deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6430
Published: 2025-06-24
Description: When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `&lt;embed&gt;` or `&lt;object&gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1971140; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-53/
CVE: CVE-2025-6431
Published: 2025-06-24
Description: When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. 
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1942716; https://www.mozilla.org/security/advisories/mfsa2025-51/
CVE: CVE-2025-6432
Published: 2025-06-24
Description: When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1943804; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE: CVE-2025-6433
Published: 2025-06-24
Description: If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete.  This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1954033; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE: CVE-2025-6434
Published: 2025-06-24
Description: The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1955182; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE: CVE-2025-6435
Published: 2025-06-24
Description: If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1950056; https://bugzilla.mozilla.org/show_bug.cgi?id=1961777; https://www.mozilla.org/security/advisories/mfsa2025-51/
CVE: CVE-2025-6436
Published: 2025-06-24
Description: Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1941377%2C1960948%2C1966187%2C1966505%2C1970764%2C1942930; https://www.mozilla.org/security/advisories/mfsa2025-51/; https://www.mozilla.org/security/advisories/mfsa2025-54/
CVE: CVE-2025-6565
Published: 2025-06-24
Description: A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function http_d of the component HTTP POST Request Handler. The manipulation of the argument Host leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/xiaobor123/vul-finds/tree/main/vul-find-wnce3001-netgear; https://github.com/xiaobor123/vul-finds/tree/main/vul-find-wnce3001-netgear#poc; https://vuldb.com/?ctiid.313737
CVE: CVE-2025-6566
Published: 2025-06-24
Description: A vulnerability was found in oatpp Oat++ up to 1.3.1. It has been declared as critical. This vulnerability affects the function deserializeArray of the file src/oatpp/json/Deserializer.cpp. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/oatpp/oatpp/issues/1037; https://github.com/user-attachments/files/19579448/oatpp_crash.txt; https://vuldb.com/?ctiid.313738
CVE: CVE-2025-27827
Published: 2025-06-24
Description: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper handling of session data. A successful exploit requires user interaction and could allow an attacker to access sensitive information, leading to unauthorized access to active chat rooms, reading chat data, and sending messages during an active chat session.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0002-0
CVE: CVE-2025-27828
Published: 2025-06-24
Description: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts with a limited impact on the confidentiality and the integrity.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0003
CVE: CVE-2025-5318
Published: 2025-06-24
Description: A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:18231; https://access.redhat.com/errata/RHSA-2025:18275; https://access.redhat.com/errata/RHSA-2025:18286
CVE: CVE-2025-6032
Published: 2025-06-24
Description: A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVSS Score: 8.3 (HIGH)
CWE: CWE-295
References: https://access.redhat.com/errata/RHSA-2025:10295; https://access.redhat.com/errata/RHSA-2025:10549; https://access.redhat.com/errata/RHSA-2025:10550
CVE: CVE-2025-32975
Published: 2025-06-24
Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287
References: https://seclists.org/fulldisclosure/2025/Jun/22; https://seralys.com/research/CVE-2025-32975.txt; https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
CVE: CVE-2025-32976
Published: 2025-06-24
Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains a logic flaw in its two-factor authentication implementation that allows authenticated users to bypass TOTP-based 2FA requirements. The vulnerability exists in the 2FA validation process and can be exploited to gain elevated access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://seclists.org/fulldisclosure/2025/Jun/23; https://seralys.com/research/CVE-2025-32976.txt; https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
CVE: CVE-2025-32977
Published: 2025-06-24
Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-347
References: https://seclists.org/fulldisclosure/2025/Jun/24; https://seralys.com/research/CVE-2025-32977.txt; https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
CVE: CVE-2025-32978
Published: 2025-06-24
Description: Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to replace system licenses through a web interface intended for license renewal. Attackers can exploit this to replace valid licenses with expired or trial licenses, causing denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://seclists.org/fulldisclosure/2025/Jun/25; https://seralys.com/research/CVE-2025-32978.txt; https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
CVE: CVE-2025-36537
Published: 2025-06-24
Description: Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1002/
CVE: CVE-2025-6567
Published: 2025-06-24
Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file Recruitment/admin/view_application.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Sp1d3rL1/CVE/issues/3; https://vuldb.com/?ctiid.313739; https://vuldb.com/?id.313739
CVE: CVE-2025-6568
Published: 2025-06-24
Description: A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formIpv6Setup of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/d2pq/cve/blob/main/616/23.md; https://github.com/d2pq/cve/blob/main/616/23.md#poc; https://vuldb.com/?ctiid.313740
CVE: CVE-2025-6569
Published: 2025-06-24
