deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13713
Published: 2025-02-21
Description: The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wpexperts-square-for-give/trunk/includes/class-give-square.php#L189; https://plugins.trac.wordpress.org/changeset/3242658/wpexperts-square-for-give/trunk/includes/class-give-square.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7863c5fb-1eda-41a3-b8ec-054784ab2438?source=cve
CVE: CVE-2024-13846
Published: 2025-02-21
Description: The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://codecanyon.net/item/ultimate-learning-pro-wordpress-plugin/21772657; https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ccd2cc-ee5e-40e3-905d-21884ec01f72?source=cve
CVE: CVE-2024-13900
Published: 2025-02-21
Description: The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/3244016/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5177bde6-4922-48ee-9155-577c392809a0?source=cve
CVE: CVE-2024-9150
Published: 2025-02-21
Description: Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a host system with applications high privileges.
This issue has been fixed in version 8.0.00204.0
CWE: CWE-1336
References: https://cert.pl/en/posts/2025/02/CVE-2024-9150; https://efigo.pl/blog/cve-2024-9150/; https://www.wynenterprise.com/
CVE: CVE-2025-1402
Published: 2025-02-21
Description: The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.18.1/src/Tribe/Assets.php#L202; https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.18.1/src/Tribe/Metabox.php#L30; https://plugins.trac.wordpress.org/browser/event-tickets/tags/5.18.1/src/Tribe/Metabox.php#L490
CVE: CVE-2025-1489
Published: 2025-02-21
Description: The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3244084/; https://wordpress.org/plugins/wp-appbox/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d58355d-2762-4ecc-aec2-52a1e3323017?source=cve
CVE: CVE-2025-1535
Published: 2025-02-21
Description: A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /wuser/admin.ticket.close.php. The manipulation of the argument ticket_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/sekaino-sakura/CVE/blob/main/CVE_2.md; https://vuldb.com/?ctiid.296475; https://vuldb.com/?id.296475
CVE: CVE-2025-26794
Published: 2025-02-21
Description: Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://bugzilla.suse.com/show_bug.cgi?id=1237424; https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da[PII_REDACTED]db9fe305; https://exim.org
CVE: CVE-2020-6158
Published: 2025-02-21
Description: Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing sensitive data.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-290
References: https://security.opera.com/en/address-bar-spoofing-in-opera-mini-for-android-opera-security-advisories/
CVE: CVE-2024-10222
Published: 2025-02-21
Description: The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. By default, this can only be exploited by administrators, but the ability to upload SVG files can be extended to authors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/benbodhi/svg-support/commit/eee3e13b650511c9cc9ee0746be485d031c7c072; https://plugins.trac.wordpress.org/changeset/3244181/; https://wordpress.org/plugins/svg-support/#developers
CVE: CVE-2025-0838
Published: 2025-02-21
Description: There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://github.com/abseil/abseil-cpp/commit/5a0e2cb5e3958dd90bb8569a2766622cb74d90c1; https://lists.debian.org/debian-lts-announce/2025/04/msg00012.html
CVE: CVE-2025-1536
Published: 2025-02-21
Description: A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability affects unknown code of the file /vpn/vpn_template_style.php of the component Request Parameter Handler. The manipulation of the argument stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/koishi0x01/CVE/blob/main/CVE_1.md; https://vuldb.com/?ctiid.296476; https://vuldb.com/?id.296476
CVE: CVE-2025-1537
Published: 2025-02-21
Description: A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atualatendimento_jpeg.php. The manipulation of the argument codexame leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://drive.google.com/file/d/10IspKbYh7TYmxRPRIQZ7oRg6Xise8ykJ/view?usp=sharing; https://vuldb.com/?ctiid.296477; https://vuldb.com/?id.296477
CVE: CVE-2025-1538
Published: 2025-02-21
Description: A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-122, CWE-787
References: https://legacy.us.dlink.com/pages/product.aspx?id=4b2bbe2e3f1d440ea65bc56c7e3dcc5c; https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-set_ws_action-Vulnerability-1950448e61958049be3cc606d434bc9d; https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-set_ws_action-Vulnerability-1950448e61958049be3cc606d434bc9d?pvs=74
CVE: CVE-2025-1539
Published: 2025-02-21
Description: A vulnerability, which was classified as critical, has been found in D-Link DAP-1320 1.00. Affected by this issue is the function replace_special_char of the file /storagein.pd-XXXXXX. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://legacy.us.dlink.com/pages/product.aspx?id=4b2bbe2e3f1d440ea65bc56c7e3dcc5c; https://tasty-foxtrot-3a8.notion.site/D-link-DAP-1320-replace_special_char-Vulnerability-1960448e6195809c94f9fd2ff1f59bcf?pvs=4; https://vuldb.com/?ctiid.296480
CVE: CVE-2025-1543
Published: 2025-02-21
Description: A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/dreamercms/PathTraversal-UeditorResource.md; https://vuldb.com/?ctiid.296489; https://vuldb.com/?id.296489
CVE: CVE-2025-1544
Published: 2025-02-21
Description: A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.php. The manipulation of the argument shopId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/XinCaoZ/cve/blob/main/dingfanzu/dingfanzu-CMS%20loadShopInfo.php%20shopId%20SQL%20inject.md; https://vuldb.com/?ctiid.296490; https://vuldb.com/?id.296490
CVE: CVE-2025-26013
Published: 2025-02-21
Description: An issue in Loggrove v.1.0 allows a remote attacker to obtain sensitive information via the read.py component.
CVSS Score: 8.2 (HIGH)
CWE: CWE-540
References: https://gitee.com/olajowon/loggrove/issues/IBJSXS
CVE: CVE-2024-45673
Published: 2025-02-21
Description: IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-260
References: https://www.ibm.com/support/pages/node/7183801
CVE: CVE-2025-1403
Published: 2025-02-21
Description: Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library.
CVSS Score: 8.6 (HIGH)
CWE: CWE-502
References: https://www.ibm.com/support/pages/node/7183868
CVE: CVE-2025-1546
Published: 2025-02-21
Description: A vulnerability has been found in BDCOM Behavior Management and Auditing System up to 20250210 and classified as critical. Affected by this vulnerability is the function log_operate_clear of the file /webui/modules/log/operate.mds. The manipulation of the argument start_code leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/koishi0x01/CVE/blob/main/CVE_2.md; https://vuldb.com/?ctiid.296491; https://vuldb.com/?id.296491
CVE: CVE-2025-1548
Published: 2025-02-21
Description: A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archives/edit. The manipulation of the argument editorValue/answer/content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-918
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/dreamercms/RemoteFileInclusion-ArticleEditorImageUpload.md; https://vuldb.com/?ctiid.296494; https://vuldb.com/?id.296494
CVE: CVE-2025-25505
Published: 2025-02-21
Description: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC6_getRootStatus_callback_overflow/detail.md
CVE: CVE-2025-25507
Published: 2025-02-21
Description: There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC6_formexecommand_cmdinput_rce/detail.md
CVE: CVE-2025-25510
Published: 2025-02-21
Description: Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/faqiadegege/IoTVuln/blob/main/tendaAC8_get_parentControl_list_Info_urls_overflow/detail.md
CVE: CVE-2025-26014
Published: 2025-02-21
Description: A Remote Code Execution (RCE) vulnerability in Loggrove v.1.0 allows a remote attacker to execute arbitrary code via the path parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gitee.com/olajowon/loggrove/; https://gitee.com/olajowon/loggrove/issues/IBJT1K; https://github.com/olajowon/loggrove/
CVE: CVE-2024-55156
Published: 2025-02-21
Description: An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-134
References: https://github.com/aixiao0621/CVE/blob/main/CVE-2024-55156/README.md
CVE: CVE-2024-55159
Published: 2025-02-21
Description: GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-89
References: https://github.com/SuperDu1/CVE/issues/1; https://github.com/tiger1103/gfast/blob/os-v3.2/internal/app/system/logic/sysLoginLog/sys_login_log.go#L75
CVE: CVE-2024-57176
Published: 2025-02-21
Description: An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL.
