deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47967
Published: 2025-09-16
Description: Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-357
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47967
CVE: CVE-2025-49728
Published: 2025-09-16
Description: Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-312
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49728
CVE: CVE-2025-56557
Published: 2025-09-16
Description: An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-250
References: http://tuya.com; https://archive.org/details/tuya-matter-fabric-bug/mode/2up
CVE: CVE-2025-10563
Published: 2025-09-16
Description: A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_category. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/76; https://vuldb.com/?ctiid.324477; https://vuldb.com/?id.324477
CVE: CVE-2025-34183
Published: 2025-09-16
Description: Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential reuse.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://packetstorm.news/files/id/208700/; https://www.ilevia.com/; https://www.vulncheck.com/advisories/ilevia-eve-x1-server-credentials-leak-through-log-disclosure
CVE: CVE-2025-34184
Published: 2025-09-16
Description: Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, leading to full system compromise or denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://packetstorm.news/files/id/207717/; https://www.ilevia.com/; https://www.vulncheck.com/advisories/ilevia-eve-x1-server-neuro-code-unauth-code-injection
CVE: CVE-2025-34185
Published: 2025-09-16
Description: Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'db_log' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-200, CWE-22
References: https://packetstorm.news/files/id/207716/; https://www.ilevia.com/; https://www.vulncheck.com/advisories/ilevia-eve-x1-server-unauth-file-disclosure
CVE: CVE-2025-34186
Published: 2025-09-16
Description: Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Due to the binary's interpretation of non-zero exit codes as successful authentication, remote attackers can bypass authentication and gain full access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-287, CWE-78
References: https://packetstorm.news/files/id/208871/; https://www.ilevia.com/; https://www.vulncheck.com/advisories/ilevia-eve-x1-x5-server-auth-bypass
CVE: CVE-2025-34187
Published: 2025-09-16
Description: Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-269
References: https://packetstorm.news/files/id/209226/; https://www.ilevia.com/; https://www.vulncheck.com/advisories/ilevia-eve-x1-x5-server-reverse-rootshell
CVE: CVE-2025-56263
Published: 2025-09-16
Description: by-night sms V1.0 has an Arbitrary File Upload vulnerability. The /api/sms/upload/headImg endpoint allows uploading arbitrary files. Users can upload files of any size and type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/by-night/sms/issues/50; https://github.com/echo0d/vulnerability/blob/main/by-night_sms/fileUpload.md
CVE: CVE-2025-56264
Published: 2025-09-16
Description: The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/echo0d/vulnerability/blob/main/zhangyd-c_OneBlog/DoS.md; https://github.com/echo0d/vulnerability/blob/main/zhangyd-c_OneBlog/DoS.md
CVE: CVE-2025-57631
Published: 2025-09-16
Description: SQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary code via the Add a file upload module
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://tduck-platform.com; https://gist.github.com/Theresasu1/b1b57b3763a286d[PII_REDACTED]c99368b; https://github.com/TDuckCloud/tduck-platform
CVE: CVE-2025-10564
Published: 2025-09-16
Description: A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=delete_category. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/75; https://vuldb.com/?ctiid.324478; https://vuldb.com/?id.324478
CVE: CVE-2025-10565
Published: 2025-09-16
Description: A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_receiving. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/74; https://vuldb.com/?ctiid.324479; https://vuldb.com/?id.324479
CVE: CVE-2025-54391
Published: 2025-09-16
Description: A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Factor Authentication (2FA) protection. The attacker can configure an additional 2FA method (either a third-party authenticator app or email-based 2FA) without presenting a valid authentication token or proving access to an already configured 2FA method. This bypasses 2FA and results in unauthorized access to accounts that are otherwise protected by 2FA.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2025-10566
Published: 2025-09-16
Description: A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php?page=users. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/zzb1388/cve/issues/73; https://vuldb.com/?ctiid.324480; https://vuldb.com/?id.324480
CVE: CVE-2025-43805
Published: 2025-09-16
Description: Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted URLs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43805
CVE: CVE-2025-9708
Published: 2025-09-16
Description: A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://github.com/kubernetes/kubernetes/issues/134063; https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ; http://www.openwall.com/lists/oss-security/2025/09/16/1
CVE: CVE-2025-37123
Published: 2025-09-16
Description: A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37124
Published: 2025-09-16
Description: A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leading to unauthorized access or disruption of services.
CVSS Score: 8.6 (HIGH)
CWE: CWE-693
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37125
Published: 2025-09-16
Description: A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37126
Published: 2025-09-16
Description: A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37127
Published: 2025-09-16
Description: A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, potentially leading to unauthorized access and control over the affected systems.
