deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3459
Published: 2025-06-08
Description: The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
CVSS Score: 7.7 (HIGH)
CWE: CWE-88
References: https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices; https://takeonme.org/cves/cve-2025-3459
CVE: CVE-2025-3460
Published: 2025-06-08
Description: The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
CVSS Score: 7.7 (HIGH)
CWE: CWE-88
References: https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices; https://takeonme.org/cves/cve-2025-3460
CVE: CVE-2025-3461
Published: 2025-06-08
Description: The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices; https://takeonme.org/cves/cve-2025-3461/
CVE: CVE-2025-5848
Published: 2025-06-08
Description: A vulnerability was found in Tenda AC15 15.03.05.19_multi and classified as critical. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://candle-throne-f75.notion.site/Tenda-AC15-formSetPPTPUserList-20adf0aa118580d080eacb031b89ddc6; https://vuldb.com/?ctiid.311594; https://vuldb.com/?id.311594
CVE: CVE-2025-5849
Published: 2025-06-08
Description: A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been classified as critical. This affects the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg of the component HTTP POST Request Handler. The manipulation of the argument remoteIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://candle-throne-f75.notion.site/Tenda-AC15-formSetSafeWanWebMan-20adf0aa1185806daab3ebe0036266cb; https://vuldb.com/?ctiid.311595; https://vuldb.com/?id.311595
CVE: CVE-2025-5850
Published: 2025-06-08
Description: A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been declared as critical. This vulnerability affects the function formsetschedled of the file /goform/SetLEDCf of the component HTTP POST Request Handler. The manipulation of the argument Time leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://candle-throne-f75.notion.site/Tenda-AC15-formsetschedled-20adf0aa118580d984d8fcdb98d9959c; https://vuldb.com/?ctiid.311596; https://vuldb.com/?id.311596
CVE: CVE-2025-5851
Published: 2025-06-09
Description: A vulnerability was found in Tenda AC15 15.03.05.19_multi. It has been rated as critical. This issue affects the function fromadvsetlanip of the file /goform/AdvSetLanip of the component HTTP POST Request Handler. The manipulation of the argument lanMask leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://candle-throne-f75.notion.site/Tenda-AC15-fromadvsetlanip-20adf0aa118580a09182c1c5c42079fc; https://vuldb.com/?ctiid.311597; https://vuldb.com/?id.311597
CVE: CVE-2025-5852
Published: 2025-06-09
Description: A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC6-formSetPPTPUserList-20a53a41781f801280e7e2dbdbd8625c?source=copy_link; https://vuldb.com/?ctiid.311598; https://vuldb.com/?id.311598
CVE: CVE-2025-5853
Published: 2025-06-09
Description: A vulnerability classified as critical was found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formSetSafeWanWebMan of the file /goform/SetRemoteWebCfg. The manipulation of the argument remoteIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC6-formSetSafeWanWebMan-20a53a41781f80f1a3ebc7931f32a29f?source=copy_link; https://vuldb.com/?ctiid.311599; https://vuldb.com/?id.311599
CVE: CVE-2025-5854
Published: 2025-06-09
Description: A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this issue is the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC6-fromadvsetlanip-20a53a41781f80a29bdff7dca9a4773e?source=copy_link; https://vuldb.com/?ctiid.311600; https://vuldb.com/?id.311600
CVE: CVE-2025-5855
Published: 2025-06-09
Description: A vulnerability, which was classified as critical, was found in Tenda AC6 15.03.05.16. This affects the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC6-formsetreboottimer-20a53a41781f80c5b6cac51008556c7e?source=copy_link; https://vuldb.com/?ctiid.311601; https://vuldb.com/?id.311601
CVE: CVE-2025-5856
Published: 2025-06-09
Description: A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /registration.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Rmy4x/cve/blob/main/cve2.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311602
CVE: CVE-2025-5857
Published: 2025-06-09
Description: A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /urinalysis_record.php. The manipulation of the argument itr_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yuyuchenchen/vuln-pdf0605/blob/main/0605CVE.pdf; https://vuldb.com/?ctiid.311603
CVE: CVE-2025-5858
Published: 2025-06-09
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /patient-report.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/64; https://phpgurukul.com/; https://vuldb.com/?ctiid.311604
CVE: CVE-2025-5859
Published: 2025-06-09
