deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3349
Published: 2025-04-07
Description: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SYST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit.txt; https://vuldb.com/?ctiid.303563; https://vuldb.com/?id.303563
CVE: CVE-2025-0050
Published: 2025-04-07
Description: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations, including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r0p0 through r49p2, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r19p0 through r49p2, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p2, from r50p0 through r53p0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: https://developer.arm.com/documentation/110435/latest/
CVE: CVE-2025-3350
Published: 2025-04-07
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/view-enquiry.php. The manipulation of the argument viewid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/n0name-yang/myCVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303564
CVE: CVE-2025-3351
Published: 2025-04-07
Description: A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/n0name-yang/myCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.303565
CVE: CVE-2025-3352
Published: 2025-04-07
Description: A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-scdetails.php. The manipulation of the argument contnum leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/n0name-yang/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.303566
CVE: CVE-2025-3353
Published: 2025-04-07
Description: A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/add-services.php. The manipulation of the argument cost leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/LaneyYu/cve/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.303567
CVE: CVE-2025-3359
Published: 2025-04-07
Description: A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-754
References: https://access.redhat.com/security/cve/CVE-2025-3359; https://bugzilla.redhat.com/show_bug.cgi?id=2357749; https://sourceforge.net/p/gnuplot/bugs/2781/
CVE: CVE-2025-3360
Published: 2025-04-07
Description: A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
CVSS Score: 3.7 (LOW)
CWE: CWE-190
References: https://access.redhat.com/security/cve/CVE-2025-3360; https://bugzilla.redhat.com/show_bug.cgi?id=2357754; https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html
CVE: CVE-2025-27686
Published: 2025-04-07
Description: Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVSS Score: 2.7 (LOW)
CWE: CWE-90
References: https://www.dell.com/support/kbdoc/en-ao/000302223/dsa-2025-111-dell-powermaxos-dell-powermax-eem-dell-unisphere-for-powermax-dell-unisphere-for-powermax-virtual-appliance-dell-unisphere-360-dell-solutions-enabler-and-dell-solutions-enabler-virtual-appliance-security-update-for-multiple-vulnerabilities
CVE: CVE-2025-2251
Published: 2025-04-07
Description: A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulnerability stems from untrusted data deserialization handled by JBoss Marshalling. This flaw allows an attacker to send a specially crafted serialized object, leading to remote code execution without requiring authentication.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-502
References: https://access.redhat.com/errata/RHSA-2025:10452; https://access.redhat.com/errata/RHSA-2025:10453; https://access.redhat.com/errata/RHSA-2025:10459
CVE: CVE-2025-30195
Published: 2025-04-07
Description: An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses and crash of the Recursor, causing a denial of service.

The remedy is: upgrade to the patched 5.2.1 version.

