deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11619
Published: 2025-10-15
Description: Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://devolutions.net/security/advisories/DEVO-2025-0014/
CVE: CVE-2025-43280
Published: 2025-10-15
Description: The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remote images in Mail in Lockdown Mode.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-940
References: https://support.apple.com/en-us/124147
CVE: CVE-2025-43281
Published: 2025-10-15
Description: The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be able to elevate their privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://support.apple.com/en-us/124149
CVE: CVE-2025-43282
Published: 2025-10-15
Description: A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. An app may be able to cause unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://support.apple.com/en-us/124147; https://support.apple.com/en-us/124148; https://support.apple.com/en-us/124149
CVE: CVE-2025-43313
Published: 2025-10-15
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/124149; https://support.apple.com/en-us/124150; https://support.apple.com/en-us/124151
CVE: CVE-2025-62375
Published: 2025-10-15
Description: go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is empty, and when RSA signature verification fails. The attestor also embeds a single legacy global AWS public certificate and does not account for newer region specific certificates issued in 2024, making detection of forged documents difficult without additional trusted region data. An attacker able to supply or intercept instance identity document data (such as through Instance Metadata Service impersonation) can cause a forged identity document to be accepted, leading to incorrect trust decisions based on the attestation. This is fixed in go-witness 0.9.1 and witness 0.10.1. As a workaround, manually verify the included identity document, signature, and public key with standard tools (for example openssl) following AWS’s verification guidance, or disable use of the AWS attestor until upgraded.
CWE: CWE-295
References: https://github.com/in-toto/go-witness/commit/04ff20b600e28ce8fd1aa287534dd383a1cfefb9; https://github.com/in-toto/go-witness/security/advisories/GHSA-72c7-4g63-hpw5
CVE: CVE-2025-11683
Published: 2025-10-16
Description: YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure

Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read

The issue is seen with complex YAML files with a hash of all keys and empty values.  There is no indication that the issue leads to accessing memory outside that allocated to the module.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/cpan-authors/YAML-Syck/pull/65; https://metacpan.org/dist/YAML-Syck/changes
CVE: CVE-2025-62579
Published: 2025-10-16
Description: ASDA-Soft Stack-based Buffer Overflow Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00019_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerabilities.pdf
CVE: CVE-2025-62580
Published: 2025-10-16
Description: ASDA-Soft Stack-based Buffer Overflow Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00019_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerabilities.pdf
CVE: CVE-2025-10700
Published: 2025-10-16
Description: The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3378763/; https://research.cleantalk.org/cve-2025-10700; https://www.wordfence.com/threat-intel/vulnerabilities/id/f9190d35-c9e7-4190-8e66-f6066fe66af8?source=cve
CVE: CVE-2025-0274
Published: 2025-10-16
Description: HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control.  Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124512
CVE: CVE-2025-11814
Published: 2025-10-16
Description: The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-cross-site-scripting-xss-vulnerability; https://www.wordfence.com/threat-intel/vulnerabilities/id/1f41101c-c54f-4e97-a0fb-79a17d5f0929?source=cve
CVE: CVE-2025-0275
Published: 2025-10-16
Description: HCL BigFix Mobile 3.3 and earlier is affected by improper access control.  Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124512
CVE: CVE-2025-58778
Published: 2025-10-16
Description: Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial configuration. Anyone with the knowledge of the related credentials can log in to the affected device, leading to information disclosure, altering the system configurations, or causing a denial of service (DoS) condition.
CVSS Score: 7.2 (HIGH)
CWE: CWE-912
References: https://jvn.jp/en/jp/JVN72648885/; https://www.ruijie.com.cn/gy/xw-aqtg-gw/929848/; https://www.ruijie.com/en-global/support/productLifecycle
CVE: CVE-2025-10706
Published: 2025-10-16
Description: The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://themeforest.net/item/classifiedpro-recommerce-classified-wordpress-theme/44528010; https://www.wordfence.com/threat-intel/vulnerabilities/id/2954583e-4ebe-4658-b132-0085f2b1cf08?source=cve
CVE: CVE-2025-10742
Published: 2025-10-16
Description: The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://themeforest.net/item/truelysell-service-booking-wordpress-theme/43398124; https://www.wordfence.com/threat-intel/vulnerabilities/id/a636e865-9556-4afb-8726-4537a160f379?source=cve
CVE: CVE-2025-10849
Published: 2025-10-16
Description: The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate or deactivate arbitrary plugins.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955; https://www.wordfence.com/threat-intel/vulnerabilities/id/c5abd601-132a-4d8b-bfcc-afd5c6ed9947?source=cve
CVE: CVE-2025-10850
Published: 2025-10-16
Description: The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://themeforest.net/item/felan-freelance-marketplace-and-job-board-wordpress-theme/53612955; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4c7656-544c-4f2f-a42f-264ac90e3b61?source=cve
CVE: CVE-2025-55084
Published: 2025-10-16
Description: In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() in the extension version field.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-126
References: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-m474-39rw-v8gm
CVE: CVE-2025-55089
Published: 2025-10-16
Description: In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could cause a remote execurtion after receiving a crafted sequence of packets
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/eclipse-threadx/filex/security/advisories/GHSA-467v-6j75-3j7g
CVE: CVE-2025-55090
Published: 2025-10-16
Description: In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when received an Ethernet frame with less than 4 bytes of IP packet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-126
References: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-cf2g-j6vv-m8c5
CVE: CVE-2025-62583
Published: 2025-10-16
Description: Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-358
References: https://cve.naver.com/detail/cve-2025-62583.html
CVE: CVE-2025-62584
Published: 2025-10-16
Description: Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://cve.naver.com/detail/cve-2025-62584.html
CVE: CVE-2025-62585
Published: 2025-10-16
Description: Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: https://cve.naver.com/detail/cve-2025-62585.html
CVE: CVE-2025-41018
Published: 2025-10-16
Description: SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in '/public.php'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE: CVE-2025-41019
Published: 2025-10-16
Description: SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter in '/index.php?view=ticket_detail'.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE: CVE-2025-41020
Published: 2025-10-16
Description: Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticket_a4.php'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE: CVE-2025-41021
Published: 2025-10-16
Description: Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'obs' parameter in '/admin/index.php?action=product_update'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sergestec-products
CVE: CVE-2025-41443
Published: 2025-10-16
Description: Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-55091
Published: 2025-10-16
Description: In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when received an Ethernet with type set as IP but no IP data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-126
References: https://github.com/eclipse-threadx/netxduo/security/advisories/GHSA-pf5q-r6q5-6j2f
CVE: CVE-2025-0276
Published: 2025-10-16
Description: HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).  An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-693
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513
CVE: CVE-2025-0277
Published: 2025-10-16
Description: HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).  An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-693
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513
CVE: CVE-2025-10545
Published: 2025-10-16
Description: Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-41410
Published: 2025-10-16
Description: Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-53858
Published: 2025-10-16
Description: ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN13030751/; https://www.chatluck.com/support/package/mainte/pchatluck-%e8%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e4%b8%8a%e3%81%ae%e5%95%8f%e9%a1%8c%e3%81%ab/
CVE: CVE-2025-54461
Published: 2025-10-16
Description: ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1220
References: https://jvn.jp/en/jp/JVN13030751/; https://www.chatluck.com/support/package/mainte/pchatluck-%e8%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e4%b8%8a%e3%81%ae%e5%95%8f%e9%a1%8c%e3%81%ab/
CVE: CVE-2025-54499
Published: 2025-10-16
Description: Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets
CVSS Score: 3.1 (LOW)
CWE: CWE-208
References: https://mattermost.com/security-updates
CVE: CVE-2025-54539
Published: 2025-10-16
Description: A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.