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /test-details.php. The manipulation of the argument assignto leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/65; https://phpgurukul.com/; https://vuldb.com/?ctiid.311605
CVE: CVE-2025-5860
Published: 2025-06-09
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Maid Hiring Management System 1.0. This affects an unknown part of the file /admin/search-booking-request.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/kakalalaww/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.311619
CVE: CVE-2025-5861
Published: 2025-06-09
Description: A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. This vulnerability affects the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC7-fromadvsetlanip-20a53a41781f80038f4fc4b9d927eb9a?source=copy_link; https://vuldb.com/?ctiid.311620; https://vuldb.com/?id.311620
CVE: CVE-2025-5862
Published: 2025-06-09
Description: A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC7-formSetPPTPUserList-20a53a41781f806ca124cbdf99bff931?source=copy_link; https://vuldb.com/?ctiid.311621; https://vuldb.com/?id.311621
CVE: CVE-2025-25207
Published: 2025-06-09
Description: The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-770
References: https://access.redhat.com/security/cve/CVE-2025-25207; https://bugzilla.redhat.com/show_bug.cgi?id=2347421
CVE: CVE-2025-25208
Published: 2025-06-09
Description: A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400
References: https://access.redhat.com/security/cve/CVE-2025-25208; https://bugzilla.redhat.com/show_bug.cgi?id=2347436
CVE: CVE-2025-25209
Published: 2025-06-09
Description: The AuthPolicy metadata on Red Hat Connectivity Link contains an object which stores secretes, however it assumes those secretes are already in the kuadrant-system instead of copying it to the referred namespace. This creates space for a malicious actor with a developer persona access to leak those secrets over HTTP connection, as long the attacker knows the name of the targeted secrets and those secrets are limited to one line only.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/security/cve/CVE-2025-25209; https://bugzilla.redhat.com/show_bug.cgi?id=2347438
CVE: CVE-2025-3581
Published: 2025-06-09
Description: The Newsletter  WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2d96f018-510d-40ab-9e73-76fa44784813/; https://wpscan.com/vulnerability/2d96f018-510d-40ab-9e73-76fa44784813/
CVE: CVE-2025-3582
Published: 2025-06-09
Description: The Newsletter  WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/19db8521-8dff-48c5-b21a[PII_REDACTED]e0/; https://wpscan.com/vulnerability/19db8521-8dff-48c5-b21a[PII_REDACTED]e0/
CVE: CVE-2025-47711
Published: 2025-06-09
Description: There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-193
References: https://access.redhat.com/security/cve/CVE-2025-47711; https://bugzilla.redhat.com/show_bug.cgi?id=2365687
CVE: CVE-2025-47712
Published: 2025-06-09
Description: A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://access.redhat.com/security/cve/CVE-2025-47712; https://bugzilla.redhat.com/show_bug.cgi?id=2365724; https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/
CVE: CVE-2025-4652
Published: 2025-06-09
Description: The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/2a18ab96-ba95-4599-824f-df12e4851e6d/; https://wpscan.com/vulnerability/2a18ab96-ba95-4599-824f-df12e4851e6d/
CVE: CVE-2025-5863
Published: 2025-06-09
Description: A vulnerability was found in Tenda AC5 15.03.06.47. It has been classified as critical. Affected is the function formSetRebootTimer of the file /goform/SetRebootTimer. The manipulation of the argument rebootTime leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC5-formSetRebootTimer-20a53a41781f80a6b9a8f6e5915cf256?source=copy_link; https://vuldb.com/?ctiid.311622; https://vuldb.com/?id.311622
CVE: CVE-2025-5864
Published: 2025-06-09
Description: A vulnerability was found in Tenda TDSEE App up to 1.7.12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /app/ConfirmSmsCode of the component Password Reset Confirmation Code Handler. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.15 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-799
References: https://blog.kevgen.ru/posts/account_takeover_in_tdsee_app/; https://github.com/k3vg3n/researches/blob/main/Account_takeover_in_TDSEE_app.md; https://vuldb.com/?ctiid.311623
CVE: CVE-2025-5865
Published: 2025-06-09
Description: A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sys_select of the file rt-thread/components/lwp/lwp_syscall.c of the component Parameter Handler. The manipulation of the argument timeout leads to memory corruption. The vendor explains, that "[t]he timeout parameter should be checked to check if it can be accessed correctly in kernel mode and used temporarily in kernel memory."