We would like to thank Volodymyr Ilyin for bringing this issue to our attention.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-01.html; http://www.openwall.com/lists/oss-security/2025/04/07/1
CVE: CVE-2025-3369
Published: 2025-04-07
Description: A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/friendLink/list. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/mapl3miss/novel-plusSQLi/blob/master/novelPLUS-sqli.md; https://vuldb.com/?ctiid.303614; https://vuldb.com/?id.303614
CVE: CVE-2025-3370
Published: 2025-04-07
Description: A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/1SHOTSEC/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.303615
CVE: CVE-2025-30373
Published: 2025-04-07
Description: Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10; https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q7g5-jq6p-6wvx
CVE: CVE-2025-31138
Published: 2025-04-07
Description: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1021
References: https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07; https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3
CVE: CVE-2025-31475
Published: 2025-04-07
Description: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution. An attacker with high privileges could exploit this vulnerability to modify object prototypes, affecting core JavaScript behavior, cause application crashes or unexpected behavior, or potentially introduce further security vulnerabilities depending on the application's architecture. This vulnerability is fixed in 1.20.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-1321
References: https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b; https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc
CVE: CVE-2025-31476
Published: 2025-04-07
Description: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02; https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-p5g4-v748-6fh8; https://www.drupal.org/sa-contrib-2025-027
CVE: CVE-2025-32014
Published: 2025-04-07
Description: estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3.
CWE: CWE-1321
References: https://github.com/remcohaszing/estree-util-value-to-estree/commit/d0c394fbc64bc55937ffe4e162b81f15ba506e55; https://github.com/remcohaszing/estree-util-value-to-estree/security/advisories/GHSA-f7f6-9jq7-3rqj
CVE: CVE-2025-3248
Published: 2025-04-07
Description: Langflow versions prior to 1.3.0 are susceptible to code injection in 
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-94, CWE-306
References: https://github.com/langflow-ai/langflow/pull/6911; https://github.com/langflow-ai/langflow/releases/tag/1.3.0; https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/
CVE: CVE-2025-3371
Published: 2025-04-07
Description: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component DELETE Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit1.txt; https://vuldb.com/?ctiid.303617; https://vuldb.com/?id.303617
CVE: CVE-2025-3372
Published: 2025-04-07
Description: A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component MKDIR Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/01-exploit.txt; https://vuldb.com/?ctiid.303618; https://vuldb.com/?id.303618
CVE: CVE-2025-28400
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28400.md; https://github.com/yangzongzhuan/RuoYi
CVE: CVE-2025-28401
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://github.com/yangzongzhuan/RuoYi
CVE: CVE-2025-28402
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28402.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28402.md
CVE: CVE-2025-28403
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28403.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28403.md
CVE: CVE-2025-28405
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28405.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28405.md
CVE: CVE-2025-28406
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28406.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28406.md
CVE: CVE-2025-28407
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified dictId
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28407.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28407.md
CVE: CVE-2025-28408
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the deptId parameter
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.md
CVE: CVE-2025-28409
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.md
CVE: CVE-2025-28410
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28409.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28409.md
CVE: CVE-2025-28411
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28411.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28411.md
CVE: CVE-2025-28412
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28412.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28412.md
CVE: CVE-2025-28413
Published: 2025-04-07
Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28413.md; https://github.com/yangzongzhuan/RuoYi; https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28413.md
CVE: CVE-2025-3373
Published: 2025-04-07
Description: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component SITE CHMOD Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit2.txt; https://vuldb.com/?ctiid.303619; https://vuldb.com/?id.303619
CVE: CVE-2025-3374
Published: 2025-04-07
Description: A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component CCC Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-e4f29cda8e801f1b0e7fcf539e4352b4.txt; https://vuldb.com/?ctiid.303620; https://vuldb.com/?id.303620
CVE: CVE-2025-3424
Published: 2025-04-07
Description: The IntelliSpace portal application utilizes .NET
Remoting for its functionality. The vulnerability arises from the exploitation
of port 755 through the "Object Marshalling" technique, which allows
an attacker to read internal files without any authentication. This is possible
by crafting specific .NET Remoting URLs derived from information enumerated in
the client-side configuration files.







This issue affects IntelliSpace Portal: 12 and prior.
CWE: CWE-22
References: https://www.cve.org/CVERecord?id=CVE-2025-3424; https://www.philips.com/a-w/security/security-advisories.html#security_advisories
CVE: CVE-2025-3425
Published: 2025-04-07
Description: The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is dangerous as it can potentially lead to remote code execution using deserialization. This issue affects IntelliSpace Portal: 12 and prior.
CWE: CWE-502
References: https://www.cve.org/CVERecord?id=CVE-2025-3425; https://www.philips.com/a-w/security/security-advisories.html#security_advisories
CVE: CVE-2025-3375
Published: 2025-04-07
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component CDUP Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-b81a4a56b5d867bc810b183e3c9791ef.txt; https://vuldb.com/?ctiid.303621; https://vuldb.com/?id.303621
CVE: CVE-2025-3376
Published: 2025-04-07
Description: A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component CONF Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-f14d986820a0a41f23e061b41b5c6f61.txt; https://vuldb.com/?ctiid.303622; https://vuldb.com/?id.303622
CVE: CVE-2025-3426
Published: 2025-04-07
Description: We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-engineer the application to gain insights into its internal workings, which can potentially lead to the discovery of sensitive information, business logic flaws, and other vulnerabilities.
Utilizing this flaw, the attacker was able to identify the Hardcoded credentials from PortalUsersDatabase.dll, which contains .NET remoting definition. Inside the namespace PortalUsersDatabase, the class Users contains the functions CreateAdmin and CreateService that are used to initialize accounts in the Portal service. Both CreateAdmin and CreateService functions contain a hardcoded encrypted password along with its respective salt that are set with the function SetInitialPasswordAndSalt.
This issue affects IntelliSpace Portal: 12 and prior; Advanced Visualization Workspace: 15.
CWE: CWE-798
References: https://www.cve.org/CVERecord?id=CVE-2025-3426; https://www.philips.com/a-w/security/security-advisories.html#security_advisories