CVSS Score: 7.6 (HIGH)
CWE: CWE-437
References: https://github.com/DYX217/Incorrect-Access-Control
CVE: CVE-2025-25765
Published: 2025-02-21
Description: MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.
CVSS Score: 4.0 (MEDIUM)
References: https://flowus.cn/share/be03dd2c-b760-457a-a919-e388d7566ff2
CVE: CVE-2025-25766
Published: 2025-02-21
Description: An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-77
References: https://flowus.cn/share/7097c747-ae3e-4cef-a[PII_REDACTED]98607
CVE: CVE-2025-25875
Published: 2025-02-21
Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL injection to obtain sensitive data.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/SticKManII/cve-poc/blob/main/chat-box/4/poc.md
CVE: CVE-2025-25876
Published: 2025-02-21
Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/SticKManII/cve-poc/blob/main/chat-box/2/poc.md
CVE: CVE-2025-25877
Published: 2025-02-21
Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL injection to obtain sensitive data.
CVSS Score: 3.8 (LOW)
CWE: CWE-89
References: https://github.com/SticKManII/cve-poc/blob/main/chat-box/1/poc.md
CVE: CVE-2025-25878
Published: 2025-02-21
Description: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data.
CVSS Score: 3.8 (LOW)
CWE: CWE-89
References: https://github.com/SticKManII/cve-poc/blob/main/chat-box/3/poc.md
CVE: CVE-2020-19248
Published: 2025-02-21
Description: SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by searching for page contamination URLs, thus triggering vulnerabilities when the program uses eval statements to parse templates.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: https://github.com/SticKManII/SticKManII.github.io/tree/master/2019/07/31/PbootCMSv1-4-1-%E5%89%8D%E5%8F%B0%E6%90%9C%E7%B4%A2%E9%A1%B5%E9%9D%A2%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5; https://unh3x.github.io/2019/07/19/PbootCMSv1.4.1_Template_Injection/
CVE: CVE-2025-25604
Published: 2025-02-21
Description: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/sezangel/IOT-vul/tree/main/Totolink/X5000R/5
CVE: CVE-2025-25605
Published: 2025-02-21
Description: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/sezangel/IOT-vul/tree/main/Totolink/X5000R/4
CVE: CVE-2025-25767
Published: 2025-02-21
Description: A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-266
References: https://flowus.cn/share/a6170a19-032b-462d-8bf9-06ab139f78ba
CVE: CVE-2025-25768
Published: 2025-02-21
Description: MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-77
References: https://flowus.cn/share/8838861d-0b32-4314-a13d-edb22b72cebc
CVE: CVE-2025-25769
Published: 2025-02-21
Description: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://flowus.cn/share/56c86622-1e4d-47ed-923c-9e37aff00079
CVE: CVE-2025-25770
Published: 2025-02-21
Description: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://flowus.cn/share/dddbd17e-e459-46c7-b3f9-9c9a90cee804; https://flowus.cn/share/dddbd17e-e459-46c7-b3f9-9c9a90cee804
CVE: CVE-2025-25772
Published: 2025-02-21
Description: A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: https://www.yuque.com/u123456789-6sobi/cdgcbq/pkwoqmkamcm9854r?singleDoc#%E3%80%8AjspXcms_csrf%E3%80%8B
CVE: CVE-2025-1555
Published: 2025-02-21
Description: A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. This vulnerability affects the function saveImage. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Rain1er/report/blob/main/CDG/bnhiMg%3D%3D.md; https://vuldb.com/?ctiid.296506; https://vuldb.com/?id.296506
CVE: CVE-2025-25282
Published: 2025-02-21
Description: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tenant user accounts, add user account into other tenant). Unauthorized cross-tenant access: list user from other tenant (e.g., via GET /<tenant_id>/user/list), add user account to other tenant (POST /<tenant_id>/user). This issue has not yet been patched. Users are advised to reach out to the project maintainers to coordinate a fix.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://github.com/infiniflow/ragflow/security/advisories/GHSA-wc5v-g79p-7hch; https://github.com/infiniflow/ragflow/security/advisories/GHSA-wc5v-g79p-7hch