deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54691
Published: 2025-08-14
Description: Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through <= 1.4.80.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-plugin-1-4-80-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-54692
Published: 2025-08-14
Description: Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.9.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54693
Published: 2025-08-14
Description: Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through <= 1.5.5.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/form-block/vulnerability/wordpress-form-block-plugin-1-5-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-54694
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block button-block allows Cross Site Request Forgery.This issue affects Button Block: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/button-block/vulnerability/wordpress-button-block-plugin-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54695
Published: 2025-08-14
Description: Missing Authorization vulnerability in DevItems HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through <= 2.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54696
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through <= 3.5.26.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-plugin-3-5-26-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54697
Published: 2025-08-14
Description: Incorrect Privilege Assignment vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Privilege Escalation.This issue affects Kadence WooCommerce Email Designer: from n/a through <= 1.5.16.
CVSS Score: 7.2 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-16-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-54698
Published: 2025-08-14
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing classified-listing allows Code Injection.This issue affects Classified Listing: from n/a through <= 5.0.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-plugin-5-0-0-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54699
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Stored XSS.This issue affects Masteriyo - LMS: from n/a through <= 1.18.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-plugin-1-18-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54700
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic makeaholic allows PHP Local File Inclusion.This issue affects Makeaholic: from n/a through <= 1.8.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/makeaholic/vulnerability/wordpress-makeaholic-theme-1-8-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54701
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.6.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/unicamp/vulnerability/wordpress-unicamp-theme-2-6-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54702
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store ebook-store allows Cross Site Request Forgery.This issue affects Ebook Store: from n/a through <= 5.8013.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-plugin-5-8013-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54703
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Cross Site Request Forgery.This issue affects Integrate Google Drive: from n/a through <= 1.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/integrate-google-drive/vulnerability/wordpress-integrate-google-drive-plugin-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54704
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows DOM-Based XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-plugin-2-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54705
Published: 2025-08-14
Description: Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.4.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-plugin-4-4-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54706
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display magical-posts-display allows DOM-Based XSS.This issue affects Magical Posts Display: from n/a through <= 1.2.52.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/magical-posts-display/vulnerability/wordpress-magical-posts-display-plugin-plugin-1-2-52-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54707
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows SQL Injection.This issue affects MDTF: from n/a through <= 1.3.3.7.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-3-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-8957
Published: 2025-08-14
Description: A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Affected is an unknown function of the file /flights.php. The manipulation of the argument departure_airport_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.319926; https://vuldb.com/?id.319926; https://vuldb.com/?submit.627840
CVE: CVE-2025-8958
Published: 2025-08-14
Description: A vulnerability was identified in Tenda TX3 16.03.13.11_multi_TDE01. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/alc9700jmo/CVE/issues/16; https://vuldb.com/?ctiid.319927; https://vuldb.com/?id.319927
CVE: CVE-2025-8960
Published: 2025-08-14
Description: A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/save_airlines.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.319952; https://vuldb.com/?id.319952; https://vuldb.com/?submit.627900
CVE: CVE-2023-5342
Published: 2025-08-14
Description: The Fedora Secure Boot CA certificate shipped with shim in Fedora was expired which could lead to old or invalid signed boot components being loaded.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-324
References: https://access.redhat.com/security/cve/CVE-2023-5342; https://bodhi.fedoraproject.org/updates/FEDORA-2024-2aa28a4cfc; https://bugzilla.redhat.com/show_bug.cgi?id=2198977
CVE: CVE-2025-8713
Published: 2025-08-14
Description: PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access.  Separately, statistics allow a user to read sampled data that a row security policy intended to hide.  PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process.  Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies.  Reachable statistics data notably included histograms and most-common-values lists.  CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
CVSS Score: 3.1 (LOW)
CWE: CWE-1230
References: https://www.postgresql.org/support/security/CVE-2025-8713/
CVE: CVE-2025-8714
Published: 2025-08-14
Description: Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands.  pg_dumpall is also affected.  pg_restore is affected when used to generate a plain-format dump.  This is similar to MySQL CVE-2024-21096.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://www.postgresql.org/support/security/CVE-2025-8714/
CVE: CVE-2025-8715
Published: 2025-08-14
Description: Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name.  The same attacks can achieve SQL injection as a superuser of the restore target server.  pg_dumpall, pg_restore, and pg_upgrade are also affected.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.  Versions before 11.20 are unaffected.  CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.
CVSS Score: 8.8 (HIGH)
CWE: CWE-93
References: https://www.postgresql.org/support/security/CVE-2025-8715/
CVE: CVE-2025-8961
Published: 2025-08-14
Description: A weakness has been identified in LibTIFF 4.7.0. This affects the function main of the file tiffcrop.c of the component tiffcrop. Executing manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be exploited.
