deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-38465
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

netlink: Fix wraparounds of sk->sk_rmem_alloc.

Netlink has this pattern in some places

  if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
  	atomic_add(skb->truesize, &sk->sk_rmem_alloc);

, which has the same problem fixed by commit 5a465a0da13e ("udp:
Fix multiple wraparounds of sk->sk_rmem_alloc.").

For example, if we set INT_MAX to SO_RCVBUFFORCE, the condition
is always false as the two operands are of int.

Then, a single socket can eat as many skb as possible until OOM
happens, and we can see multiple wraparounds of sk->sk_rmem_alloc.

Let's fix it by using atomic_add_return() and comparing the two
variables as unsigned int.

Before:
  [root@fedora ~]# ss -f netlink
  Recv-Q      Send-Q Local Address:Port                Peer Address:Port
  [PII_REDACTED] 0               rtnl:nl_wraparound/293               *

After:
  [root@fedora ~]# ss -f netlink
  Recv-Q     Send-Q Local Address:Port                Peer Address:Port
 [PII_REDACTED] 0               rtnl:nl_wraparound/290               *
  ^
  `--- INT_MAX - 576
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4b8e18af7bea92f8b7fb92d40aeae729209db250; https://git.kernel.org/stable/c/55baecb9eb90238f60a8350660d6762046ebd3bd; https://git.kernel.org/stable/c/76602d8e[PII_REDACTED]b0687dc32cd8f19164d5a
CVE: CVE-2025-38466
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

perf: Revert to requiring CAP_SYS_ADMIN for uprobes

Jann reports that uprobes can be used destructively when used in the
middle of an instruction. The kernel only verifies there is a valid
instruction at the requested offset, but due to variable instruction
length cannot determine if this is an instruction as seen by the
intended execution stream.

Additionally, Mark Rutland notes that on architectures that mix data
in the text segment (like arm64), a similar things can be done if the
data word is 'mistaken' for an instruction.

As such, require CAP_SYS_ADMIN for uprobes.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/183bdb89af1b5193b1d1d[PII_REDACTED]b15ca6fa4; https://git.kernel.org/stable/c/8e8bf7bc6aa6f583336c2fda280b6cea0aed5612; https://git.kernel.org/stable/c/a0a8009083e569b5526c64f7d3f2a62baca95164
CVE: CVE-2025-38467
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling

If there's support for another console device (such as a TTY serial),
the kernel occasionally panics during boot. The panic message and a
relevant snippet of the call stack is as follows:

  Unable to handle kernel NULL pointer dereference at virtual address[PII_REDACTED]00000
  Call trace:
    drm_crtc_handle_vblank+0x10/0x30 (P)
    decon_irq_handler+0x88/0xb4
    [...]

Otherwise, the panics don't happen. This indicates that it's some sort
of race condition.

Add a check to validate if the drm device can handle vblanks before
calling drm_crtc_handle_vblank() to avoid this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/391e5ea5b877230b844c9bd8bbcd91b681b1ce2d; https://git.kernel.org/stable/c/87825fbd1e176cd5b896940f3959e7c9a916945d; https://git.kernel.org/stable/c/996740652e620ef8ee1e5c65832cf2ffa498577d
CVE: CVE-2025-3508
Published: 2025-07-25
Description: Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print job information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]8125-16/hpsbpi04039
CVE: CVE-2025-3873
Published: 2025-07-25
Description: The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corruption on the host (Cortex-M4) application.


