07-21
Description: Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure and Information tampering.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000345331/dsa-2025-277-security-update-for-dell-appsync-vulnerabilities
CVE: CVE-2025-43720
Published: 2025-07-21
Description: Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/h-mdm/hmdm-server/commit/19e4a63f732c99064444df7e8c61b4f01df362e8; https://github.com/h-mdm/hmdm-server/compare/v5.32.1...v5.33.1; https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720
CVE: CVE-2025-44649
Published: 2025-07-21
Description: In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary attacks, and lacks flexibility in negotiating security parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://tew-wlc100p.com; https://gist.github.com/TPCchecker/6d787c4916891f493b274b70abfad860; https://www.notion.so/CVE-2025-44649-24754a1113e780a4a1d1c4cd6d3ff345
CVE: CVE-2025-44653
Published: 2025-07-21
Description: In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://h3c.com; https://gist.github.com/TPCchecker/1193f51fc870b597c8a59860199d50e4; https://www.notion.so/CVE-2025-44653-24754a1113e780fab128c2c5752f5703
CVE: CVE-2025-54082
Published: 2025-07-21
Description: marshmallow-packages/nova-tiptap is a rich text editor for Laravel Nova based on tiptap. Prior to 5.7.0, a vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application. The vulnerability is due to missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint, the lack of validation on uploaded files (no MIME/type or extension restrictions), and the ability for an attacker to choose the disk parameter dynamically. This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments. This vulnerability was fixed in 5.7.0.
CWE: CWE-434
References: https://github.com/marshmallow-packages/nova-tiptap/commit/fed42d2f8ebb9e3c74f1ee262c9db[PII_REDACTED]6; https://github.com/marshmallow-packages/nova-tiptap/security/advisories/GHSA-96c2-h667-9fxp
CVE: CVE-2025-7392
Published: 2025-07-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-087
CVE: CVE-2025-7393
Published: 2025-07-21
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://www.drupal.org/sa-contrib-2025-088
CVE: CVE-2025-7715
Published: 2025-07-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-090
CVE: CVE-2025-7716
Published: 2025-07-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting (XSS).This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-091
CVE: CVE-2025-7717
Published: 2025-07-21
Description: Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-089
CVE: CVE-2025-7931
Published: 2025-07-21
Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /members/admin_pic.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/n0name-yang/myCVE/issues/16; https://vuldb.com/?ctiid.317060
CVE: CVE-2025-7932
Published: 2025-07-21
Description: A vulnerability classified as critical has been found in D-Link DIR‑817L up to 1.04B01. This affects the function lxmldbc_system of the file ssdpcgi. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/Patr1ck-S/Patr1ck-S.github.io/blob/main/D-Link%20DIR%E2%80%91817L%20has%20a%20remote%20arbitrary%20command%20execution%20vulnerability%20in%20ssdpcgi(1).md; https://vuldb.com/?ctiid.317061; https://vuldb.com/?id.317061
CVE: CVE-2025-36107
Published: 2025-07-21
Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7239635
CVE: CVE-2025-36845
Published: 2025-07-21
Description: An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the application server.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://smartoffice.expert/en; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt
CVE: CVE-2025-36846
Published: 2025-07-21
Description: An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be chained with CVE-2025-36845.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://smartoffice.expert/en/; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-034.txt
CVE: CVE-2025-44652
Published: 2025-07-21
Description: In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited users are connected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gist.github.com/TPCchecker/cb4549b7689727efeb24de0802c0fde3; https://www.netgear.com/about/security/; https://www.notion.so/CVE-2025-44652-24754a1113e78003909afbd6f7fd707b
CVE: CVE-2025-44654
Published: 2025-07-21
Description: In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://e2500.com; https://gist.github.com/TPCchecker/279708bf9c599c836ea66f3a3e0c25e1
CVE: CVE-2025-52575
Published: 2025-07-21
Description: EspoCRM is an Open Source CRM (Customer Relationship Management) software. EspoCRM versions 9.1.6 and earlier are vulnerable to blind LDAP Injection when LDAP authentication is enabled. A remote, unauthenticated attacker can manipulate LDAP queries by injecting crafted input containing wildcard characters (e.g., *). This may allow the attacker to bypass authentication controls, enumerate valid usernames, or retrieve sensitive directory information depending on the LDAP server configuration. This was fixed in version 9.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-90
References: https://github.com/espocrm/espocrm/commit/8649f1ac0ce714b2c31727bca3dd95d06e17337f; https://github.com/espocrm/espocrm/security/advisories/GHSA-rjm8-77fr-4f3v
CVE: CVE-2025-7933
Published: 2025-07-21
Description: A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/settings_update.php of the component Setting Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhaodaojie/cve/issues/5; https://vuldb.com/?ctiid.317062; https://vuldb.com/?id.317062