deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9768
Published: 2025-09-01
Description: A vulnerability was identified in itsourcecode Sports Management System 1.0. This impacts an unknown function of the file /Admin/mode.php. The manipulation of the argument code leads to sql injection. The attack is possible to be carried out remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hjsjbsg/record-for-own/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.322068
CVE: CVE-2025-9769
Published: 2025-09-01
Description: A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub_478D28 of the file /mng_platform.asp. The manipulation of the argument addr with the input `echo 12345 > poc.txt` results in command injection. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/xyh4ck/iot_poc; https://github.com/xyh4ck/iot_poc#vulnerability-verification-process; https://vuldb.com/?ctiid.322069
CVE: CVE-2025-9770
Published: 2025-09-01
Description: A weakness has been identified in Campcodes Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Dashboard Login. This manipulation of the argument Password causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Yashh-G/zero-day-research/blob/main/HMS_Admin_Auth_Bypass.pdf; https://vuldb.com/?ctiid.322070; https://vuldb.com/?id.322070
CVE: CVE-2025-9771
Published: 2025-09-01
Description: A security vulnerability has been detected in SourceCodester Eye Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file /main/search_index_Diagnosis.php. Such manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_3.md; https://vuldb.com/?ctiid.322071; https://vuldb.com/?id.322071
CVE: CVE-2025-9772
Published: 2025-09-01
Description: A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /staff/edit.php. Performing manipulation of the argument image results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/lan041221/cvec/issues/18; https://vuldb.com/?ctiid.322072; https://vuldb.com/?id.322072
CVE: CVE-2025-9773
Published: 2025-09-01
Description: A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing manipulation of the argument Last Name can lead to cross site scripting. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/03hice-collab/CVE/issues/2; https://vuldb.com/?ctiid.322073; https://vuldb.com/?id.322073
CVE: CVE-2025-9774
Published: 2025-09-01
Description: A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processing of the file /patients/edit-patient.php. The manipulation of the argument Email leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/diy777/cve/issues/1; https://vuldb.com/?ctiid.322074; https://vuldb.com/?id.322074
CVE: CVE-2025-9775
Published: 2025-09-01
Description: A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /staff/edit-my-profile.php. The manipulation of the argument image results in unrestricted upload. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/diy777/cve/issues/2; https://vuldb.com/?ctiid.322075; https://vuldb.com/?id.322075
CVE: CVE-2025-36133
Published: 2025-09-01
Description: IBM App Connect Enterprise Certified Container CD: 9.2.0 through 11.6.0, 12.1.0 through 12.14.0, and 12.0 LTS: 12.0.0 through 12.0.14stores potentially sensitive information in log files during installation that could be read by a local user on the container.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7243690
CVE: CVE-2025-9778
Published: 2025-09-01
Description: A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. The manipulation leads to hard-coded credentials. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used.
CVSS Score: 1.9 (LOW)
CWE: CWE-259, CWE-798, CWE-798
References: https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e8.md; https://github.com/August829/Yu/blob/main/58ead8e7e08bfb0e8.md#steps-to-reproduce; https://vuldb.com/?ctiid.322080
CVE: CVE-2024-12914
Published: 2025-09-01
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akınsoft QR Menü allows Cross-Site Scripting (XSS).This issue affects QR Menü: from s1.05.05 before v1.05.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0202
CVE: CVE-2024-12924
Published: 2025-09-01
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akınsoft QR Menü allows Forceful Browsing, Phishing.This issue affects QR Menü: from s1.05.05 before v1.05.12.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601
References: https://www.usom.gov.tr/bildirim/tr-25-0202
CVE: CVE-2024-12925
Published: 2025-09-01
Description: Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows HTTP Response Splitting.This issue affects QR Menü: from s1.05.05 before v1.05.12.
CVSS Score: 7.3 (HIGH)
CWE: CWE-297
References: https://www.usom.gov.tr/bildirim/tr-25-0202
CVE: CVE-2025-0610
Published: 2025-09-01
Description: Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forgery.This issue affects QR Menü: from s1.05.06 before v1.05.12.
CVSS Score: 8.6 (HIGH)
CWE: CWE-352
References: https://www.usom.gov.tr/bildirim/tr-25-0202
CVE: CVE-2025-2412
Published: 2025-09-01
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass.This issue affects QR Menu: from s1.05.07 before v1.05.12.
CVSS Score: 8.6 (HIGH)
CWE: CWE-307
References: https://www.usom.gov.tr/bildirim/tr-25-0202
CVE: CVE-2025-9779
Published: 2025-09-01
Description: A vulnerability was detected in TOTOLINK A702R 4.0.0-B20[PII_REDACTED]. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md; https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md#poc; https://vuldb.com/?ctiid.322081
CVE: CVE-2025-9780
Published: 2025-09-01
Description: A flaw has been found in TOTOLINK A702R 4.0.0-B20[PII_REDACTED]. Affected by this issue is the function sub_419BE0 of the file /boafrm/formIpQoS. This manipulation of the argument mac causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formIpQoS/formIpQoS.md; https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formIpQoS/formIpQoS.md#poc; https://vuldb.com/?ctiid.322082
CVE: CVE-2025-9781
Published: 2025-09-01
Description: A vulnerability has been found in TOTOLINK A702R 4.0.0-B20[PII_REDACTED]. This affects the function sub_4162DC of the file /boafrm/formFilter. Such manipulation of the argument ip6addr leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md; https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formFilter/formFilter.md#poc; https://vuldb.com/?ctiid.322083
CVE: CVE-2025-9782
Published: 2025-09-01
Description: A vulnerability was found in TOTOLINK A702R 4.0.0-B20[PII_REDACTED]. This vulnerability affects the function sub_4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the argument submit-url results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formOneKeyAccessButton/formOneKeyAccessButton.md; https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formOneKeyAccessButton/formOneKeyAccessButton.md#poc; https://vuldb.com/?ctiid.322084
CVE: CVE-2025-0656
Published: 2025-09-01
Description: IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7243699
CVE: CVE-2025-33082
Published: 2025-09-01
Description: IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7243699
CVE: CVE-2025-33083
Published: 2025-09-01
Description: IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7243699
CVE: CVE-2025-33084
Published: 2025-09-01
Description: IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7243699
CVE: CVE-2025-33099
Published: 2025-09-01
Description: IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://www.ibm.com/support/pages/node/7243699
CVE: CVE-2025-33102
Published: 2025-09-01
Description: IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7243699
CVE: CVE-2025-9783
Published: 2025-09-01
Description: A vulnerability was determined in TOTOLINK A702R 4.0.0-B20[PII_REDACTED]. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formParentControl/formParentControl.md; https://github.com/rew1X/CVE/blob/main/TOTOLINK/A702R/formParentControl/formParentControl.md#poc; https://vuldb.com/?ctiid.322085
CVE: CVE-2025-55007
Published: 2025-09-01
Description: Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request forgery. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact of this vulnerability is limited. However, an attacker could be able to leverage this vulnerability to scan the internal network. This issue has been patched in version 8.1.37.
CVSS Score: 3.5 (LOW)
CWE: CWE-918
References: https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-7f6m-ph57-52w6
CVE: CVE-2025-57799
Published: 2025-09-01
Description: StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server privileges. Users of all versions of the StreamVault system to date who have not modified their background passwords or use weak passwords are at risk of having their systems taken over via remote command execution. This issue has been patched in version 250822.
CWE: CWE-78
References: https://github.com/lemon8866/StreamVault/commit/2e3f1f54b7d8a4e6389b640796866ac1108780ef; https://github.com/lemon8866/StreamVault/security/advisories/GHSA-qg4r-92hv-g9f4
CVE: CVE-2025-9786
Published: 2025-09-01
Description: A vulnerability was found in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /teacher_signup.php. Performing manipulation of the argument firstname results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyyyxxxx1017/CVE/issues/6; https://vuldb.com/?ctiid.322102; https://vuldb.com/?id.322102
CVE: CVE-2025-9375
Published: 2025-09-01
Description: XML Injection vulnerability in xmltodict allows Input Data Manipulation.
This issue affects xmltodict: from 0.14.2 before 0.15.1.

NOTE: the scope of this CVE is disputed by the vendor on the grounds that xmltodict.unparse() delegates element-name handling to Python's xml.sax.saxutils.XMLGenerator, and that XMLGenerator should be the component performing validation.
CWE: CWE-91
References: https://fluidattacks.com/advisories/mono; https://github.com/martinblech/xmltodict; https://github.com/martinblech/xmltodict/blob/v0.15.1/CHANGELOG.md
CVE: CVE-2025-3586
Published: 2025-09-01
Description: In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote authenticated admin users with the Instance Administrator role to execute arbitrary Groovy scripts (i.e., remote code execution) through Object actions. 

In contrast, in Liferay DXP (Liferay SaaS), the use of Groovy in Object actions is not allowed due to the high security risks it poses. 

Starting from Liferay DXP 2024.Q2 and later, a new feature has been introduced in Instance Settings that allows administrators to configure whether Groovy scripts are allowed in their instances.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3586
CVE: CVE-2025-9788
Published: 2025-09-01
Description: A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_class.php. Executing manipulation of the argument id_no can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyyyxxxx1017/CVE/issues/10; https://vuldb.com/?ctiid.322103; https://vuldb.com/?id.322103
CVE: CVE-2025-9789
Published: 2025-09-01
Description: A vulnerability was identified in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is some unknown functionality of the file /admin/edituser.php. The manipulation of the argument userid leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/YoSheep/cve/blob/main/Online%20Hotel%20Reservation%20System%20In%20PHP%20With%20Source%20Code%20-%20SQL%20Injection%20in%20edituser.php.md; https://vuldb.com/?ctiid.322104; https://vuldb.com/?id.322104
CVE: CVE-2025-9790
Published: 2025-09-01
Description: A security flaw has been discovered in SourceCodester Hotel Reservation System 1.0. This affects an unknown part of the file /admin/updateabout.php. The manipulation of the argument address results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/YoSheep/cve/blob/main/Online%20Hotel%20Reservation%20System%20In%20PHP%20With%20Source%20Code%20-%20SQL%20Injection%20in%20updateabout.php.md; https://vuldb.com/?ctiid.322105; https://vuldb.com/?id.322105
CVE: CVE-2025-9791
Published: 2025-09-01
Description: A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. This manipulation of the argument wanMTU causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/Cpppq43/Tenda/blob/main/Tenda_AC20_V16.03.08.05.md; https://github.com/Cpppq43/Tenda/blob/main/Tenda_AC20_V16.03.08.05.md#poc; https://vuldb.com/?ctiid.322106
CVE: CVE-2025-9809
Published: 2025-09-01
Description: Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary code via a crafted .cue file with a file path exceeding PATH_MAX_LENGTH that is copied using memcpy into a fixed-size buffer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/libretro/libretro-common/blob/master/formats/cdfs/cdfs.c#L471; https://github.com/libretro/libretro-common/issues/222
CVE: CVE-2025-9810
Published: 2025-09-01
Description: TOCTOU  in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen("w") on the history path and subsequent chmod() on the same path.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-367
References: https://github.com/antirez/linenoise/blob/master/linenoise.c#L1321; https://github.com/antirez/linenoise/pull/202; https://github.com/antirez/linenoise/blob/4111f1d6cd29e136b4e86a25d1dd859a1e00813b/linenoise.c#L1321
CVE: CVE-2025-9792
Published: 2025-09-01
Description: A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /e_dashboard/e_all_info.php. Such manipulation of the argument mid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/62; https://itsourcecode.com/; https://vuldb.com/?ctiid.322107
CVE: CVE-2025-9793
Published: 2025-09-01
Description: A vulnerability was detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /setting/admin.php of the component Setting Handler. Performing manipulation of the argument ddlBranch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/61; https://itsourcecode.com/; https://vuldb.com/?ctiid.322108
CVE: CVE-2025-9794
Published: 2025-09-01
Description: A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/pos_transac.php?action=add. Executing manipulation of the argument cash/firstname can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Yuanwennnn/cve/issues/2; https://github.com/e1evensu/cve/issues/1; https://vuldb.com/?ctiid.322109
CVE: CVE-2025-9795
Published: 2025-09-01
Description: A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/xujeff/tianti/issues/43; https://github.com/xujeff/tianti/issues/43#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322110
CVE: CVE-2024-28988
Published: 2025-09-01
Description: SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. 





We recommend all Web Help Desk customers apply the patch, which is now available. 





We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-3; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28988
CVE: CVE-2025-9796
Published: 2025-09-01
Description: A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 5.13.0 mitigates this issue. The patch is identified as 63773c97a56bdb3649510e83b66c16db4754965b. Upgrading the affected component is recommended.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/thinkgem/jeesite5/commit/63773c97a56bdb3649510e83b66c16db4754965b; https://github.com/thinkgem/jeesite5/issues/33; https://github.com/thinkgem/jeesite5/issues/33#issue[PII_REDACTED]