CVSS Score: 3.3 (LOW)
CWE: CWE-119
References: http://www.libtiff.org/; https://drive.google.com/file/d/15L4q2eD8GX3Aj3z6SWC3_FbqaM1ChUx2/view?usp=sharing; https://gitlab.com/libtiff/libtiff/-/issues/721
CVE: CVE-2025-8963
Published: 2025-08-14
Description: A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated".
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/jeecgboot/jimureport/issues/4010; https://github.com/jeecgboot/jimureport/issues/4010#issuecomment[PII_REDACTED]; https://vuldb.com/?ctiid.319958
CVE: CVE-2024-53945
Published: 2025-08-14
Description: The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS commands with root privileges via shell metacharacters in parameters such as pincode and cmds. Exploitation can lead to full system compromise, including enabling remote access (e.g., enabling telnet).
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2024-53945.txt; https://github.com/actuator/cve/tree/main/Kuwfi; https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port
CVE: CVE-2024-53946
Published: 2025-08-14
Description: The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in /goform/formMultiApnSetting. Successful exploitation can also lead to unauthorized configuration changes.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2024-53946.txt; https://github.com/actuator/cve/tree/main/Kuwfi; https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port
CVE: CVE-2025-36581
Published: 2025-08-14
Description: Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 3.8 (LOW)
CWE: CWE-788, CWE-119
References: https://www.dell.com/support/kbdoc/en-us/000356405/dsa-2025-299-security-update-for-dell-poweredge-server-bios-for-an-access-of-memory-location-after-end-of-buffer-vulnerability
CVE: CVE-2025-43984
Published: 2025-08-14
Description: An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unauthenticated /goform/goform_set_cmd_process requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary OS commands with root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://drive.proton.me/urls/1NRPNBE678#lFyUYIRIBZO5; https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43984.txt; https://github.com/actuator/cve/tree/main/kuwfi
CVE: CVE-2025-55672
Published: 2025-08-14
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://lists.apache.org/thread/rvh7fdjfzxzjhcfwoz7twc2brhvochdj; http://www.openwall.com/lists/oss-security/2025/08/14/4
CVE: CVE-2025-55673
Published: 2025-08-14
Description: When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread/h2hw756wk4sj4z49blvzkr5fntl9hlf8; http://www.openwall.com/lists/oss-security/2025/08/14/3
CVE: CVE-2025-55674
Published: 2025-08-14
Description: A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://lists.apache.org/thread/cn49ps15ny3g2b1qzdg5mj7hp47p5jdo; http://www.openwall.com/lists/oss-security/2025/08/14/5
CVE: CVE-2025-55675
Published: 2025-08-14
Description: Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://lists.apache.org/thread/op681b4kbd7g84tfjf9omz0sxggbcv33; http://www.openwall.com/lists/oss-security/2025/08/14/6
CVE: CVE-2025-7353
Published: 2025-08-14
Description: A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and control execution flow.
CWE: CWE-1188
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1732.html
CVE: CVE-2025-7773
Published: 2025-08-14
Description: A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlates to the last two consecutive sign in session interval, making it predictable.
CWE: CWE-863
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html
CVE: CVE-2025-7774
Published: 2025-08-14
Description: A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions.
CWE: CWE-306
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html
CVE: CVE-2025-7973
Published: 2025-08-14
Description: A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack the cscript.exe console window, which runs with SYSTEM privileges. This can be exploited to spawn an elevated command prompt, enabling full privilege escalation.
CWE: CWE-268
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1738.html
CVE: CVE-2025-9036
Published: 2025-08-14
Description: A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.
CWE: CWE-200
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1740.html
CVE: CVE-2025-26484
Published: 2025-08-14
Description: Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000356343/dsa-2025-321-security-update-for-dell-cloudlink-vulnerability
CVE: CVE-2025-27845
Published: 2025-08-14
Description: In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://espec.com; https://espec.com/na/about/detail/cve_2025_27845
CVE: CVE-2025-27846
Published: 2025-08-14
Description: In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://espec.com; https://espec.com/na/about/detail/cve_2025_27846
CVE: CVE-2025-27847
Published: 2025-08-14
Description: In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://espec.com; https://espec.com/na/about/detail/cve_2025_27847
CVE: CVE-2025-36612
Published: 2025-08-14
Description: SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266
References: https://www.dell.com/support/kbdoc/en-us/000356690/dsa-2025-296-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities