deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4727
Published: 2025-05-15
Description: A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/livedata_server.js. The manipulation of the argument forwardedFor leads to inefficient regular expression complexity. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.2 is able to address this issue. The identifier of the patch is f7ea6817b90952baaea9baace2a3b4366fee6a63. It is recommended to upgrade the affected component.
CVSS Score: 3.7 (LOW)
CWE: CWE-400, CWE-1333
References: https://github.com/meteor/meteor/commit/f7ea6817b90952baaea9baace2a3b4366fee6a63; https://github.com/meteor/meteor/issues/13713; https://github.com/meteor/meteor/pull/13721
CVE: CVE-2025-4728
Published: 2025-05-15
Description: A vulnerability was found in SourceCodester Best Online News Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /search.php. The manipulation of the argument searchtitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Lena-lyy/SQL/issues/4; https://vuldb.com/?ctiid.309030; https://vuldb.com/?id.309030
CVE: CVE-2025-47930
Published: 2025-05-16
Description: Zulip is an open-source team chat application. Starting in version 10.0 and prior to version 10.3, the "Who can create public channels" access control mechanism can be circumvented by creating a private or web-public channel, and then changing the channel privacy to public. A similar technique works for creating private channels without permission, though such a process requires either the API or modifying the HTML, as we do mark the "private" radio button as disabled in such cases. Version 10.3 contains a patch.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/zulip/zulip/commit/d2ff4bda4c3efa30fc3ab1f151255cfdbf370f78; https://github.com/zulip/zulip/security/advisories/GHSA-rqg7-xfqg-v7q5; https://zulip.com/help/configure-who-can-create-channels
CVE: CVE-2025-4729
Published: 2025-05-16
Description: A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20[PII_REDACTED]. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/2.md; https://vuldb.com/?ctiid.309031; https://vuldb.com/?id.309031
CVE: CVE-2025-4730
Published: 2025-05-16
Description: A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20[PII_REDACTED]. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/3.md; https://vuldb.com/?ctiid.309032; https://vuldb.com/?id.309032
CVE: CVE-2025-4731
Published: 2025-05-16
Description: A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20[PII_REDACTED]. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/4.md; https://vuldb.com/?ctiid.309033; https://vuldb.com/?id.309033
CVE: CVE-2024-51475
Published: 2025-05-16
Description: IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7233695
CVE: CVE-2025-47809
Published: 2025-05-16
Description: Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.
CVSS Score: 8.2 (HIGH)
CWE: CWE-272
References: https://www.wibu.com/support/security-advisories/wibu-100120.html
CVE: CVE-2025-4732
Published: 2025-05-16
Description: A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20[PII_REDACTED]. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/6.md; https://vuldb.com/?ctiid.309034; https://vuldb.com/?id.309034
CVE: CVE-2025-4733
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20[PII_REDACTED]. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/7.md; https://vuldb.com/?ctiid.309035; https://vuldb.com/?id.309035
CVE: CVE-2025-4734
Published: 2025-05-16
Description: A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/ci_update.php. The manipulation of the argument id/name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/CVE/issues/1; https://vuldb.com/?ctiid.309036; https://vuldb.com/?id.309036
CVE: CVE-2025-4735
Published: 2025-05-16
Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pages/product.php. The manipulation of the argument Picture leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/[PII_REDACTED]/CVE/issues/2; https://vuldb.com/?ctiid.309037; https://vuldb.com/?id.309037
CVE: CVE-2025-4736
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Daily Expense Tracker 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/bleakTS/myCVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.309038
CVE: CVE-2025-4169
Published: 2025-05-16
Description: The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3292123%40posts-per-cat&new=3292123%40posts-per-cat&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb60874-85c1-40a9-b19d-131c2c2d49ba?source=cve