Description: A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. Affected by this vulnerability is an unknown functionality of the file /student.php. The manipulation of the argument sname/contact/about/emailid/transcation_remark leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/18; https://vuldb.com/?ctiid.313741
CVE: CVE-2021-41691
Published: 2025-06-24
Description: A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Classic/; https://opensis.com/; https://resources.s4e.io/blog/opensis-student-information-system-0-day-vulnerability-cve-2021-41691/
CVE: CVE-2025-23264
Published: 2025-06-24
Description: NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Escalation of Privileges, Information Disclosure and Data Tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5663
CVE: CVE-2025-23265
Published: 2025-06-24
Description: NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Escalation of Privileges, Information Disclosure and Data Tampering.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5663
CVE: CVE-2025-44531
Published: 2025-06-24
Description: An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://realtek.com; http://rtl8762ekf-evb.com; https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Pairing_Random_Before_Pairing_Public_Key.md
CVE: CVE-2025-4383
Published: 2025-06-24
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot allows Authentication Abuse, Authentication Bypass.This issue affects Wi-Fi Cloud Hotspot: before 30.05.2025.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0134
CVE: CVE-2025-50693
Published: 2025-06-24
Description: PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://github.com/blackm4c/cve/blob/master/phpgurukul/odms/idor/README.md
CVE: CVE-2025-50695
Published: 2025-06-24
Description: PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/invoice-generating.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/blackm4c/cve/tree/master/phpgurukul/odms/1.stored_xss
CVE: CVE-2025-50699
Published: 2025-06-24
Description: PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/blackm4c/cve/tree/master/phpgurukul/odms/2.stored_xss
CVE: CVE-2025-6570
Published: 2025-06-24
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown functionality of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Ant1sec-ops/HMS4.0-Avdisories/blob/main/Union-based-sqli-on-doctor-search/exploit.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.313742
CVE: CVE-2024-56918
Published: 2025-06-24
Description: In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/netbox-community/netbox/releases/tag/v4.1.7; https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56918; https://youtu.be/GC8-PUlu2i8?si=cd_dSVno93pCisr-&t=103
CVE: CVE-2025-4378
Published: 2025-06-24
Description: Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentication Abuse, Authentication Bypass.This issue affects ATA-AOF Mobile Application: before 20.06.2025.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-319, CWE-798
References: https://www.usom.gov.tr/bildirim/tr-25-0135
CVE: CVE-2024-56916
Published: 2025-06-24
Description: In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/netbox-community/netbox/releases/tag/v4.1.7; https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56916; https://www.youtube.com/watch?v=GC8-PUlu2i8
CVE: CVE-2025-23260
Published: 2025-06-24
Description: NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-266
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5660
CVE: CVE-2025-49147
Published: 2025-06-24
Description: Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to brute force derive a user's password. This information was not exposed in Umbraco 7 or 8, nor in 14 or higher versions. The vulnerability is patched in versions 10.8.11 and 13.9.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://github.com/umbraco/Umbraco-CMS/commit/b4144564c836ec6929111ce2a12eb1f67b42d61e; https://github.com/umbraco/Umbraco-CMS/commit/d8f68d2c40f8e158bd81d469f25ef3a4e1d86c4c; https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-pgvc-6h2p-q4f6
CVE: CVE-2025-53073
Published: 2025-06-24
Description: In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) without being a member of the project's team. A seven-digit issue ID must be known (it is not treated as a secret and might be mentioned publicly, or it could be predicted).
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-425
References: https://github.com/getsentry/self-hosted/releases; https://github.com/nikolas-ch/CVEs/blob/main/Sentry_Version%3E%3D25.1.0/Sentry_%3E%3D25.1.0_WeakAuthorizationControl.txt; https://github.com/nikolas-ch/CVEs/tree/main/Sentry_Version%3E%3D25.1.0
CVE: CVE-2025-2566
Published: 2025-06-24
Description: Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server.
CWE: CWE-502
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
CVE: CVE-2025-5087
Published: 2025-06-24
Description: Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credentials.
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
CVE: CVE-2024-37743
Published: 2025-06-24
Description: An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/mmz-001/knowledge_gpt/blob/main/knowledge_gpt/main.py; https://medium.com/@cnetsec/vulnerability-identified-in-knowledgegpt-version-0-0-5-5168ec081842
CVE: CVE-2024-56917
Published: 2025-06-24
Description: Netbox Community 4.1.7 is vulnerable to Cross Site Scripting (XSS) via the maintenance banner` in maintenance mode.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/netbox-community/netbox/releases/tag/v4.1.7; https://github.com/noxlumens/Vulnerability-Research/tree/main/CVE-2024-56917; https://youtu.be/GC8-PUlu2i8?si=eoScOk8IUJdwPDc_&t=172
CVE: CVE-2025-49851
Published: 2025-06-24
Description: ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-05
CVE: CVE-2025-49852
Published: 2025-06-24
Description: ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-05
CVE: CVE-2025-49853
Published: 2025-06-24
Description: ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-05