sl_si91x_aes
sl_si91x_gcm
sl_si91x_ccm 
sl_si91x_sha
CWE: CWE-787
References: https://community.silabs.com/068Vm00000SSlOu; https://docs.silabs.com/wiseconnect/latest/sisdk-wifi-release-notes/
CVE: CVE-2025-45466
Published: 2025-07-25
Description: Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://github.com/zgsnj123/CVE-2025-45466; https://www.unitree.com/cn/go1
CVE: CVE-2023-53155
Published: 2025-07-25
Description: goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/51762
CVE: CVE-2025-29628
Published: 2025-07-25
Description: A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-924, CWE-77, CWE-200
References: https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md; https://mygardyn.com/blog/security-update/; https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03
CVE: CVE-2025-29629
Published: 2025-07-25
Description: Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1392, CWE-94, CWE-200
References: https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29629.md; https://mygardyn.com/blog/security-update/; https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03
CVE: CVE-2025-29630
Published: 2025-07-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue; there is no indication that an applicable SSH private key has ever been compromised. Notes: none.
CVE: CVE-2025-29631
Published: 2025-07-25
Description: Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-94
References: https://github.com/mselbrede/gardyn/blob/main/CVE-2025-29628_CVE-2025-29631.md; https://mygardyn.com/blog/security-update/; https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03
CVE: CVE-2025-36727
Published: 2025-07-25
Description: Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12.
CVSS Score: 8.3 (HIGH)
CWE: CWE-829
References: https://www.tenable.com/security/research/tra-2025-24
CVE: CVE-2025-36728
Published: 2025-07-25
Description: Cross-Site Request Forgery (CSRF) vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.11.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2025-24
CVE: CVE-2025-45406
Published: 2025-07-25
Description: A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/advisories/GHSA-7h5r-54mm-w4pq; https://medium.com/@talktoshweta0/when-debugging-bites-back-exposing-a-persistent-xss-in-codeigniter4-c9caf804a190; https://nvd.nist.gov/vuln/detail/CVE-2020-15943
CVE: CVE-2025-45892
Published: 2025-07-25
Description: OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's editor is not properly sanitized or escaped before being rendered. This allows attackers to inject malicious JavaScript code
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstorm.news/files/id/202886; https://www.opencart.com
CVE: CVE-2025-45893
Published: 2025-07-25
Description: OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstorm.news/files/id/202886; https://www.opencart.com
CVE: CVE-2025-45960
Published: 2025-07-25
Description: Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tawkto.com; https://github.com/pracharapol/CVE-2025-45960
CVE: CVE-2025-54596
Published: 2025-07-25
Description: Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://bugcrowd.com/disclosures/b2406123-c02d-47cf-bcf1-8af57e1de526/no-rbac-validation-on-api-requests-user-management
CVE: CVE-2025-8161
Published: 2025-07-25
Description: A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. Affected by this vulnerability is an unknown functionality of the file /system/role/export. The manipulation of the argument params[dataScope] leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLQQG; https://vuldb.com/?ctiid.317575; https://vuldb.com/?id.317575
CVE: CVE-2025-8162
Published: 2025-07-25
Description: A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the file /system/dept/list. The manipulation of the argument params[dataScope] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLQKV; https://vuldb.com/?ctiid.317576; https://vuldb.com/?id.317576
CVE: CVE-2025-46199
Published: 2025-07-25
Description: Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://rapid-echo-f9c.notion.site/Grav-XSS-25-04-21-1dcaf8998a078001a2eff3dc47974d6d?pvs=4; https://tyojong.tistory.com/2
CVE: CVE-2025-5449
Published: 2025-07-25
Description: A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://access.redhat.com/security/cve/CVE-2025-5449; https://bugzilla.redhat.com/show_bug.cgi?id=2369705; https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=261612179f740bc62ba363d98b3bd5e5573a811f
CVE: CVE-2025-8163
Published: 2025-07-25
Description: A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/role/list. The manipulation of the argument params[dataScope] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://gitee.com/deerwms/deer-wms-2/issues/ICLQFL; https://vuldb.com/?ctiid.317577; https://vuldb.com/?id.317577
CVE: CVE-2025-8164
Published: 2025-07-25
Description: A vulnerability has been found in code-projects Public Chat Room 1.0 and classified as critical. This vulnerability affects unknown code of the file send_message.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kbhjt/cve/issues/3; https://vuldb.com/?ctiid.317578