CVE: CVE-2025-4739
Published: 2025-05-16
Description: A vulnerability was found in projectworlds Hospital Database Management System 1.0. It has been classified as critical. This affects an unknown part of the file /medicines_info.php. The manipulation of the argument Med_ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/[PII_REDACTED]/cve/issues/1; https://vuldb.com/?ctiid.309039; https://vuldb.com/?id.309039
CVE: CVE-2025-4740
Published: 2025-05-16
Description: A vulnerability was found in BeamCtrl Airiana up to 11.0. It has been declared as problematic. This vulnerability affects unknown code of the file coef. The manipulation leads to deserialization. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/BeamCtrl/Airiana/issues/42; https://github.com/BeamCtrl/Airiana/issues/42#issue[PII_REDACTED]; https://vuldb.com/?ctiid.309040
CVE: CVE-2025-4741
Published: 2025-05-16
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pages/purchase_add.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/snkercyber/CVE/issues/1; https://vuldb.com/?ctiid.309041; https://vuldb.com/?id.309041
CVE: CVE-2025-4742
Published: 2025-05-16
Description: A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of the file grpo_vanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/XU-YIJIE/grpo-flat/issues/3; https://vuldb.com/?ctiid.309042; https://vuldb.com/?id.309042
CVE: CVE-2025-4743
Published: 2025-05-16
Description: A vulnerability classified as critical was found in code-projects Employee Record System 1.0. Affected by this vulnerability is an unknown functionality of the file /dashboard/getData.php. The manipulation of the argument keywords leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/872323857/CVE/blob/main/employee-record-system.md; https://vuldb.com/?ctiid.309043
CVE: CVE-2025-4744
Published: 2025-05-16
Description: A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functionality of the file dashboard\edit_employee.php. The manipulation of the argument employeed_id/first_name/middle_name/last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/872323857/CVE/blob/main/employee-record-system-xss1.pdf; https://vuldb.com/?ctiid.309044
CVE: CVE-2025-4745
Published: 2025-05-16
Description: A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_employees.php. The manipulation of the argument employeed_id/first_name/middle_name/last_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/872323857/CVE/blob/main/employee-record-system-xss2.pdf; https://vuldb.com/?ctiid.309045
CVE: CVE-2025-48174
Published: 2025-05-16
Description: In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/AOMediaCodec/libavif/commit/50a743062938a3828581d725facc9c2b92a1d109; https://github.com/AOMediaCodec/libavif/commit/c9f1bea437f21cb78f9919c332922a3b0ba65e11; https://github.com/AOMediaCodec/libavif/commit/e5fdefe7d1776e6c4cf1703c163a8c[PII_REDACTED]
CVE: CVE-2025-48175
Published: 2025-05-16
Description: In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/AOMediaCodec/libavif/commit/64d956ed5a602f78cebf29da023280944ee92efd; https://github.com/AOMediaCodec/libavif/pull/2769; https://github.com/AOMediaCodec/libavif/security/advisories/GHSA-762c-2538-h844
CVE: CVE-2025-4746
Published: 2025-05-16
Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/purchase_delete.php. The manipulation of the argument pr_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/snkercyber/CVE/issues/2; https://vuldb.com/?ctiid.309046; https://vuldb.com/?id.309046
CVE: CVE-2025-4747
Published: 2025-05-16
Description: A vulnerability was found in Bohua NetDragon Firewall 1.0 and classified as critical. This issue affects some unknown processing of the file /systemstatus/ip_status.php. The manipulation of the argument subnet leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/lche511/cve/issues/1; https://vuldb.com/?ctiid.309047; https://vuldb.com/?id.309047
CVE: CVE-2025-4749
Published: 2025-05-16
Description: A vulnerability classified as critical was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This vulnerability affects the function sub_4983B0 of the file /H5/backup.asp?opt=reset of the component Factory Reset Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/backup.md; https://vuldb.com/?ctiid.309052; https://vuldb.com/?id.309052
CVE: CVE-2025-4759
Published: 2025-05-16
Description: Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.
