deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27052
Published: 2025-07-08
Description: Memory corruption while processing data packets in diag received from Unix clients.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE: CVE-2025-27055
Published: 2025-07-08
Description: Memory corruption during the image encoding process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE: CVE-2025-27056
Published: 2025-07-08
Description: Memory corruption during sub-system restart while processing clean-up to free up resources.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE: CVE-2025-27057
Published: 2025-07-08
Description: Transient DOS while handling beacon frames with invalid IE header length.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE: CVE-2025-27058
Published: 2025-07-08
Description: Memory corruption while processing packet data with exceedingly large packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE: CVE-2025-27061
Published: 2025-07-08
Description: Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2025-bulletin.html
CVE: CVE-2025-50130
Published: 2025-07-08
Description: A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD.
Opening V9 files or X1 files specially crafted by an attacker on the affected product may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://jvn.jp/en/vu/JVNVU94011267/; https://monitouch.fujielectric.com/site/download-e/03tellus_inf/Search.php; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-7178
Published: 2025-07-08
Description: A vulnerability classified as critical has been found in code-projects Food Distributor Site 1.0. This affects an unknown part of the file /admin/login.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kn1g78/cve/blob/main/food.md; https://vuldb.com/?ctiid.315117
CVE: CVE-2025-7179
Published: 2025-07-08
Description: A vulnerability classified as critical was found in code-projects Library System 1.0. This vulnerability affects unknown code of the file /add-teacher.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kobeforever26/cve/issues/1; https://vuldb.com/?ctiid.315118
CVE: CVE-2025-47422
Published: 2025-07-08
Description: Advanced Installer before 22.6 has an uncontrolled search path element local privilege escalation vulnerability. When running as SYSTEM in certain configurations, Advanced Installer looks in standard-user writable locations for non-existent binaries and executes them as SYSTEM. A low-privileged attacker can place a malicious binary in a targeted folder; when the installer is executed, the attacker achieves arbitrary SYSTEM code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://www.advancedinstaller.com/advanced-installer-security-fixes-retrospective.html; https://www.advancedinstaller.com/advanced-installer-security-fixes-retrospective.html#update-deprecated-apis-used-to-resolve-paths; https://www.advancedinstaller.com/release-22.6.html
CVE: CVE-2025-7180
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kn1g78/cve/blob/main/staff1/staff1.md; https://vuldb.com/?ctiid.315119
CVE: CVE-2025-7181
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. The manipulation of the argument uploadedfile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/kn1g78/cve/blob/main/staff2/staff2.md; https://vuldb.com/?ctiid.315120
CVE: CVE-2025-7345
Published: 2025-07-08
Description: A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://access.redhat.com/errata/RHSA-2025:12841; https://access.redhat.com/errata/RHSA-2025:12862; https://access.redhat.com/errata/RHSA-2025:13315
CVE: CVE-2024-52965
Published: 2025-07-08
Description: A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.
CVSS Score: 7.2 (HIGH)
CWE: CWE-304
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-511
CVE: CVE-2024-55599
Published: 2025-07-08
Description: An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-358
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-053
CVE: CVE-2025-24474
Published: 2025-07-08
Description: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiAnalyzer 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; and FortiAnalyzer Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker with high privilege to extract database information via crafted requests.
CVSS Score: 2.7 (LOW)
CWE: CWE-89
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-437
CVE: CVE-2025-29267
Published: 2025-07-08
Description: SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the cid parameter in the GET request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://abis.com; http://adjutant.com; https://github.com/cmoncrook/Security-Advisories/blob/main/CVE-2025-29267
CVE: CVE-2025-2793
Published: 2025-07-08
Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 

6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4



is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7239092
CVE: CVE-2025-2827
Published: 2025-07-08
Description: IBM Sterling File Gateway 

