deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-61786
Published: 2025-10-08
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: https://github.com/denoland/deno/commit/1ab2268c0bcbf9b0468e0e36963f77f8c31c73ec; https://github.com/denoland/deno/pull/30876; https://github.com/denoland/deno/releases/tag/v2.2.15
CVE: CVE-2025-11421
Published: 2025-10-08
Description: A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation of the argument Firstname/Lastname/Platform causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/10; https://vuldb.com/?ctiid.327356
CVE: CVE-2025-11422
Published: 2025-10-08
Description: A vulnerability has been found in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /admin/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hbesljx/vul/issues/5; https://vuldb.com/?ctiid.327357; https://vuldb.com/?id.327357
CVE: CVE-2025-11423
Published: 2025-10-08
Description: A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. Performing a manipulation of the argument page results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/f000x0/cve/issues/7; https://vuldb.com/?ctiid.327358; https://vuldb.com/?id.327358
CVE: CVE-2025-11424
Published: 2025-10-08
Description: A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. This impacts an unknown function of the file /login.php. Executing manipulation of the argument emailid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Real-Rio/vulnreport/blob/main/SQL6.md; https://vuldb.com/?ctiid.327359
CVE: CVE-2025-61787
Published: 2025-10-08
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawns ``cmd.exe`` if a batch file (.bat, .cmd, etc.) is being executed even if the application does not specify it via the command line. This makes Deno vulnerable to a command injection attack on Windows. Versions 2.5.3 and 2.2.15 fix the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://github.com/denoland/deno/commit/8a0990ccd37bafd8768176ca64b906ba2da2d822; https://github.com/denoland/deno/pull/30818; https://github.com/denoland/deno/releases/tag/v2.2.15
CVE: CVE-2025-11425
Published: 2025-10-08
Description: A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/ChenGuangHuangHun/CVE/issues/2; https://vuldb.com/?ctiid.327360; https://vuldb.com/?id.327360
CVE: CVE-2025-11426
Published: 2025-10-08
Description: A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_book.php. The manipulation of the argument image results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ChenGuangHuangHun/CVE/issues/3; https://vuldb.com/?ctiid.327361; https://vuldb.com/?id.327361
CVE: CVE-2025-10494
Published: 2025-10-08
Description: The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.1 (HIGH)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3369415%40motors-car-dealership-classified-listings%2Ftrunk&old=3367132%40motors-car-dealership-classified-listings%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e6066890-75b9-468d-9f67-78e93f58dcc1?source=cve
CVE: CVE-2025-10587
Published: 2025-10-08
Description: The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/community-events/trunk/community-events.php?rev=3115223; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3369351%40community-events%2Ftrunk&old=3115222%40community-events%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/community-events/
CVE: CVE-2025-11430
Published: 2025-10-08
Description: A vulnerability was found in SourceCodester Simple E-Commerce Bookstore 1.0. The affected element is an unknown function of the file /cart.php. The manipulation of the argument remove results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/DrNbnonono/CVE/issues/2; https://vuldb.com/?ctiid.327367; https://vuldb.com/?id.327367
CVE: CVE-2025-11431
Published: 2025-10-08
Description: A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.php. This manipulation of the argument shopid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/SQL7.md; https://vuldb.com/?ctiid.327368
CVE: CVE-2025-11204
Published: 2025-10-08
Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_reports_service.php?rev=3360241; https://plugins.trac.wordpress.org/changeset/3374106/custom-registration-form-builder-with-submission-manager/trunk?contextall=1&old=3366909&old_path=%2Fcustom-registration-form-builder-with-submission-manager%2Ftrunk; https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
CVE: CVE-2025-11432
Published: 2025-10-08
Description: A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /reset.php. Such manipulation of the argument employid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/romatdibrohiksnov/vulndb.com/tree/main/itsourcecode%20leave%20management%20system%20Bulk%20Password%20Reset%20SQL%20Injection; https://itsourcecode.com/; https://vuldb.com/?ctiid.327369
CVE: CVE-2025-11433
Published: 2025-10-08
Description: A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php?action=reset of the component Query Parameter Handler. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/romatdibrohiksnov/vulndb.com/blob/main/itsourcecode%20Leave%20Management%20System%20%E2%80%94%20Reflected%20Cross-Site%20Scripting%20(XSS)/readme.md; https://itsourcecode.com/; https://vuldb.com/?ctiid.327370
CVE: CVE-2025-11434
Published: 2025-10-08
Description: A weakness has been identified in itsourcecode Student Transcript Processing System 1.0. Affected is an unknown function of the file /login.php. Executing a manipulation of the argument uname can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yihaofuweng/cve/issues/49; https://itsourcecode.com/; https://vuldb.com/?ctiid.327371
CVE: CVE-2025-10635
Published: 2025-10-08
Description: The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
CVSS Score: 7.7 (HIGH)
References: https://wpscan.com/vulnerability/92e965aa-45fc-4189-a341-1ecac656ebf3/; https://wpscan.com/vulnerability/92e965aa-45fc-4189-a341-1ecac656ebf3/
CVE: CVE-2025-11171
Published: 2025-10-08
Description: The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-builder-admin.php#L1625; https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/admin/class-chart-builder-admin.php#L675; https://plugins.trac.wordpress.org/browser/chart-builder/tags/3.5.8/includes/class-chart-builder.php#L247
CVE: CVE-2025-11435
Published: 2025-10-08
