deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-29998
Published: 2025-03-13
Description: This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.
CWE: CWE-799
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
CVE: CVE-2024-10942
Published: 2025-03-13
Description: The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 via deserialization of untrusted input in the 'replace_serialized_values' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must export and restore a backup in order to trigger the exploit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/trunk/lib/vendor/servmask/database/class-ai1wm-database-utility.php#L97; https://plugins.trac.wordpress.org/changeset/3253940/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0823d1d9-4f3b-4ac0-8cd1-ad208ebc325f?source=cve
CVE: CVE-2025-1635
Published: 2025-03-13
Description: Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his authenticated session in the export due to faulty business logic.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE: CVE-2025-1636
Published: 2025-03-13
Description: Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to inadvertently leak the My Personal Credentials in a shared vault via the clear history feature due to faulty business logic.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE: CVE-2025-2277
Published: 2025-03-13
Description: Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-522
References: https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE: CVE-2025-2278
Published: 2025-03-13
Description: Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE: CVE-2025-2280
Published: 2025-03-13
Description: Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0

 and earlier allows an authenticated user to bypass the browser extension restriction feature.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0004/
CVE: CVE-2024-22880
Published: 2025-03-13
Description: Cross Site Scripting vulnerability in Zadarma Zadarma extension v.1.0.11 allows a remote attacker to execute a arbitrary code via a crafted script to the webchat component.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/sAjibuu/372fd7d103218dabac95bf12580adbe4
CVE: CVE-2024-28803
Published: 2025-03-13
Description: Cross-site scripting (XSS) vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameter
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2024-57348
Published: 2025-03-13
Description: Cross Site Scripting vulnerability in PecanProject pecan through v.1.8.0 allows a remote attacker to execute arbitrary code via the crafted payload to the hostname, sitegroupid, lat, lon and sitename parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/PecanProject/pecan/issues/3400
CVE: CVE-2025-29357
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the startIp and endIp parameters at /goform/SetPptpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_4.pdf
CVE: CVE-2025-29358
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the firewallEn parameter at /goform/SetFirewallCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_2.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_2.pdf
CVE: CVE-2025-29359
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the deviceId parameter at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_6.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_6.pdf
CVE: CVE-2025-29360
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the time and timeZone parameters at /goform/SetSysTimeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_1.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_1.pdf
CVE: CVE-2025-29361
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/SetVirtualServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_5.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_5.pdf
CVE: CVE-2025-29362
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to Buffer Overflow via the list parameter at /goform/setPptpUserList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_3.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_3.pdf
CVE: CVE-2025-29363
Published: 2025-03-13
Description: Tenda RX3 US_RX3V1.0br_V16.03.13.11_multi_TDE01 is vulnerable to buffer overflow via the schedStartTime and schedEndTime parameters at /goform/saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_7.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/RX3/tenda_rx3_bof_7.pdf
CVE: CVE-2024-55198
Published: 2025-03-13
Description: User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker to enumerate users through discrepancies in the responses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html; https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55198; https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55198
CVE: CVE-2025-25625
Published: 2025-03-13
Description: A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages which then present the user name without encoding special characters will then cause the injected code to be parsed by the browsers of other users accessing the web interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2025-25625
CVE: CVE-2024-57062
Published: 2025-03-13
Description: An issue in SoundCloud IOS application v.7.65.2 allows a local attacker to escalate privileges and obtain sensitive information via the session handling component.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: http://soundcloud.com; https://github.com/SahilDabhilkar/CVE-Reference/blob/main/CVE-2024-57062.md
CVE: CVE-2025-28010
Published: 2025-03-13
Description: A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/rtnthakur/CVE/blob/main/MODX/README.md
CVE: CVE-2025-28015
Published: 2025-03-13
Description: A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-80
References: https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/HTML%20Injection%20-%20edit-profile.md
CVE: CVE-2024-12858
Published: 2025-03-13
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
*** Duplicate of 
CVE-2025-22880

***
CVE: CVE-2024-53406
Published: 2025-03-13
Description: Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to execute security bypass attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://github.com/espressif/esp-idf; https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Esp/sk_reuse.md
CVE: CVE-2024-9042
Published: 2025-03-13
Description: This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/issues/129654; https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg; http://www.openwall.com/lists/oss-security/2025/01/16/1
CVE: CVE-2025-1427
Published: 2025-03-13
Description: A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1428
Published: 2025-03-13
Description: A maliciously crafted CATPART file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1429
Published: 2025-03-13
Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1430
Published: 2025-03-13
Description: A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1431
Published: 2025-03-13
Description: A maliciously crafted SLDPRT file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1432
Published: 2025-03-13
Description: A maliciously crafted 3DM file, when parsed through Autodesk AutoCAD, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1433
Published: 2025-03-13
Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1649
Published: 2025-03-13
Description: A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1650
Published: 2025-03-13
Description: A maliciously crafted CATPRODUCT file, when parsed through Autodesk AutoCAD, can force an Uninitialized Variable vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1651
Published: 2025-03-13
Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1652
Published: 2025-03-13
Description: A maliciously crafted MODEL file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/Where-can-I-download-the-latest-update-of-AutoCAD-AutoCAD-LT-2022.html; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001
CVE: CVE-2025-1767
Published: 2025-03-13
Description: This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/kubernetes/kubernetes/pull/130786; https://groups.google.com/g/kubernetes-security-announce/c/19irihsKg7s; http://www.openwall.com/lists/oss-security/2025/03/13/9
CVE: CVE-2025-24974
Published: 2025-03-13
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-862
References: https://github.com/dataease/dataease/security/advisories/GHSA-wmfp-mjf3-57f5
CVE: CVE-2025-27103
Published: 2025-03-13
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-862
References: https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx; https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx
CVE: CVE-2025-27107
Published: 2025-03-13
Description: Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods.
This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.
CWE: CWE-74
References: https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L46; https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/translation/ValueTranslators.java; https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4823-hq77
CVE: CVE-2025-27138
Published: 2025-03-13
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-863
References: https://github.com/dataease/dataease/security/advisories/GHSA-533g-whf8-q637
CVE: CVE-2025-28011
Published: 2025-03-13
Description: A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-89
References: https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Change-password-sql-injection.pdf
CVE: CVE-2025-29768
Published: 2025-03-13
Description: Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-88
References: https://github.com/vim/vim/commit/f209dcd3defb95bae21b2740910e6aa7bb940531; https://github.com/vim/vim/security/advisories/GHSA-693p-m996-3rmf; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/