deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-38419
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()

When rproc->state = RPROC_DETACHED and rproc_attach() is used
to attach to the remote processor, if rproc_handle_resources()
returns a failure, the resources allocated by imx_rproc_prepare()
should be released, otherwise the following memory leak will occur.

Since almost the same thing is done in imx_rproc_prepare() and
rproc_resource_cleanup(), Function rproc_resource_cleanup() is able
to deal with empty lists so it is better to fix the "goto" statements
in rproc_attach(). replace the "unprepare_device" goto statement with
"clean_up_resources" and get rid of the "unprepare_device" label.

unreferenced object 0xffff0000861c5d00 (size 128):
comm "kworker/u12:3", pid 59, jiffies[PII_REDACTED] (age 149.220s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 02 88 00 00 00 00 00 00 10 00 00 00 00 00 ............
backtrace:
 [<00000000f949fe18>] slab_post_alloc_hook+0x98/0x37c
 [<00000000adbfb3e7>] __kmem_cache_alloc_node+0x138/0x2e0
 [<[PII_REDACTED]1c0345>] kmalloc_trace+0x40/0x158
 [<000000004e330a49>] rproc_mem_entry_init+0x60/0xf8
 [<[PII_REDACTED]15755e>] imx_rproc_prepare+0xe0/0x180
 [<[PII_REDACTED]f61b4e>] rproc_boot+0x2ec/0x528
 [<00000000e7e994ac>] rproc_add+0x124/0x17c
 [<[PII_REDACTED]>] imx_rproc_probe+0x4ec/0x5d4
 [<00000000efc298a1>] platform_probe+0x68/0xd8
 [<[PII_REDACTED]0be6fe>] really_probe+0x110/0x27c
 [<00000000e245c0ae>] __driver_probe_device+0x78/0x12c
 [<00000000f61f6f5e>] driver_probe_device+0x3c/0x118
 [<00000000a7874938>] __device_attach_driver+0xb8/0xf8
 [<[PII_REDACTED]319e69>] bus_for_each_drv+0x84/0xe4
 [<00000000db3eb243>] __device_attach+0xfc/0x18c
 [<[PII_REDACTED]e4e1a4>] device_initial_probe+0x14/0x20
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/5434d9f2fd68722b514c14b417b53a8af02c4d24; https://git.kernel.org/stable/c/7692c9fbedd9087dc9050903f[PII_REDACTED]8d9b1; https://git.kernel.org/stable/c/82208ce9505abb057afdece7c62a14687c52c9ca
CVE: CVE-2025-45777
Published: 2025-07-25
Description: An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/edwin-0990/CVE_ID/tree/main/CVE-2025-45777; https://www.chavaramatrimony.com/register-free
CVE: CVE-2025-45939
Published: 2025-07-25
Description: Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: http://golive.com; https://golive.apwide.com/doc/latest/server-data-center/2025-06-06
CVE: CVE-2025-8158
Published: 2025-07-25
Description: A vulnerability was found in PHPGurukul Login and User Management System 3.3. It has been declared as critical. This vulnerability affects unknown code of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/secfake/mycve/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.317572
CVE: CVE-2024-48729
Published: 2025-07-25
Description: An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users component.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269
References: http://etsi.com; http://open.com; https://www.osmium.solutions/articles/osm-mano-vulnerability-discovery.html#3
CVE: CVE-2024-48730
Published: 2025-07-25
Description: The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts performed by the default admin user, allowing a remote attacker to escalate privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://www.osmium.solutions/articles/osm-mano-vulnerability-discovery.html#2
CVE: CVE-2025-30086
Published: 2025-07-25
Description: CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/goharbor/harbor/releases; https://github.com/goharbor/harbor/security/advisories/GHSA-h27m-3qw8-3pw8; https://goharbor.io/blog/
CVE: CVE-2025-38420
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: do not ping device which has failed to load firmware

Syzkaller reports [1, 2] crashes caused by an attempts to ping
the device which has failed to load firmware. Since such a device
doesn't pass 'ieee80211_register_hw()', an internal workqueue
managed by 'ieee80211_queue_work()' is not yet created and an
attempt to queue work on it causes null-ptr-deref.

[1] https://syzkaller.appspot.com/bug?extid=9a4aec[PII_REDACTED]45ff
[2] https://syzkaller.appspot.com/bug?extid=0d8afba53e8fb2633217
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0140d3d37f0f1759d1fdedd854c7875a86e15f8d; https://git.kernel.org/stable/c/11ef72b3312752c2ff92f3c1e64912be3228ed36; https://git.kernel.org/stable/c/15d[PII_REDACTED]2cec4b57052da73387f91a2e870
CVE: CVE-2025-38421
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd: pmf: Use device managed allocations

If setting up smart PC fails for any reason then this can lead to
a double free when unloading amd-pmf.  This is because dev->buf was
freed but never set to NULL and is again freed in amd_pmf_remove().