Description: A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submissions. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a2af1184e53953afa8cb052f4055f288adcaa608. To fix this issue, it is recommended to deploy a patch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?usp=sharing; https://github.com/JhumanJ/OpnForm/pull/900/commits/a2af1184e53953afa8cb052f4055f288adcaa608; https://vuldb.com/?ctiid.327372
CVE: CVE-2025-11436
Published: 2025-10-08
Description: A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as 95c3e23856465d202e6aec10bdb6ee0688b5305a. It is advisable to implement a patch to correct this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.dm5ttliupfqn; https://github.com/JhumanJ/OpnForm/pull/900/commits/95c3e23856465d202e6aec10bdb6ee0688b5305a; https://vuldb.com/?ctiid.327373
CVE: CVE-2025-11437
Published: 2025-10-08
Description: A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currently under review for additional handling. As of right now the vendor has stated that the feature is disabled until the user has configured their own domain which will mitigate this attack vector.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.nowv0hlgdq8; https://vuldb.com/?ctiid.327374; https://vuldb.com/?id.327374
CVE: CVE-2025-11438
Published: 2025-10-08
Description: A vulnerability has been found in JhumanJ OpnForm up to 1.9.3. This vulnerability affects unknown code of the file /custom-domains of the component API Endpoint. Such manipulation leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is beb153ce52dceb971c1518f98333328c95f1ba20. It is best practice to apply a patch to resolve this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.gm61tyll8uys; https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20; https://vuldb.com/?ctiid.327375
CVE: CVE-2025-11439
Published: 2025-10-08
Description: A vulnerability was found in JhumanJ OpnForm up to 1.9.3. This issue affects some unknown processing of the file /show/integrations. Performing manipulation results in missing authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The patch is named 11d97d78f2de2cb49f79baed6bde8b611ec1f384. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.reuyi9lwvpj; https://github.com/JhumanJ/OpnForm/pull/900/commits/11d97d78f2de2cb49f79baed6bde8b611ec1f384; https://vuldb.com/?ctiid.327376
CVE: CVE-2025-11440
Published: 2025-10-08
Description: A vulnerability was determined in JhumanJ OpnForm up to 1.9.3. Impacted is an unknown function of the file /edit. Executing manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called b15e29021d326be127193a5dbbd528c4e37e6324. Applying a patch is advised to resolve this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.t78mmp24qqk5; https://github.com/JhumanJ/OpnForm/pull/900/commits/b15e29021d326be127193a5dbbd528c4e37e6324; https://vuldb.com/?ctiid.327377
CVE: CVE-2025-11441
Published: 2025-10-08
Description: A vulnerability was identified in JhumanJ OpnForm up to 1.9.3. The affected element is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The identifier of the patch is 11e99960e14ca986b1a001a56e7533223d2cfa5b. It is suggested to install a patch to address this issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-307, CWE-799
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.va2ituwwqcf3; https://github.com/JhumanJ/OpnForm/pull/900/commits/11e99960e14ca986b1a001a56e7533223d2cfa5b; https://vuldb.com/?ctiid.327378
CVE: CVE-2025-48464
Published: 2025-10-08
Description: Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: https://tuxplorer.com/posts/dont-leave-me-outdated/; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-097/
CVE: CVE-2025-11442
Published: 2025-10-08
Description: A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor has stated that API calls require authentication through Authorization Bearer Tokens, so classic CSRF attacks do not apply here. An attacker would need to possess the JWT through means such as XSS which were mitigated, disabling any form of initial access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.w5b1nllxwvdq; https://vuldb.com/?ctiid.327379; https://vuldb.com/?id.327379
CVE: CVE-2025-11443
Published: 2025-10-08
Description: A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Password Handler. This manipulation causes information exposure through discrepancy. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be exploited. This issue is currently aligned with Laravel issue #46465, which is why no mitigation action was taken.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-203
References: https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.my0ldciyllp; https://vuldb.com/?ctiid.327380; https://vuldb.com/?id.327380
CVE: CVE-2025-11444
Published: 2025-10-08
Description: A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/wepkey/wepkey.md; https://github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/wepkey/wepkey.md#reproduce; https://vuldb.com/?ctiid.327381
CVE: CVE-2025-11445
Published: 2025-10-08
Description: A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-707
References: https://github.com/Kilo-Org/kilocode/pull/2244; https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333; https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/
CVE: CVE-2025-11469
Published: 2025-10-08
Description: A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /pages/save_customer.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/TThuyyy/cve1/issues/8; https://vuldb.com/?ctiid.327587; https://vuldb.com/?id.327587
CVE: CVE-2025-11470
Published: 2025-10-08
Description: A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the file /manage_website.php. The manipulation of the argument website_image/back_login_image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/TThuyyy/cve1/issues/13; https://vuldb.com/?ctiid.327588; https://vuldb.com/?id.327588
CVE: CVE-2025-10351
Published: 2025-10-08
Description: SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
CWE: CWE-89
References: https://github.com/ivansmc00/CVE-2025-10351-POC; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform
CVE: CVE-2025-10352
Published: 2025-10-08
Description: Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.
CWE: CWE-862
References: https://github.com/ivansmc00/CVE-2025-10352-POC; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform
CVE: CVE-2025-10353
Published: 2025-10-08
Description: File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
CWE: CWE-43
References: https://github.com/ivansmc00/CVE-2025-10353-POC; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform