deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8707
Published: 2025-08-08
Description: A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xml of the component com.huuge.game.zjbox. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md; https://github.com/KMov-g/androidapps/blob/main/com.huuge.game.zjbox.md#steps-to-reproduce; https://vuldb.com/?ctiid.319137
CVE: CVE-2025-8708
Published: 2025-08-08
Description: A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of the file ShiroConfiguration.java of the component com.gm.wj.config.ShiroConfiguration. The manipulation with the input EVANNIGHTLY_WAOU leads to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/Antabot/White-Jotter/issues/161; https://github.com/Antabot/White-Jotter/issues/161#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319138
CVE: CVE-2024-58255
Published: 2025-08-08
Description: EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-78
References: https://www.huawei.com/cn/psirt/security-advisories/2025/huawei-sa-ocivihep-e73ab538
CVE: CVE-2024-58256
Published: 2025-08-08
Description: EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-200, CWE-78
References: https://www.huawei.com/cn/psirt/security-advisories/2025/huawei-sa-ocivihep-cn
CVE: CVE-2024-58257
Published: 2025-08-08
Description: EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-78
References: https://www.huawei.com/cn/psirt/security-advisories/2025/huawei-sa-ocivihep-1bcbfffa
CVE: CVE-2025-54940
Published: 2025-08-08
Description: An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered.
CVSS Score: 3.4 (LOW)
CWE: CWE-94
References: https://jvn.jp/en/jp/JVN21048820/; https://www.advancedcustomfields.com/blog/acf-6-4-3-security-release/
CVE: CVE-2025-54958
Published: 2025-08-08
Description: Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be executed on the affected product.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN39636188/; https://www.mubit.co.jp/sub/products/blue/pb-base-cloud-890.html
CVE: CVE-2025-54959
Published: 2025-08-08
Description: Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected product may be disclosed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN39636188/; https://www.mubit.co.jp/sub/products/blue/pb-base-cloud-890.html
CVE: CVE-2025-6572
Published: 2025-08-08
Description: The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
References: https://wpscan.com/vulnerability/58c7a8ac-1acd-45b7-abe5-5635fbb5d4c1/; https://wpscan.com/vulnerability/58c7a8ac-1acd-45b7-abe5-5635fbb5d4c1/
CVE: CVE-2025-48913
Published: 2025-08-08
Description: If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.  This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83; http://www.openwall.com/lists/oss-security/2025/08/07/2
CVE: CVE-2025-53606
Published: 2025-08-08
Description: Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).

This issue affects Apache Seata (incubating): 2.4.0.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/ggfd72vvvxjozs81zbcls45zxg64pphx; http://www.openwall.com/lists/oss-security/2025/08/07/1
CVE: CVE-2025-8748
Published: 2025-08-08
Description: MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious 
HTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the 
underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://mobile-industrial-robots.com/security-advisories/command-injection; https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE: CVE-2025-8088
Published: 2025-08-08
Description: A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček
     from ESET.
CVSS Score: 8.8 (HIGH)
CWE: CWE-35
References: https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5; https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/; https://support.dtsearch.com/faq/dts0245.htm
CVE: CVE-2025-8749
Published: 2025-08-08
Description: Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to extract files from the robot file system via a crafted API request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://mobile-industrial-robots.com/security-advisories/path-traversal; https://supportportal.mobile-industrial-robots.com/documentation/mir-cybersecurity-guide/mir-cybersecurity-guide/
CVE: CVE-2025-8729
Published: 2025-08-08
Description: A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the file backend/service/upload_service.py. The manipulation of the argument task_id leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is f1b00597e293d09452aabd4fa57f[PII_REDACTED]e8. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/MigoXLab/LMeterX/commit/f1b00597e293d09452aabd4fa57f[PII_REDACTED]e8; https://github.com/MigoXLab/LMeterX/issues/10; https://github.com/MigoXLab/LMeterX/issues/10#issue[PII_REDACTED]
CVE: CVE-2020-9322
Published: 2025-08-08
Description: The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://gist.github.com/kernelsndrs/86b78e869d[PII_REDACTED]14ec7d4fc881; https://statamic.com/changelog#2.11.18; https://web.archive.org/web/[PII_REDACTED]4034/www.statamic.com/changelog#2.11.18
CVE: CVE-2025-36023
Published: 2025-08-08
Description: IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.ibm.com/support/pages/node/7241570
CVE: CVE-2025-36119
Published: 2025-08-08
Description: IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator.
CVSS Score: 7.1 (HIGH)
CWE: CWE-290
References: https://www.ibm.com/support/pages/node/7241008
CVE: CVE-2025-8730
Published: 2025-08-08
Description: A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to hard-coded credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://github.com/Nicholas-wei/bug-discovery/blob/main/belkin/F9K1009_WW_2.00.09/belkin%20F9K1009_WW_2.00.09_hardcoded_credential.pdf; https://github.com/Nicholas-wei/bug-discovery/blob/main/belkin/F9K1010_WW_2.00.04/belkin_F9K1010_WW_2.00.04_hardcoded_credential.pdf; https://vuldb.com/?ctiid.319226
CVE: CVE-2025-4576
Published: 2025-08-08
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-4576
CVE: CVE-2025-52586
Published: 2025-08-08
Description: The MOD3 command traffic between the monitoring application and the 
inverter is transmitted in plaintext without encryption or obfuscation. 
This vulnerability may allow an attacker with access to a local network 
to intercept, manipulate, replay, or forge critical data, including 
read/write operations for voltage, current, and power configuration, 
operational status, alarms, telemetry, system reset, or inverter control
 commands, potentially disrupting power generation or reconfiguring 
inverter settings.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-319
References: https://eg4electronics.com/contact/; https://eg4electronics.com/wp-content/uploads/2025/09/EG4-Wi-Fi-Dongle-Dongle-Firmware-Update.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
CVE: CVE-2025-8355
Published: 2025-08-08
Description: In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf
CVE: CVE-2025-8356
Published: 2025-08-08
Description: In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-94
References: https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf; https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/
CVE: CVE-2025-8731
Published: 2025-08-08
Description: A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "For product TI-PG102i and TI-G160i, by default, the product's remote management options are all disabled. The root account is for troubleshooting purpose and the password is encrypted. However, we will remove the root account from the next firmware release. For product TPL-430AP, the initial setup process requires user to set the password for the management GUI. Once that was done, the default password will be invalid."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1392
References: https://github.com/Nicholas-wei/bug-discovery/blob/main/trendnet/TPL-430AP_FW1.0.1/trendnet_several_vulns.pdf; https://vuldb.com/?ctiid.319227; https://vuldb.com/?id.319227
CVE: CVE-2025-46414
Published: 2025-08-08
Description: The affected product does not limit the number of attempts for inputting
 the correct PIN for a registered product, which may allow an attacker 
to gain unauthorized access using brute-force methods if they possess a 
valid device serial number. The API provides clear feedback when the 
correct PIN is entered. This vulnerability was patched in a server-side 
update on April 6, 2025.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: https://eg4electronics.com/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
CVE: CVE-2025-47872
Published: 2025-08-08
Description: The public-facing product registration endpoint server responds 
differently depending on whether the S/N is valid and unregistered, 
valid but already registered, or does not exist in the database. 
Combined with the fact that serial numbers are sequentially assigned, 
this allows an attacker to gain information on the product registration 
status of different S/Ns.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-203
References: https://eg4electronics.com/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
CVE: CVE-2025-50465
Published: 2025-08-08
Description: OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The testPlatform parameter can be used to build a SQL query.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://gist.github.com/javadk/c23cc3276f3fb5587b0f4345d7a71a7f; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3515; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3517
CVE: CVE-2025-50466
Published: 2025-08-08
Description: OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The entityType parameter can be used to build a SQL query.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://gist.github.com/javadk/aa7b5eb6f0fca2fbc334129b7572c7c6; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3521; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3522
CVE: CVE-2025-50467
Published: 2025-08-08
Description: OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The supportedDataTypeParam parameter can be used to build a SQL query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/javadk/ed0d38e[PII_REDACTED]f154e289036a705; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3527; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3528
CVE: CVE-2025-50468
Published: 2025-08-08
Description: OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface. The entityType parameters can be used to build a SQL query.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/javadk/0be29d2bb5a971bc09f3410659c83308; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L4411; https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L4412
CVE: CVE-2025-53520
Published: 2025-08-08
Description: The affected product allows firmware updates to be downloaded from EG4's
 website, transferred via USB dongles, or installed through EG4's 
Monitoring Center (remote, cloud-connected interface) or via a serial 
connection, and can install these files without integrity checks. The 
TTComp archive format used for the firmware is unencrypted and can be 
unpacked and altered without detection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-494
References: https://eg4electronics.com/contact/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
CVE: CVE-2025-8284
Published: 2025-08-08
Description: By default, the Packet Power Monitoring and Control Web Interface do not
 enforce authentication mechanisms. This vulnerability could allow 
unauthorized users to access and manipulate monitoring and control 
functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-05
CVE: CVE-2025-8393
Published: 2025-08-08
Description: A TLS vulnerability exists in the phone application used to manage a 
connected device. The phone application accepts self-signed certificates
 when establishing TLS communication which may result in 
man-in-the-middle attacks on untrusted networks. Captured communications
 may include user credentials and sensitive session tokens.
CVSS Score: 7.3 (HIGH)
CWE: CWE-295
References: https://support.dreametech.com/hc/en-us; https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-06
CVE: CVE-2025-8732
Published: 2025-08-08
Description: A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-674
References: https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link; https://gitlab.gnome.org/GNOME/libxml2/-/issues/958; https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853
CVE: CVE-2025-50927
Published: 2025-08-08
Description: A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via injecting a crafted payload into the ftpusername parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://packetstorm.news/files/id/207908; https://www.ehcp.net/?p=402
CVE: CVE-2025-50928
Published: 2025-08-08
Description: Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-89
References: https://packetstorm.news/files/id/207907; https://www.ehcp.net/?p=402
CVE: CVE-2025-52913
Published: 2025-08-08
Description: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0007
CVE: CVE-2025-52914
Published: 2025-08-08
Description: A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0008
CVE: CVE-2025-5095
Published: 2025-08-08
Description: Burk Technology ARC Solo's password change mechanism can be utilized without proper 
authentication procedures, allowing an attacker to take over the device.
 A password change request can be sent directly to the device's HTTP 
endpoint without providing valid credentials. The system does not 
enforce proper authentication or session validation, allowing the 
password change to proceed without verifying the request's legitimacy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.burk.com/products/Broadcast/ARC-Solo-6; https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-03
CVE: CVE-2025-8733
Published: 2025-08-08
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison.
CVE: CVE-2025-8734
Published: 2025-08-08
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison.
CVE: CVE-2010-10013
Published: 2025-08-08
Description: An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.
CWE: CWE-78
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb; https://sourceforge.net/projects/ajaxplorer/; https://www.exploit-db.com/exploits/21993