deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60772
Published: 2025-10-21
Description: Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to escalate privileges and lock out the legitimate administrator via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/navy-birds-MRS/vuln-reports/blob/main/vendors/netlink/CVE-2025-60772/advisory.md; https://netlinkict.com/shop/gpon-ont/gpon-ont-hg322g/; https://github.com/navy-birds-MRS/vuln-reports/blob/main/vendors/netlink/CVE-2025-60772/advisory.md
CVE: CVE-2025-62518
Published: 2025-10-21
Description: astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://edera.dev/stories/tarmageddon; https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318; https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx
CVE: CVE-2025-62595
Published: 2025-10-21
Description: Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This occurs because the implementation incorrectly treats some specially crafted URLs as safe relative paths. Exploiting this vulnerability could allow attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications. This issue has been patched in version 3.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/koajs/koa/commit/769fd75cc6b30d72493b370b5a3ae2332ca03c5b; https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc; https://github.com/koajs/koa/security/advisories/GHSA-g8mr-fgfg-5qpc
CVE: CVE-2025-62597
Published: 2025-10-21
Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/e41395fe6a7b4f428b1797a8d5b52e0e3dbbb3d9; https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.1; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wqjv-fhc9-h7hm
CVE: CVE-2025-62598
Published: 2025-10-21
Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the action parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?action=1. This issue has been patched in version 3.5.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.1; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jmm7-rr7w-f223
CVE: CVE-2025-62605
Published: 2025-10-21
Description: Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon internally treats reblogs as statuses. Since they were not special-treated, an attacker could reblog any post, then quote their reblog, technically quoting themselves, but having the quote feature a preview of the post they did not get authorization for with all of the affordances that would be otherwise denied by the quote controls. This issue has been patched in versions 4.4.8 and 4.5.0-beta.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754
References: https://github.com/mastodon/mastodon/commit/2dc4552229b55e2e4adaef675e68ed7ae123d78e; https://github.com/mastodon/mastodon/commit/405a49df44033e7d179f3d44d59fb68a67d54789; https://github.com/mastodon/mastodon/releases/tag/v4.4.8
CVE: CVE-2025-62763
Published: 2025-10-21
Description: Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://blog.zimbra.com/2025/10/patch-release-update-zimbra-10-1-12/; https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.12
CVE: CVE-2025-11757
Published: 2025-10-21
Description: The CloudEdge Cloud does not sanitize the MQTT topic input, which could allow an attacker to leverage the MQTT wildcard to receive all the messages that should be delivered to other users by subscribing to the a MQTT topic. In these messages, the attacker can obtain the credentials and key information to connect to the cameras from peer to peer.
CWE: CWE-155
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-294-05
CVE: CVE-2025-12031
Published: 2025-10-21
Description: HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1004
References: https://azure-access.com/security-advisories
CVE: CVE-2025-60427
Published: 2025-10-21
Description: LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://beafn28.gitbook.io/beafn28/cve/broken-access-control-in-libretime-analytics-endpoints-cve-2025-60427; https://github.com/libretime/libretime; https://github.com/libretime/libretime/issues/1251
CVE: CVE-2025-60507
Published: 2025-10-21
Description: Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://github.com/onurcangnc/moodle_genai_plugin_xss; https://moodle.org/plugins/local_geniai; https://moodle.org/security/
CVE: CVE-2025-60790
Published: 2025-10-21
Description: ProcessWire CMS 3.0.246 allows a low-privileged user with lang-edit to upload a crafted ZIP to Language Support that is auto-extracted without limits prior to validation, enabling resource-exhaustion Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/NomanProdhan/security-vulnerability-research/tree/master/CVE-2025-60790; https://github.com/processwire/processwire-issues/issues/2120; https://github.com/processwire/processwire-issues/issues/2120
CVE: CVE-2025-8050
Published: 2025-10-21
Description: External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. 

The vulnerability could allow a user to access files hosted on the server.

This issue affects Flipper: 3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0850526
CVE: CVE-2025-56799
Published: 2025-10-21
Description: Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name. NOTE: this is disputed by the Supplier because a crafted folder name would arise only if the local user were attacking himself.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/shinyColumn/CVE-2025-56799; https://shinycolumn.notion.site/reolink-command-injection
CVE: CVE-2025-56800
Published: 2025-10-21
Description: Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism. The application implements lock screen password logic entirely on the client side using JavaScript within an Electron resource file. Because the password is stored and returned via a modifiable JavaScript property(a.settingsManager.lockScreenPassword), an attacker can patch the return value to bypass authentication. NOTE: this is disputed by the Supplier because the lock-screen bypass would only occur if the local user modified his own instance of the application.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-290
References: https://github.com/shinyColumn/CVE-2025-56800; https://shinycolumn.notion.site/reolink-auth-bypass
CVE: CVE-2025-56801
Published: 2025-10-21
Description: The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-321
References: https://github.com/shinyColumn/CVE-2025-56801; https://shinycolumn.notion.site/reolink-aes-iv
CVE: CVE-2025-56802
Published: 2025-10-21
Description: The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is that material is not hardcoded and is instead randomly generated on each installation of the application.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-321
References: https://github.com/shinyColumn/CVE-2025-56802; https://shinycolumn.notion.site/reolink-aes-key
CVE: CVE-2025-61255
Published: 2025-10-21
Description: Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nikhilpatidar01/CVE-Assigned-Reports/blob/Master/CVE-2025-61255/advisory.md; https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/
CVE: CVE-2025-61457
Published: 2025-10-21
Description: code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chimmeee/vulnerability-research/blob/main/CVE-2025-61457; https://github.com/code16/sharp/blob/6d106b05aa07c6b46f5de28f909b732e1bbcdc47/src/Form/Fields/SharpFormUploadField.php#L97; https://github.com/code16/sharp/issues/611
CVE: CVE-2025-62249
Published: 2025-10-21
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62249
CVE: CVE-2025-50074
Published: 2025-10-21
Description: Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management System).  Supported versions that are affected are 2.9.0.0.0-7.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Financial Services Revenue Management and Billing accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-50075
Published: 2025-10-21
Description: Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Security Management System).  Supported versions that are affected are 2.9.0.0.0-7.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Financial Services Revenue Management and Billing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-52079
Published: 2025-10-21
Description: The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/namberino/cve/tree/main/CVE-2025-52079; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-53034
Published: 2025-10-21
Description: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).  Supported versions that are affected are 8.0.7.9, 8.0.8.7 and  8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Financial Services Analytical Applications Infrastructure accessible data as well as  unauthorized read access to a subset of Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-306
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53035
Published: 2025-10-21
Description: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).  Supported versions that are affected are 8.0.7.9, 8.0.8.7 and  8.1.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53036
Published: 2025-10-21
Description: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).  Supported versions that are affected are 8.0.7.9, 8.0.8.7 and  8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  While the vulnerability is in Oracle Financial Services Analytical Applications Infrastructure, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS Score: 8.6 (HIGH)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53037
Published: 2025-10-21
Description: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform).  Supported versions that are affected are 8.0.7.9, 8.0.8.7 and  8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53040
Published: 2025-10-21
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53041
Published: 2025-10-21
Description: Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).  Supported versions that are affected are 12.2.5-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle iStore accessible data as well as  unauthorized read access to a subset of Oracle iStore accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53042
Published: 2025-10-21
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53043
Published: 2025-10-21
Description: Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53044
Published: 2025-10-21
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53045
Published: 2025-10-21
Description: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpuoct2025.html
CVE: CVE-2025-53046
Published: 2025-10-21
Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Analytics).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: https://www.oracle.com/security-alerts/cpuoct2025.html