CVSS Score: 7.2 (HIGH)
CWE: CWE-327
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37128
Published: 2025-09-16
Description: A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-250
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37129
Published: 2025-09-16
Description: A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilities. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system if the feature is enabled without proper security measures.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37130
Published: 2025-09-16
Description: A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-37131
Published: 2025-09-16
Description: A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04943en_us&docLocale=en_US
CVE: CVE-2025-43804
Published: 2025-09-16
Description: Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43804
CVE: CVE-2025-10050
Published: 2025-09-17
Description: The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_loggers parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3361543%40developer-loggers-for-simple-history&new=3361543%40developer-loggers-for-simple-history&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ea3a9e-2a9a-4628-8ea1-e18e756f915f?source=cve
CVE: CVE-2025-10143
Published: 2025-09-17
Description: The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catch_dark_mode' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/catch-dark-mode/trunk/plugin.php#L483; https://plugins.trac.wordpress.org/changeset/3359058/; https://wordpress.org/plugins/catch-dark-mode
CVE: CVE-2025-10166
Published: 2025-09-17
Description: The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/social-media-shortcodes/trunk/social_media_shortcode_plugin.php#L187; https://plugins.trac.wordpress.org/changeset/3359485/; https://wordpress.org/plugins/social-media-shortcodes
CVE: CVE-2025-8153
Published: 2025-09-17
Description: Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.
CWE: CWE-79
References: https://jpn.nec.com/security-info/secinfo/nv25-005_en.html
CVE: CVE-2025-8394
Published: 2025-09-17
Description: The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/productive-style/tags/1.1.23/includes/common/module/breadcrumb.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341842%40productive-style&new=3341842%40productive-style&sfp_email=&sfph_mail=; https://wordpress.org/plugins/productive-style/#developers
CVE: CVE-2025-9629
Published: 2025-09-17
Description: The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the uss_setting_page function when processing the uss_set form type. This makes it possible for unauthenticated attackers to modify critical Upyun cloud storage settings including bucket name, operator credentials, upload paths, and image processing parameters via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L493; https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.0/upyun-uss-wordpress.php#L499; https://plugins.trac.wordpress.org/browser/uss-upyun/tags/1.5.1/upyun-uss-wordpress.php#L493
CVE: CVE-2025-9851
Published: 2025-09-17
Description: The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3359404%40appointmind&new=3359404%40appointmind&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/65d965ac-66ae-4c23-b9c2-335b93a140d9?source=cve
CVE: CVE-2025-9891
Published: 2025-09-17
Description: The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/user-sync/tags/1.0.1/mo-user-sync-main.php#L118; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360328%40user-sync&new=3360328%40user-sync&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6b60777e-6e07-42bd-9364-43367e209227?source=cve
CVE: CVE-2025-10125
Published: 2025-09-17
Description: The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/memberlite-shortcodes/tags/1.4/shortcodes/columns.php#L12; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3359252%40memberlite-shortcodes&new=3359252%40memberlite-shortcodes&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb7316e-8b55-4e7a-9309-8a9e84f22c90?source=cve
CVE: CVE-2025-10188
Published: 2025-09-17
Description: The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation on the bulk_remove() function. This makes it possible for unauthenticated attackers to arbitrary directory deletion in /wp-content via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/hackrepair-plugin-archiver/tags/3.1.1/includes/bulk.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/51810981-5d2b-471b-b602-35809e281a0b?source=cve
CVE: CVE-2025-10584
Published: 2025-09-17
Description: A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Such manipulation of the argument nm_anotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://karinagante.github.io/cve-2025-10584/; https://karinagante.github.io/cve-2025-10584/#proof-of-concept-poc; https://vuldb.com/?ctiid.324561
CVE: CVE-2025-10589
Published: 2025-09-17
Description: The N-Reporter, N-Cloud, and N-Probe developed by N-Partner has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-10387-b8a4e-2.html; https://www.twcert.org.tw/tw/cp-132-10386-231ae-1.html
CVE: CVE-2025-55075
Published: 2025-09-17
Description: Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-912
References: https://jvn.jp/en/vu/JVNVU97490987/; https://www.iodata.jp/support/information/2025/09_wn-7d36qr/index.htm
CVE: CVE-2025-58116
Published: 2025-09-17
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU97490987/; https://www.iodata.jp/support/information/2025/09_wn-7d36qr/index.htm