deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54677
Published: 2025-08-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-54713
Published: 2025-08-20
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-1-3-0-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-54726
Published: 2025-08-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/jquery-archive-list-widget/vulnerability/wordpress-js-archive-list-plugin-6-1-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54735
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <= 1.1.24.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/cubewp-framework/vulnerability/wordpress-cubewp-framework-plugin-1-1-24-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-54750
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-11-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-55715
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/otter-blocks/vulnerability/wordpress-otter-gutenberg-block-plugin-3-1-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-9225
Published: 2025-08-20
Description: Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://mobile-industrial-robots.com/security-advisories/cross-site-scripting; https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE: CVE-2024-39954
Published: 2025-08-20
Description: CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources.
Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon
CVE: CVE-2025-5260
Published: 2025-08-20
Description: Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery.This issue affects Pik Online: before 3.1.5.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://www.usom.gov.tr/bildirim/tr-25-0201
CVE: CVE-2025-5261
Published: 2025-08-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers.This issue affects Pik Online: before 3.1.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0201
CVE: CVE-2025-9228
Published: 2025-08-20
Description: MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, 
allowing low-privilege users to create notes which are intended only for administrative users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mobile-industrial-robots.com/security-advisories/insufficient-authorization-when-creating-notes; https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE: CVE-2025-9229
Published: 2025-08-20
Description: Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://mobile-industrial-robots.com/security-advisories/information-disclosure; https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE: CVE-2025-57727
Published: 2025-08-20
Description: In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-319
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57728
Published: 2025-08-20
Description: In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57729
Published: 2025-08-20
Description: In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-829
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57730
Published: 2025-08-20
Description: In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-80
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57731
Published: 2025-08-20
Description: In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57732
Published: 2025-08-20
Description: In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
CVSS Score: 7.5 (HIGH)
CWE: CWE-282
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57733
Published: 2025-08-20
Description: In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-57734
Published: 2025-08-20
Description: In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-538, CWE-538
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-9173
Published: 2025-08-20
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The file upload in include/service/media.php verifies the file extension based on a list defined in include/lib/option.php. This whitelist prevents unrestricted uploads (e.g. PHP files). Therefore, the attack possibility is just of theoretical nature.
CVE: CVE-2025-43741
Published: 2025-08-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScrip in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_assetTagNames parameter
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43741
CVE: CVE-2025-43742
Published: 2025-08-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript in web content for friendly urls.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43742
CVE: CVE-2025-7777
Published: 2025-08-20
Description: The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601
References: https://access.redhat.com/security/cve/CVE-2025-7777; https://bugzilla.redhat.com/show_bug.cgi?id=2382545
CVE: CVE-2025-8102
Published: 2025-08-20
Description: The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate or download and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/easy-digital-downloads/tags/3.5.0/includes/deprecated-functions.php#L1678; https://plugins.trac.wordpress.org/changeset/3346633/easy-digital-downloads/trunk/includes/deprecated-functions.php?old=3328623&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fdeprecated-functions.php; https://wordpress.org/plugins/easy-digital-downloads/#developers
CVE: CVE-2025-43749
Published: 2025-08-20
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and stored in document_library
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43749
CVE: CVE-2025-43750
Published: 2025-08-20
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment field without proper validation, enabling extension obfuscation and bypassing MIME type checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43750
CVE: CVE-2025-4437
Published: 2025-08-20
Description: There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-770
References: https://access.redhat.com/security/cve/CVE-2025-4437; https://bugzilla.redhat.com/show_bug.cgi?id=2375084
CVE: CVE-2025-4877
Published: 2025-08-20
Description: There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption.
This issue affects only 32-bits builds of libssh.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/security/cve/CVE-2025-4877; https://bugzilla.redhat.com/show_bug.cgi?id=2376193; https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=6fd9cc8ce3958092a1aae11f1f2e911b2747732d
CVE: CVE-2025-54172
Published: 2025-08-20
Description: QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. Regular admin user is not able to inject any JS scripts into the page.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/08/CVE-2025-54172; https://opensolution.org/cms-system-quick-cms.html
CVE: CVE-2025-54174
Published: 2025-08-20
Description: QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious article with content defined by the attacker.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://cert.pl/en/posts/2025/08/CVE-2025-54172; https://opensolution.org/cms-system-quick-cms.html
CVE: CVE-2025-54175
Published: 2025-08-20
Description: QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality.  An attacker can craft a malicious URL that results in arbitrary JavaScript execution in the victim's browser when opened.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/08/CVE-2025-54172; https://opensolution.org/professional-cms-system-quick-cms-ext.html
CVE: CVE-2025-8453
Published: 2025-08-20
Description: CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and
arbitrary code execution when a privileged engineer user with console access modifies a configuration file
used by a root-level daemon to execute custom scripts.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-01.pdf
CVE: CVE-2025-24322
Published: 2025-08-20
Description: An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-304
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2163; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2163
CVE: CVE-2025-24496
Published: 2025-08-20
Description: An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2164; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2164
CVE: CVE-2025-27129
Published: 2025-08-20
Description: An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send packets to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2165; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2165
CVE: CVE-2025-30256
Published: 2025-08-20
Description: A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted series of HTTP requests can lead to a reboot. An attacker can send multiple network packets to trigger this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-772
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2166; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2166
CVE: CVE-2025-31355
Published: 2025-08-20
Description: A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-494
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2161; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2161
CVE: CVE-2025-32010
Published: 2025-08-20
Description: A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP response can lead to arbitrary code execution. An attacker can send an HTTP response to trigger this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2168; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2168
CVE: CVE-2025-50503
Published: 2025-08-20
Description: A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide a legitimate authentication factor, such as an OTP. This compromises account security and allows for potential unauthorized access to user data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-640
References: https://github.com/ksarieddine/disclosures/blob/main/Touch%20Mobile%20Application/2FA%20Bypass%20-%20Touch%20Lebanon.md; https://www.touch.com.lb/autoforms/portal/touch/personal/contentandapps/mobileapp
CVE: CVE-2025-54923
Published: 2025-08-20
Description: CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.
CWE: CWE-502
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE: CVE-2025-54924
Published: 2025-08-20
Description: CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE: CVE-2025-54925
Published: 2025-08-20
Description: CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE: CVE-2025-54926
Published: 2025-08-20
Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE: CVE-2025-54927
Published: 2025-08-20
Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-02.pdf
CVE: CVE-2025-55483
Published: 2025-08-20
Description: Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formSetMacFilterCfg/poc.md
CVE: CVE-2025-55499
Published: 2025-08-20
Description: Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/fromSetSysTime/poc.md
CVE: CVE-2025-55503
Published: 2025-08-20
Description: Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/saveParentControlInfo/poc.md
CVE: CVE-2025-8448
Published: 2025-08-20
Description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.
CWE: CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf