deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24290
Published: 2025-06-29
Description: Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://community.ui.com/releases/Security-Advisory-Bulletin-048-048/af007d99-bb6d-4368-a12f-75e84de19e8d
CVE: CVE-2025-24292
Published: 2025-06-29
Description: A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or VPN Server (l2tp and OpenVPN) using a device’s  MAC address from 802.1X or MAC Authentication, if both services are enabled and share the same RADIUS profile.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://community.ui.com/releases/Security-Advisory-Bulletin-049-049/7a019b27-6c77-4500-bec8-596cd87c9292
CVE: CVE-2025-6869
Published: 2025-06-29
Description: A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/testimonials/manage.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/25; https://vuldb.com/?ctiid.314341; https://vuldb.com/?id.314341
CVE: CVE-2025-6870
Published: 2025-06-29
Description: A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Content.php?f=service. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/ez-lbz/poc/issues/26; https://vuldb.com/?ctiid.314342; https://vuldb.com/?id.314342
CVE: CVE-2015-20112
Published: 2025-06-29
Description: RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.
CVSS Score: 3.4 (LOW)
CWE: CWE-325
References: https://github.com/LaurentMT/go-ethereum/commit/e8cba7283b57280b1bcf5761478f[PII_REDACTED]01; https://github.com/ethereum/devp2p/blob/master/rlpx.md#known-issues-in-the-current-version; https://github.com/ethereum/devp2p/issues/32
CVE: CVE-2025-6871
Published: 2025-06-29
Description: A vulnerability classified as critical has been found in SourceCodester Simple Company Website 1.0. This affects an unknown part of the file /classes/Login.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ez-lbz/poc/issues/27; https://vuldb.com/?ctiid.314343; https://vuldb.com/?id.314343
CVE: CVE-2025-6872
Published: 2025-06-29
Description: A vulnerability classified as critical was found in SourceCodester Simple Company Website 1.0. This vulnerability affects unknown code of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/ez-lbz/poc/issues/28; https://vuldb.com/?ctiid.314344; https://vuldb.com/?id.314344
CVE: CVE-2025-6873
Published: 2025-06-29
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Simple Company Website 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/ez-lbz/poc/issues/29; https://vuldb.com/?ctiid.314345; https://vuldb.com/?id.314345
CVE: CVE-2025-6874
Published: 2025-06-29
Description: A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/add_subscribe.php. The manipulation of the argument user_id/plan_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-15.md; https://vuldb.com/?ctiid.314346; https://vuldb.com/?id.314346
CVE: CVE-2025-6875
Published: 2025-06-29
Description: A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /panel/edit-subscription.php. The manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-16.md; https://vuldb.com/?ctiid.314347; https://vuldb.com/?id.314347
CVE: CVE-2025-6876
Published: 2025-06-29
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /panel/add-category.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-17.md; https://vuldb.com/?ctiid.314348; https://vuldb.com/?id.314348
CVE: CVE-2025-6877
Published: 2025-06-30
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /panel/edit-category.php. The manipulation of the argument editid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-18.md; https://vuldb.com/?ctiid.314349; https://vuldb.com/?id.314349
CVE: CVE-2025-6878
Published: 2025-06-30
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /panel/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-19.md; https://vuldb.com/?ctiid.314350; https://vuldb.com/?id.314350
CVE: CVE-2025-6879
Published: 2025-06-30
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /panel/add-tax.php. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-20.md; https://vuldb.com/?ctiid.314351; https://vuldb.com/?id.314351
CVE: CVE-2025-6880
Published: 2025-06-30
Description: A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-tax.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-21.md; https://vuldb.com/?ctiid.314352; https://vuldb.com/?id.314352
CVE: CVE-2025-0634
Published: 2025-06-30
Description: Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/Samsung/rlottie/pull/571; https://github.com/Samsung/rlottie/commit/507ea027e47d3e1dc7ddbd[PII_REDACTED]eae7ebb9
CVE: CVE-2025-46014
Published: 2025-06-30
Description: Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-284
References: https://github.com/Souhardya/Exploit-PoCs/tree/main/HonorPCManager-PrivEsc
CVE: CVE-2025-53075
Published: 2025-06-30
Description: Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/Samsung/rlottie/pull/571
CVE: CVE-2025-6881
Published: 2025-06-30
Description: A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pppoe_base.asp of the component jhttpd. The manipulation of the argument mschap_en leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://vuldb.com/?ctiid.314360; https://vuldb.com/?id.314360; https://vuldb.com/?submit.603692
CVE: CVE-2025-53074
Published: 2025-06-30
Description: Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/Samsung/rlottie/pull/571
CVE: CVE-2025-53076
Published: 2025-06-30
Description: Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/Samsung/rlottie/pull/573
CVE: CVE-2025-6882
Published: 2025-06-30
Description: A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://vuldb.com/?ctiid.314361; https://vuldb.com/?id.314361; https://vuldb.com/?submit.603693
CVE: CVE-2025-6883
Published: 2025-06-30
Description: A vulnerability classified as critical was found in code-projects Staff Audit System 1.0. This vulnerability affects unknown code of the file /update_index.php. The manipulation of the argument updateid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/qingchuana/q1ngchuan/issues/7; https://vuldb.com/?ctiid.314362
CVE: CVE-2025-6884
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown processing of the file /search_index.php. The manipulation of the argument Search leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/qingchuana/q1ngchuan/issues/8; https://vuldb.com/?ctiid.314363
CVE: CVE-2025-6885
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/edit-teacher-detail.php. The manipulation of the argument tid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/louis-zly/myCVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.314364
CVE: CVE-2025-6886
Published: 2025-06-30
Description: A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC5-setSchedWifi_schedEndTime-21d53a41781f80fb8a90f08898e8d404?source=copy_link; https://lavender-bicycle-a5a.notion.site/Tenda-AC5-setSchedWifi_schedStartTime-21d53a41781f803f97eeddd9828c5c84?source=copy_link; https://vuldb.com/?ctiid.314365
CVE: CVE-2025-6887
Published: 2025-06-30
Description: A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/SetSysTimeCfg. The manipulation of the argument time/timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromSetSysTime_time-21d53a41781f8002bdb3fe8344d6fd8c?source=copy_link; https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromSetSysTime_timeZone-21d53a41781f8021ae2fd2ac639f1b3f?source=copy_link; https://vuldb.com/?ctiid.314366
CVE: CVE-2025-6888
Published: 2025-06-30
Description: A vulnerability was found in PHPGurukul Teachers Record Management System 2.1. It has been classified as critical. This affects an unknown part of the file /admin/changeimage.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/louis-zly/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.314367
CVE: CVE-2025-3745
Published: 2025-06-30
Description: The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1b50f686-c2e0-4963-95c8-b27137dcc059/
CVE: CVE-2025-5730
Published: 2025-06-30
Description: The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e1e7f423-f981-413c-a99a-e5927fc1cd0c/
CVE: CVE-2025-6889
Published: 2025-06-30
Description: A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /logIn.php. The manipulation of the argument postName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ez-lbz/poc/issues/30; https://vuldb.com/?ctiid.314368
CVE: CVE-2025-6890
Published: 2025-06-30
Description: A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ticketConfirmation.php. The manipulation of the argument Date leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ez-lbz/poc/issues/31; https://vuldb.com/?ctiid.314369
CVE: CVE-2025-6891
Published: 2025-06-30
Description: A vulnerability classified as critical has been found in code-projects Inventory Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/tangjihong1974/cve/issues/2; https://vuldb.com/?ctiid.314370
CVE: CVE-2025-6896
Published: 2025-06-30
Description: A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link_DI/CJ_IN_DLink_1_en.pdf; https://vuldb.com/?ctiid.314388; https://vuldb.com/?id.314388
CVE: CVE-2025-38087
Published: 2025-06-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix use-after-free in taprio_dev_notifier

Since taprio’s taprio_dev_notifier() isn’t protected by an
RCU read-side critical section, a race with advance_sched()
can lead to a use-after-free.

Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/8a008c89e5e5c5332e4c0a33d707db9ddd529f8a; https://git.kernel.org/stable/c/8c5713ce1ced75f9e9ed5c642ea3d2ba06ead69c; https://git.kernel.org/stable/c/b1547d28ba468bc3b88764efd13e4319bab63be8
CVE: CVE-2025-38088
Published: 2025-06-30
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap

memtrace mmap issue has an out of bounds issue. This patch fixes the by
checking that the requested mapping region size should stay within the
allocated region size.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/620b77b23c41a6546e5548ffe2ea3ad71880dde4; https://git.kernel.org/stable/c/81260c41b518b6f32c701425f1427562fa92f293; https://git.kernel.org/stable/c/8635e325b85dfb9ddebdfaa6b5605d40d16cd147
CVE: CVE-2025-38089
Published: 2025-06-30
Description: In the Linux kernel, the following vulnerability has been resolved:

sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

tianshuo han reported a remotely-triggerable crash if the client sends a
kernel RPC server a specially crafted packet. If decoding the RPC reply
fails in such a way that SVC_GARBAGE is returned without setting the
rq_accept_statp pointer, then that pointer can be dereferenced and a
value stored there.

If it's the first time the thread has processed an RPC, then that
pointer will be set to NULL and the kernel will crash. In other cases,
it could create a memory scribble.

The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate
or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531
says that if authentication fails that the RPC should be rejected
instead with a status of AUTH_ERR.

Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of
AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This
sidesteps the whole problem of touching the rpc_accept_statp pointer in
this situation and avoids the crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/353e75b55e583635bf71cde6abcec274dba05edd; https://git.kernel.org/stable/c/599c489eea793821232a2f69a00fa57d82b0ac98; https://git.kernel.org/stable/c/94d10a4dba0bc482f2b01e39f06d5513d0f75742
CVE: CVE-2025-38090
Published: 2025-06-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drivers/rapidio/rio_cm.c: prevent possible heap overwrite

In

riocm_cdev_ioctl(RIO_CM_CHAN_SEND)
   -> cm_chan_msg_send()
      -> riocm_ch_send()

cm_chan_msg_send() checks that userspace didn't send too much data but
riocm_ch_send() failed to check that userspace sent sufficient data.  The
result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr
which were outside the bounds of the space which cm_chan_msg_send()
allocated.

Address this by teaching riocm_ch_send() to check that the entire
rio_ch_chan_hdr was copied in from userspace.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1921781ec4a8824bd0c520bf9363e28a880d14ec; https://git.kernel.org/stable/c/1cce6ac47f4a2ac1766b8a188dc8c8f6d8df2a53; https://git.kernel.org/stable/c/50695153d7ddde3b1696dbf0085be0033bf3ddb3
CVE: CVE-2025-6897
Published: 2025-06-30
Description: A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_debug.asp. The manipulation of the argument Time leads to os command injection. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link_DI/CJ_IN_DLink_2_en.pdf; https://vuldb.com/?ctiid.314389; https://vuldb.com/?id.314389
CVE: CVE-2025-6898
Published: 2025-06-30
Description: A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxy_client.asp. The manipulation of the argument proxy_srv/proxy_lanport/proxy_lanip/proxy_srvport leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link_DI/CJ_IN_DLink_3_en.pdf; https://vuldb.com/?ctiid.314390; https://vuldb.com/?id.314390
CVE: CVE-2025-40731
Published: 2025-06-30
Description: SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-daily-expense-manager
CVE: CVE-2025-40732
Published: 2025-06-30
Description: user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-daily-expense-manager
CVE: CVE-2025-40733
Published: 2025-06-30
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-daily-expense-manager