To avoid subtle allocation bugs in failures leading to a double free
change all allocations into device managed allocations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/0d10b532f861253c283863522d59d099fcb0796d; https://git.kernel.org/stable/c/d9db3a941270d92bbd1a6a6b54a10324484f2f2d
CVE: CVE-2025-38422
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices

Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb
and 64 Kb respectively. Adjust max size definitions and return correct
EEPROM length based on device. Also prevent out-of-bound read/write.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/088279ff18cdc437d6fac5890e0c52c624f78a5b; https://git.kernel.org/stable/c/3b9935586a9b54d2da27901b830d3cf46ad66a1e; https://git.kernel.org/stable/c/51318d644c993b3f7a60b8616a6a5adc1e967cd2
CVE: CVE-2025-38423
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd9375: Fix double free of regulator supplies

Driver gets regulator supplies in probe path with
devm_regulator_bulk_get(), so should not call regulator_bulk_free() in
error and remove paths to avoid double free.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/63fe298652d4eda07d738bfcbbc59d1343a675ef; https://git.kernel.org/stable/c/c8228b5f3d74fd8ad4dfc79d5d601eb6fca5e63e; https://git.kernel.org/stable/c/ce30258c05d39b62a05c99016d7148b3bf60fbdc
CVE: CVE-2025-38424
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

perf: Fix sample vs do_exit()

Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
synchronous external abort -- most likely due to trying to access
MMIO in bad ways.

The crash further shows perf trying to do a user stack sample while in
exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address
space it is trying to access.

It turns out that we stop perf after we tear down the userspace mm; a
receipie for disaster, since perf likes to access userspace for
various reasons.

Flip this order by moving up where we stop perf in do_exit().

Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER
to abort when the current task does not have an mm (exit_mm() makes
sure to set current->mm = NULL; before commencing with the actual
teardown). Such that CPU wide events don't trip on this same problem.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2ee6044a693735396bb47eeaba1ac3ae26c1c99b; https://git.kernel.org/stable/c/456019adaa2f5366b89c868dea9b483179bece54; https://git.kernel.org/stable/c/4f6fc[PII_REDACTED]31527cefe3eb45338abd8ab39
CVE: CVE-2025-38425
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: tegra: check msg length in SMBUS block read

For SMBUS block read, do not continue to read if the message length
passed from the device is '0' or greater than the maximum allowed bytes.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/3f03f77ce688d02da284174e1884b6065d6159bd; https://git.kernel.org/stable/c/75a864f21ceeb8c1e8ce1b7589174fec2c3a039e; https://git.kernel.org/stable/c/a6e04f05ce0b070ab39d5775580e65c7d943da0b
CVE: CVE-2025-38426
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Add basic validation for RAS header

If RAS header read from EEPROM is corrupted, it could result in trying
to allocate huge memory for reading the records. Add some validation to
header fields.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0479268fdfaaff6e15d69e8a8387410f36d1b793; https://git.kernel.org/stable/c/5df0d6addb7e9b6f71f7162d1253762a5be9138e; https://git.kernel.org/stable/c/b52f52bc5ba9feb026c0be600f8ac584fd12d187
CVE: CVE-2025-38427
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

video: screen_info: Relocate framebuffers behind PCI bridges

Apply PCI host-bridge window offsets to screen_info framebuffers. Fixes
invalid access to I/O memory.

Resources behind a PCI host bridge can be relocated by a certain offset
in the kernel's CPU address range used for I/O. The framebuffer memory
range stored in screen_info refers to the CPU addresses as seen during
boot (where the offset is 0). During boot up, firmware may assign a
different memory offset to the PCI host bridge and thereby relocating
the framebuffer address of the PCI graphics device as seen by the kernel.
The information in screen_info must be updated as well.

The helper pcibios_bus_to_resource() performs the relocation of the
screen_info's framebuffer resource (given in PCI bus addresses). The
result matches the I/O-memory resource of the PCI graphics device (given
in CPU addresses). As before, we store away the information necessary to
later update the information in screen_info itself.

