deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9195
Published: 2025-02-28
Description: The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://codecanyon.net/item/whmcs-client-area-whmpress-addon/11218646; https://www.wordfence.com/threat-intel/vulnerabilities/id/c8af0c5c-3d7b-416d-9d10-6867fcf909a5?source=cve
CVE: CVE-2025-1413
Published: 2025-02-28
Description: DaVinci Resolve on MacOS was found to be installed with incorrect file permissions (rwxrwxrwx). This is inconsistent with standard macOS security practices, where applications should have drwxr-xr-x permissions. Incorrect permissions allow for Dylib Hijacking. Guest account, other users and applications can exploit this vulnerability for privilege escalation. This issue affects DaVinci Resolve on MacOS in versions before 19.1.3.
CWE: CWE-732
References: https://apps.apple.com/pl/app/davinci-resolve/id571213070?mt=12; https://cert.pl/en/posts/2025/02/CVE-2025-1413/; https://cert.pl/posts/2025/02/CVE-2025-1413/
CVE: CVE-2025-1560
Published: 2025-02-28
Description: The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wow-entrance-effects-wee/trunk/wee.php; https://wordpress.org/plugins/wow-entrance-effects-wee/; https://www.wordfence.com/threat-intel/vulnerabilities/id/423e840e-0bc2-4481-afff-61ace85788d3?source=cve
CVE: CVE-2025-1570
Published: 2025-02-28
Description: The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640, CWE-640
References: https://plugins.trac.wordpress.org/changeset/3246340/directorist; https://www.wordfence.com/threat-intel/vulnerabilities/id/853562ed-7f2e-453c-b3d0-67c90bd0231f?source=cve
CVE: CVE-2025-1662
Published: 2025-02-28
Description: The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'url_media_uploader_url_upload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247347%40url-media-uploader&new=3247347%40url-media-uploader; https://wordpress.org/plugins/url-media-uploader/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8f1852-2d67-4ed9-ab3d-5b3bf4083e06?source=cve
CVE: CVE-2025-22491
Published: 2025-02-28
Description: The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arbitrary JavaScript in a browser context
for all the interacting users. This security issue has been patched in the latest version 1.5.100 of the FRS.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-79
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1009.pdf
CVE: CVE-2025-22492
Published: 2025-02-28
Description: The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this
string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.100 of FRS.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-922
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1009.pdf
CVE: CVE-2024-10860
Published: 2025-02-28
Description: The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on the _submit_uninstall_reason_action() function in all versions up to, and including, 2.19.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit a deactivation reason on behalf of a site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3246927/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5cefecf8-46dc-4ae1-9e94-b724beb7136f?source=cve
CVE: CVE-2025-1300
Published: 2025-02-28
Description: CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. 

The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections against CVE-2021-28861, leading to the same open redirect pathway.

This issue affects CodeChecker: through 6.24.5.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/Ericsson/codechecker/security/advisories/GHSA-g839-x3p3-g5fm
CVE: CVE-2025-1319
Published: 2025-02-28
Description: The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3247059/; https://wordpress.org/plugins/site-mailer/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9fe3574-f338-474c-af78-f843501d422c?source=cve
CVE: CVE-2025-22270
Published: 2025-02-28
Description: An attacker with access to the Administration panel, specifically the "Role Management"
tab, can
inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the
required additional error that allows bypassing the Content-Security-Policy policy, which
mitigates JS code execution while still allowing HTML injection.


This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CWE: CWE-79
References: https://cert.pl/en/posts/2025/02/CVE-2025-22270/; https://cert.pl/posts/2025/02/CVE-2025-22270/; https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
CVE: CVE-2025-22271
Published: 2025-02-28
Description: The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability


This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CWE: CWE-290
References: https://cert.pl/en/posts/2025/02/CVE-2025-22270/; https://cert.pl/posts/2025/02/CVE-2025-22270/; https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
CVE: CVE-2025-22272
Published: 2025-02-28
Description: In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the Content-Security-Policy policy


This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CWE: CWE-79
References: https://cert.pl/en/posts/2025/02/CVE-2025-22270/; https://cert.pl/posts/2025/02/CVE-2025-22270/; https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
CVE: CVE-2025-22273
Published: 2025-02-28
Description: Application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint it is possible to perform a brute force attack on the current password in use.


This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CWE: CWE-770
References: https://cert.pl/en/posts/2025/02/CVE-2025-22270/; https://cert.pl/posts/2025/02/CVE-2025-22270/; https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
CVE: CVE-2025-22274
Published: 2025-02-28
Description: It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page.


This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not receive any answer.
CWE: CWE-80
References: https://cert.pl/en/posts/2025/02/CVE-2025-22270/; https://cert.pl/posts/2025/02/CVE-2025-22270/; https://docs.cyberark.com/epm/24.7.1/en/content/resources/_topnav/cc_home.htm
CVE: CVE-2025-1746
Published: 2025-02-28
Description: Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-opencart
CVE: CVE-2025-1747
Published: 2025-02-28
Description: HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-opencart
CVE: CVE-2025-1748
Published: 2025-02-28
Description: HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/register.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-opencart
CVE: CVE-2025-1749
Published: 2025-02-28
Description: HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/voucher.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-opencart
CVE: CVE-2025-1776
Published: 2025-02-28
Description: Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-soteshop
CVE: CVE-2025-25916
Published: 2025-02-28
Description: wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/A7cc/e28b5790d8b40df8d418d1bd15c25d12; https://github.com/wuzhicms/wuzhicms/issues/213; https://github.com/wuzhicms/wuzhicms/issues/213
CVE: CVE-2025-26326
Published: 2025-02-28
Description: A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do not have an additional authentication or computer verification mechanism. Tests indicate that more than 1,000 systems use easy-to-guess passwords, many with less than 4 to 6 characters, including common sequences. This allows brute force attacks or trial-and-error attempts by malicious invaders. The vulnerability can be exploited by a remote attacker who knows or can guess the password used in the connection. As a result, the attacker gains complete access to the affected system and can execute commands, modify files, and compromise user security.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://github.com/NVDARemote/NVDARemote; https://github.com/azurejoga/CVE-2025-26326; https://github.com/nvda-es/TeleNVDA
CVE: CVE-2024-44754
Published: 2025-02-28
Description: Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware into any other Minut M2 product via USB.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-522
References: http://minut.com; https://www.amlisoft.se/sec_20241114.html
CVE: CVE-2025-25461
Published: 2025-02-28
Description: A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/RoNiXxCybSeC0101/CVE-2025-25461; https://www.seeddms.org/; https://github.com/RoNiXxCybSeC0101/CVE-2025-25461
CVE: CVE-2025-26047
Published: 2025-02-28
Description: Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: https://gitee.com/olajowon/loggrove/issues/IBJXG8
CVE: CVE-2025-26263
Published: 2025-02-28
Description: GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-200
References: https://github.com/DRAGOWN/CVE-2025-26263; https://www.geovision.com.tw/download/product/GV-ASManager; https://www.geovision.com.tw/download/product/GV-ASManager%20%28Access%20Control%29
CVE: CVE-2025-27400
Published: 2025-02-28
Description: Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.
CVSS Score: 2.9 (LOW)
CWE: CWE-79
References: https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea; https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3; https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0
CVE: CVE-2024-54175
Published: 2025-02-28
Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD 

could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://www.ibm.com/support/pages/node/7184453
CVE: CVE-2025-0985
Published: 2025-02-28
Description: IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD 

stores potentially sensitive information in environment variables that could be obtained by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-526
References: https://www.ibm.com/support/pages/node/7184453
CVE: CVE-2025-20049
Published: 2025-02-28
Description: The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-20060
Published: 2025-02-28
Description: An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-23405
Published: 2025-02-28
Description: Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks (ex log injection).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-24316
Published: 2025-02-28
Description: The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details, which could lead to unsafe functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-213
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-24318
Published: 2025-02-28
Description: Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1004
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-24843
Published: 2025-02-28
Description: Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and attestation of stored data.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-921
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-24849
Published: 2025-02-28
Description: Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure.
CVSS Score: 7.1 (HIGH)
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-058-01; https://www.dariohealth.com/contact/
CVE: CVE-2025-25430
Published: 2025-02-28
Description: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htm page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-17a15d9d4d2680fbb72ced0a02a64875; https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-17a15d9d4d2680fbb72ced0a02a64875
CVE: CVE-2025-25431
Published: 2025-02-28
Description: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /captive_portal.htm page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-17b15d9d4d26806a90f3d830a6143ebe; https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-17b15d9d4d26806a90f3d830a6143ebe
CVE: CVE-2025-27408
Published: 2025-02-28
Description: Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database. Without the use of a salt, identical passwords across multiple users will result in the same hash, making it easier for attackers to identify and exploit patterns, thereby accelerating the cracking process. Version 4.9.2 fixes the issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-759
References: https://github.com/mnfst/manifest/commit/3ed6f1324e96ad469ad929d470dcd0cc386c6c69; https://github.com/mnfst/manifest/security/advisories/GHSA-h8h6-7752-g28c
CVE: CVE-2025-0159
Published: 2025-02-28
Description: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://www.ibm.com/support/pages/node/7184182
CVE: CVE-2025-0160
Published: 2025-02-28
Description: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1)  could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-114
References: https://www.ibm.com/support/pages/node/7184182
CVE: CVE-2025-1795
Published: 2025-02-28
Description: During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.
CWE: CWE-116
References: https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48; https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593; https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74
CVE: CVE-2025-25428
Published: 2025-02-28
Description: TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
CVSS Score: 8.0 (HIGH)
CWE: CWE-259
References: https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-Hardcoded-password-17815d9d4d2680d5a2becf32425d93fd