CVE: CVE-2025-52446
Published: 2025-07-25
Description: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.0 (HIGH)
CWE: CWE-639
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52447
Published: 2025-07-25
Description: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52448
Published: 2025-07-25
Description: Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52449
Published: 2025-07-25
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.5 (HIGH)
CWE: CWE-434
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52452
Published: 2025-07-25
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52453
Published: 2025-07-25
Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52454
Published: 2025-07-25
Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-52455
Published: 2025-07-25
Description: Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://help.salesforce.com/s/articleView?id=005105043&type=1
CVE: CVE-2025-8165
Published: 2025-07-25
Description: A vulnerability was found in code-projects Food Review System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/approve_reservation.php. The manipulation of the argument occasion leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ljfhhh/cve2/blob/main/cve-sql.pdf; https://vuldb.com/?ctiid.317579
CVE: CVE-2025-8166
Published: 2025-07-25
Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/index.php of the component HTTP POST Request Handler. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/enigma522/cve/issues/1; https://vuldb.com/?ctiid.317580
CVE: CVE-2025-30135
Published: 2025-07-25
Description: An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authentication controls on its HTTP and RTSP interfaces, allowing attackers to retrieve sensitive files and video recordings. By connecting to http://192.168.10.1/mnt/extsd/event/, an attacker can download all stored video recordings in an unencrypted manner. Additionally, the RTSP stream on port 8554 is accessible without authentication, allowing an attacker to view live footage.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306
References: https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-13---cve-2025-30135-locking-owner-out-of-device-dos; https://github.com/geo-chen/IROAD?tab=readme-ov-file#finding-8-dumping-files-over-http-and-rtsp-without-authentication; https://www.iroadau.com.au/downloads/
CVE: CVE-2025-46198
Published: 2025-07-25
Description: Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://rapid-echo-f9c.notion.site/Grav-XSS-1dbaf8998a078072bb30ffc9b9e7ab4a?pvs=4; https://tyojong.tistory.com/1
CVE: CVE-2025-8167
Published: 2025-07-25
Description: A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_members.php. The manipulation of the argument fname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/enigma522/cve/issues/2; https://vuldb.com/?ctiid.317581
CVE: CVE-2025-8168
Published: 2025-07-25
Description: A vulnerability was found in D-Link DIR-513 1.10. It has been rated as critical. Affected by this issue is the function websAspInit of the file /goform/formSetWanPPPoE. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetWanL2TP.md; https://vuldb.com/?ctiid.317582; https://vuldb.com/?id.317582
CVE: CVE-2025-8197
Published: 2025-07-25
Description: Rejected reason: Maintainers have included reasons at https://gitlab.gnome.org/GNOME/libsoup/-/issues/465
CVE: CVE-2025-8169
Published: 2025-07-25
Description: A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPPTPpath of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetWanPPPoE.md; https://vuldb.com/?ctiid.317583; https://vuldb.com/?id.317583
CVE: CVE-2025-8170
Published: 2025-07-25
Description: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/9.md; https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/9.md#poc; https://vuldb.com/?ctiid.317584
CVE: CVE-2025-8101
Published: 2025-07-25
Description: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attributes and Manipulating User-Controlled Variables.This issue affects Linkify: from 4.3.1 before 4.3.2.
CWE: CWE-1321
References: https://fluidattacks.com/advisories/charly; https://github.com/nfrasser/linkifyjs; https://github.com/nfrasser/linkifyjs/releases/tag/v4.3.2
CVE: CVE-2025-8171
Published: 2025-07-25
Description: A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing of the file /insert.php. The manipulation of the argument uploaded_file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/XiaoJiesecqwq/CVE/issues/4; https://vuldb.com/?ctiid.317585
CVE: CVE-2025-8172
Published: 2025-07-25
Description: A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/5; https://itsourcecode.com/; https://vuldb.com/?ctiid.317586
CVE: CVE-2025-8173
Published: 2025-07-25
Description: A vulnerability has been found in 1000 Projects ABC Courier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /Add_reciver.php. The manipulation of the argument reciver_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/Pick-program/CVE/issues/2; https://vuldb.com/?ctiid.317587