Commit 78aa89d1dfba ("firmware/sysfb: Update screen_info for relocated
EFI framebuffers") added the code for updating screen_info. It is based
on similar functionality that pre-existed in efifb. Efifb uses a pointer
to the PCI resource, while the newer code does a memcpy of the region.
Hence efifb sees any updates to the PCI resource and avoids the issue.

v3:
- Only use struct pci_bus_region for PCI bus addresses (Bjorn)
- Clarify address semantics in commit messages and comments (Bjorn)
v2:
- Fixed tags (Takashi, Ivan)
- Updated information on efifb
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2f29b5c231011b94007d2c8a6d793992f2275db1; https://git.kernel.org/stable/c/5c70e3ad85d2890d8af[PII_REDACTED]29de26327f2; https://git.kernel.org/stable/c/aeda386d86d79269a08f470dbdc53d13a91e51fa
CVE: CVE-2025-38428
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

Input: ims-pcu - check record size in ims_pcu_flash_firmware()

The "len" variable comes from the firmware and we generally do
trust firmware, but it's always better to double check.  If the "len"
is too large it could result in memory corruption when we do
"memcpy(fragment->data, rec->data, len);"
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/17474a56acf708bf6b2d174c06ed26abad0a9fd6; https://git.kernel.org/stable/c/5a8cd6ae8393e2eaebf51d420d5374821ef2af87; https://git.kernel.org/stable/c/74661516daee1eadebede8dc607b[PII_REDACTED]ec
CVE: CVE-2025-38429
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Update read pointer only after buffer is written

Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated
before the buffer is written, potentially causing race conditions where
the host sees an updated read pointer before the buffer is actually
written. Updating rd_offset prematurely can lead to the host accessing
an uninitialized or incomplete element, resulting in data corruption.

Invoke the buffer write before updating rd_offset to ensure the element
is fully written before signaling its availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/0007ef098dab48f1ba58364c40b4809f1e21b130; https://git.kernel.org/stable/c/44b9620e82bbec2b9a6ac77f63913636d84f96dc; https://git.kernel.org/stable/c/6f18d174b73d0ceeaa341f46c0986436b3aefc9a
CVE: CVE-2025-38430
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request

If the request being processed is not a v4 compound request, then
examining the cstate can have undefined results.

This patch adds a check that the rpc procedure being executed
(rq_procinfo) is the NFSPROC4_COMPOUND procedure.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1244f0b2c3cecd3f349a877006e67c9492b41807; https://git.kernel.org/stable/c/2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af; https://git.kernel.org/stable/c/425efc6b3292a3c79bfee4a1661cf043dcd9cf2f
CVE: CVE-2025-38431
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix regression with native SMB symlinks

Some users and customers reported that their backup/copy tools started
to fail when the directory being copied contained symlink targets that
the client couldn't parse - even when those symlinks weren't followed.

Fix this by allowing lstat(2) and readlink(2) to succeed even when the
client can't resolve the symlink target, restoring old behavior.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6ddaf7567080c7de2e0c99efca2ee1e6b79beea5; https://git.kernel.org/stable/c/ff8abbd248c1f52df0c321690b88454b13ff54b2
CVE: CVE-2025-38432
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

net: netpoll: Initialize UDP checksum field before checksumming

commit f1fce08e63fe ("netpoll: Eliminate redundant assignment") removed
the initialization of the UDP checksum, which was wrong and broke
netpoll IPv6 transmission due to bad checksumming.

udph->check needs to be set before calling csum_ipv6_magic().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/353016ec159f939a380ff6746476a779367ba9a3; https://git.kernel.org/stable/c/f[PII_REDACTED]987a353d5a95204c4d9cb725637fd
CVE: CVE-2025-38433
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: fix runtime constant support for nommu kernels

the `__runtime_fixup_32` function does not handle the case where `val` is
zero correctly (as might occur when patching a nommu kernel and referring
to a physical address below the 4GiB boundary whose upper 32 bits are all
zero) because nothing in the existing logic prevents the code from taking
the `else` branch of both nop-checks and emitting two `nop` instructions.

This leaves random garbage in the register that is supposed to receive the
upper 32 bits of the pointer instead of zero that when combined with the
value for the lower 32 bits yields an invalid pointer and causes a kernel
panic when that pointer is eventually accessed.

The author clearly considered the fact that if the `lui` is converted into
a `nop` that the second instruction needs to be adjusted to become an `li`
instead of an `addi`, hence introducing the `addi_insn_mask` variable, but
didn't follow that logic through fully to the case where the `else` branch
executes. To fix it just adjust the logic to ensure that the second `else`
branch is not taken if the first instruction will be patched to a `nop`.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0a24b00dcde83934a3cc13e4c6b[PII_REDACTED]96b; https://git.kernel.org/stable/c/8d90d9872edae7e78c3a12b98e239bfaa66f3639
CVE: CVE-2025-38434
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "riscv: Define TASK_SIZE_MAX for __access_ok()"

This reverts commit ad5643cf2f69 ("riscv: Define TASK_SIZE_MAX for
__access_ok()").

This commit changes TASK_SIZE_MAX to be LONG_MAX to optimize access_ok(),
because the previous TASK_SIZE_MAX (default to TASK_SIZE) requires some
computation.

The reasoning was that all user addresses are less than LONG_MAX, and all
kernel addresses are greater than LONG_MAX. Therefore access_ok() can
filter kernel addresses.

Addresses between TASK_SIZE and LONG_MAX are not valid user addresses, but
access_ok() let them pass. That was thought to be okay, because they are
not valid addresses at hardware level.

Unfortunately, one case is missed: get_user_pages_fast() happily accepts
addresses between TASK_SIZE and LONG_MAX. futex(), for instance, uses
get_user_pages_fast(). This causes the problem reported by Robert [1].

Therefore, revert this commit. TASK_SIZE_MAX is changed to the default:
TASK_SIZE.

This unfortunately reduces performance, because TASK_SIZE is more expensive
to compute compared to LONG_MAX. But correctness first, we can think about
optimization later, if required.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/890ba5be6335dbbbc99af14ea007befb5f83f174; https://git.kernel.org/stable/c/f8b1898748dfeb4f9b67b6a6d661f354b9de3523; https://git.kernel.org/stable/c/fe30c30bf3bb68d4a4d8c7c814769857b5c973e6
CVE: CVE-2025-38435
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: vector: Fix context save/restore with xtheadvector

Previously only v0-v7 were correctly saved/restored,
and the context of v8-v31 are damanged.
Correctly save/restore v8-v31 to avoid breaking userspace.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4262bd0d9cc704ea1365ac00afc1272400c2cbef; https://git.kernel.org/stable/c/dd5ceea8d50e9e108a10d1e0d89fa2c9ff442ca2
CVE: CVE-2025-38436
Published: 2025-07-25
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/scheduler: signal scheduled fence when kill job

When an entity from application B is killed, drm_sched_entity_kill()
removes all jobs belonging to that entity through
drm_sched_entity_kill_jobs_work(). If application A's job depends on a
scheduled fence from application B's job, and that fence is not properly
signaled during the killing process, application A's dependency cannot be
cleared.

This leads to application A hanging indefinitely while waiting for a
dependency that will never be resolved. Fix this issue by ensuring that
scheduled fences are properly signaled when an entity is killed, allowing
dependent applications to continue execution.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/471db2c2d4f80ee94225a1ef246e4f5011733e50; https://git.kernel.org/stable/c/8342127a8a65b0673863b106ce32b79c91ae3270; https://git.kernel.org/stable/c/aa382a8b6ed483e9812d0e63b6d1bdcba0186f29
CVE: CVE-2025-44608
Published: 2025-07-25
Description: CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://cloudclassroom-php.com; https://github.com/mr-xmen786/CVE-2025-44608
CVE: CVE-2025-45467
Published: 2025-07-25
Description: Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solely relies on MD5 checksums for firmware integrity validation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-276
References: https://github.com/zgsnj123/CVE-2025-45467/tree/main; https://www.unitree.com/cn/go1
CVE: CVE-2025-52360
Published: 2025-07-25
Description: A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search field is reflected in the search history interface, leading to the execution of arbitrary JavaScript in the browser context when the user interacts with the interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://gist.github.com/MerttTuran/32289a1d3c173f0b7934237c1696bef1
CVE: CVE-2025-8159
Published: 2025-07-25
Description: A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. This issue affects the function formLanguageChange of the file /goform/formLanguageChange of the component HTTP POST Request Handler. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/boyslikesports/vul/blob/main/formLanguageChange.md; https://vuldb.com/?ctiid.317573; https://vuldb.com/?id.317573
CVE: CVE-2025-8160
Published: 2025-07-25
Description: A vulnerability classified as critical has been found in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/SetSysTimeCfg of the component httpd. The manipulation of the argument timeZone leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/CH13hh/cve/blob/main/tenda1.md; https://vuldb.com/?ctiid.317574; https://vuldb.com/?id.317574
CVE: CVE-2013-10032
Published: 2025-07-25
Description: An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary files without proper validation of MIME types or extensions. By uploading a .pht file containing PHP code, an attacker can bypass blacklist-based restrictions and place executable code within the web root. A crafted request using a polyglot or disguised extension allows the attacker to execute the payload by accessing the file directly via the web server. This vulnerability exists due to the use of a blacklist for filtering file types instead of a whitelist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306, CWE-434, CWE-434
References: https://get-simple.info; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/get_simple_cms_upload_exec.rb; https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=27895