This issue affects all versions of Apache ActiveMQ NMS AMQP up to and including 2.3.0, when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic present in the client to craft responses that may lead to arbitrary code execution on the client side.

Although version 2.1.0 introduced a mechanism to restrict deserialization via allow/deny lists, the protection was found to be bypassable under certain conditions.

In line with Microsoft’s deprecation of binary serialization in .NET 9, the project is evaluating the removal of .NET binary serialization support from the NMS API entirely in future releases.

Mitigation and Recommendations:
Users are strongly encouraged to upgrade to version 2.4.0 or later, which resolves the issue. Additionally, projects depending on NMS-AMQP should migrate away from .NET binary serialization as part of a long-term hardening strategy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/9k684j07ljrshy3hxwhj5m0xjmkz1g2n; http://www.openwall.com/lists/oss-security/2025/10/15/3
CVE: CVE-2025-58073
Published: 2025-10-16
Description: Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-58075
Published: 2025-10-16
Description: Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-58115
Published: 2025-10-16
Description: ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN13030751/; https://www.chatluck.com/support/package/mainte/pchatluck-%e8%a3%bd%e5%93%81%e3%81%ab%e3%81%8a%e3%81%91%e3%82%8b%e3%80%81%e8%a4%87%e6%95%b0%e3%81%ae%e3%82%bb%e3%82%ad%e3%83%a5%e3%83%aa%e3%83%86%e3%82%a3%e4%b8%8a%e3%81%ae%e5%95%8f%e9%a1%8c%e3%81%ab/
CVE: CVE-2025-61581
Published: 2025-10-16
Description: ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.

This issue affects Apache Traffic Control: all versions.

People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://lists.apache.org/thread/mx2jxgnlop2f4vbqnvmrldh4pqmobxvp; http://www.openwall.com/lists/oss-security/2025/10/16/3
CVE: CVE-2025-24833
Published: 2025-10-16
Description: Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/
CVE: CVE-2025-52583
Published: 2025-10-16
Description: Reflected cross-site scripting (XSS) vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/
CVE: CVE-2025-54760
Published: 2025-10-16
Description: Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/
CVE: CVE-2025-54859
Published: 2025-10-16
Description: Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/
CVE: CVE-2025-55072
Published: 2025-10-16
Description: Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/
CVE: CVE-2025-58079
Published: 2025-10-16
Description: Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-424
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/
CVE: CVE-2025-58426
Published: 2025-10-16
Description: desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-321
References: https://jvn.jp/en/jp/JVN90757550/; https://www.desknets.com/neo/support/mainte/17475/