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: https://github.com/RT-Thread/rt-thread/issues/10298; https://github.com/RT-Thread/rt-thread/issues/10298#issuecomment[PII_REDACTED]; https://vuldb.com/?ctiid.311624
CVE: CVE-2025-5866
Published: 2025-06-09
Description: A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function sys_sigprocmask of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument how leads to improper validation of array index.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-129, CWE-129
References: https://github.com/RT-Thread/rt-thread/issues/10300; https://vuldb.com/?ctiid.311625; https://vuldb.com/?id.311625
CVE: CVE-2025-5893
Published: 2025-06-09
Description: Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256, CWE-497
References: https://www.twcert.org.tw/en/cp-139-10169-651d6-2.html; https://www.twcert.org.tw/tw/cp-132-10167-39c6d-1.html
CVE: CVE-2025-5867
Published: 2025-06-09
Description: A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability affects the function csys_sendto of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument to leads to null pointer dereference.
CVSS Score: 8.0 (HIGH)
CWE: CWE-404, CWE-476, CWE-476
References: https://github.com/RT-Thread/rt-thread/issues/10299; https://vuldb.com/?ctiid.311626; https://vuldb.com/?id.311626
CVE: CVE-2025-5868
Published: 2025-06-09
Description: A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function sys_thread_sigprocmask of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument how leads to improper validation of array index.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119, CWE-129, CWE-129
References: https://github.com/RT-Thread/rt-thread/issues/10303; https://vuldb.com/?ctiid.311627; https://vuldb.com/?id.311627
CVE: CVE-2025-5894
Published: 2025-06-09
Description: Smart Parking Management System from Honding Technology has a Missing Authorization vulnerability, allowing remote attackers with regular privileges to access a specific functionality to create administrator accounts, and subsequently log into the system using those accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.twcert.org.tw/en/cp-139-10171-44c0a-2.html; https://www.twcert.org.tw/tw/cp-132-10170-e2435-1.html
CVE: CVE-2025-5869
Published: 2025-06-09
Description: A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0. Affected is the function sys_recvfrom of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument from leads to memory corruption.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: https://github.com/RT-Thread/rt-thread/issues/10304; https://vuldb.com/?ctiid.311628; https://vuldb.com/?id.311628
CVE: CVE-2025-5870
Published: 2025-06-09
Description: A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/setup.cgi of the component Web Interface. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/zeke2997/CVE_request_TRENDnet; https://vuldb.com/?ctiid.311629; https://vuldb.com/?id.311629
CVE: CVE-2025-40675
Published: 2025-06-09
Description: A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-bagisto
CVE: CVE-2025-5871
Published: 2025-06-09
Description: A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://github.com/zeke2997/CVE_request_Papendorf_Software_Engineering_GmbH; https://vuldb.com/?ctiid.311630; https://vuldb.com/?id.311630
CVE: CVE-2025-5872
Published: 2025-06-09
Description: A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-306
References: https://github.com/zeke2997/CVE_request_eGauge_Systems_LLC; https://vuldb.com/?ctiid.311631; https://vuldb.com/?id.311631
CVE: CVE-2025-27709
Published: 2025-06-09
Description: Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the Service Account Auditing reports.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2025-27709.html