CVSS Score: 8.3 (HIGH)
CWE: CWE-179
References: https://gist.github.com/Xavier59/881aef04940970dc3e738dcbff64151f; https://github.com/lirantal/lockfile-lint/blob/89b5cad028df4d77bab2b73ac93bc61e392668ab/packages/lockfile-lint-api/src/validators/ValidatePackageNames.js%23L51-L63; https://github.com/lirantal/lockfile-lint/commit/9e5305bd3e4f0c6acc0d23ec43eac2bd5303b4ca
CVE: CVE-2025-1245
Published: 2025-05-16
Description: Bypass Connection Restriction vulnerability in Hitachi Infrastructure Analytics Advisor (Data Center Analytics component), Hitachi Ops Center Analyzer  (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.4-00.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-348
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-116/index.html
CVE: CVE-2025-3201
Published: 2025-05-16
Description: The Contact Form builder with drag & drop for WordPress  WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4248289f-36d2-41c5-baf6-bb2c630482ef/
CVE: CVE-2025-3516
Published: 2025-05-16
Description: The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/336a78cd-297b-4f47-a007-e33eac7f1dad/
CVE: CVE-2025-4750
Published: 2025-05-16
Description: A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). This issue affects some unknown processing of the file /H5/get_version.data of the component Configuration Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/get_version.md; https://vuldb.com/?ctiid.309053; https://vuldb.com/?id.309053
CVE: CVE-2025-4751
Published: 2025-05-16
Description: A vulnerability, which was classified as problematic, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected is an unknown function of the file /index.data. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/index.md; https://vuldb.com/?ctiid.309054; https://vuldb.com/?id.309054
CVE: CVE-2025-4752
Published: 2025-05-16
Description: A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /install_base.data. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/install_base.md; https://vuldb.com/?ctiid.309055; https://vuldb.com/?id.309055
CVE: CVE-2024-8201
Published: 2025-05-16
Description: Cross-Site WebSocket Hijacking vulnerability in Hitachi Ops Center Analyzer (RAID Agent component).This issue affects Hitachi Ops Center Analyzer: from 10.8.0-00 before 11.0.4-00; Hitachi Ops Center Analyzer: from 10.9.0-00 before 11.0.4-00.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1385
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-116/index.html
CVE: CVE-2025-1531
Published: 2025-05-16
Description: Authentication credentials leakage  vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0.0-00 before 11.0.4-00.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1392
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-116/index.html
CVE: CVE-2025-3624
Published: 2025-05-16
Description: Missing Authorization vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component).This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.4-00.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-116/index.html
CVE: CVE-2025-4753
Published: 2025-05-16
Description: A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. Affected by this issue is some unknown functionality of the file /login.data. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/login.md; https://vuldb.com/?ctiid.309056; https://vuldb.com/?id.309056
CVE: CVE-2025-4755
Published: 2025-05-16
Description: A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been classified as critical. This affects the function sub_497DE4 of the file /H5/netconfig.asp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/netconfig.md; https://vuldb.com/?ctiid.309057; https://vuldb.com/?id.309057
CVE: CVE-2024-53827
Published: 2025-05-16
Description: Ericsson Packet Core Controller (PCC) contains a
vulnerability where an attacker sending a large volume of specially
crafted messages may cause service degradation
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.ericsson.com/en/about-us/security/psirt/CVE-2024-53827
CVE: CVE-2025-4756
Published: 2025-05-16
Description: A vulnerability was found in D-Link DI-7003GV2 24.04.18D1 R(68125). It has been declared as problematic. This vulnerability affects unknown code of the file /H5/restart.asp. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/restart.md; https://vuldb.com/?ctiid.309058; https://vuldb.com/?id.309058
CVE: CVE-2025-4757
Published: 2025-05-16
Description: A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. It has been rated as critical. This issue affects some unknown processing of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xinxinwang99/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.309059
CVE: CVE-2025-4758
Published: 2025-05-16
Description: A vulnerability classified as critical has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected is an unknown function of the file /contact.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xinxinwang99/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.309060