6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4





could disclose sensitive installation directory information to an authenticated user that could be used in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-548
References: https://www.ibm.com/support/pages/node/7239094
CVE: CVE-2025-36600
Published: 2025-07-08
Description: Dell Client Platform BIOS contains an Improper Access Control Applied to Mirrored or Aliased Memory Regions vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1257
References: https://www.dell.com/support/kbdoc/en-us/000320876/dsa-2025-205
CVE: CVE-2025-3630
Published: 2025-07-08
Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 

6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4

is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7239095
CVE: CVE-2025-53372
Published: 2025-07-08
Description: node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3.0, a command injection vulnerability exists in the node-code-sandbox-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges on the host machine, bypassing the sandbox protection of running code inside docker. This vulnerability is fixed in 1.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/alfonsograziano/node-code-sandbox-mcp/commit/e461a74ecb189b268daac0d972c467b49b2abdd2; https://github.com/alfonsograziano/node-code-sandbox-mcp/security/advisories/GHSA-5w57-2ccq-8w95; https://github.com/alfonsograziano/node-code-sandbox-mcp/security/advisories/GHSA-5w57-2ccq-8w95
CVE: CVE-2025-53480
Published: 2025-07-08
Description: The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders affected message keys.




This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I777fc55fef15c3b00df0db268af2b64cb2d6e381; https://phabricator.wikimedia.org/T394700
CVE: CVE-2025-53545
Published: 2025-07-08
Description: Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit ddb439f8eb1816010f2ef653a908648b71f9bba8.
CWE: CWE-287
References: https://github.com/frappe/press/commit/ddb439f8eb1816010f2ef653a908648b71f9bba8; https://github.com/frappe/press/security/advisories/GHSA-fwfh-vhjg-45q4
CVE: CVE-2025-5450
Published: 2025-07-08
Description: Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-602
References: https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE: CVE-2025-5451
Published: 2025-07-08
Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to trigger a denial of service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE: CVE-2025-5463
Published: 2025-07-08
Description: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a local authenticated attacker to obtain that information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE: CVE-2025-6770
Published: 2025-07-08
Description: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2025-6770-CVE-2025-6771?language=en_US
CVE: CVE-2025-6995
Published: 2025-07-08
Description: Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
CVSS Score: 8.4 (HIGH)
CWE: CWE-257
References: https://forums.ivanti.com/s/article/Security-Advisory-July-2025-for-Ivanti-EPM-2024-SU2-and-EPM-2022-SU8
CVE: CVE-2025-6996
Published: 2025-07-08
Description: Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
CVSS Score: 8.4 (HIGH)
CWE: CWE-257
References: https://forums.ivanti.com/s/article/Security-Advisory-July-2025-for-Ivanti-EPM-2024-SU2-and-EPM-2022-SU8
CVE: CVE-2025-7037
Published: 2025-07-08
Description: SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://forums.ivanti.com/s/article/Security-Advisory-July-2025-for-Ivanti-EPM-2024-SU2-and-EPM-2022-SU8?language=en_US
CVE: CVE-2025-7182
Published: 2025-07-08
Description: A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/modules/subject/edit.php. The manipulation of the argument pre leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/Catcheryp/CVE/issues/5; https://itsourcecode.com/; https://vuldb.com/?ctiid.315121
CVE: CVE-2025-7183
Published: 2025-07-08
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /pages/customer_account.php. The manipulation of the argument Customer leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/To-LingJing/CVE-Issues/issues/3; https://vuldb.com/?ctiid.315122; https://vuldb.com/?id.315122
CVE: CVE-2025-7326
Published: 2025-07-08
Description: Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
CVSS Score: 7.0 (HIGH)
CWE: CWE-1390
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070; https://www.cve.org/CVERecord?id=CVE-2025-24070; https://www.herodevs.com/vulnerability-directory/cve-2025-7326
CVE: CVE-2025-0292
Published: 2025-07-08
Description: SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE: CVE-2025-0293
Published: 2025-07-08
Description: CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-93
References: https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE: CVE-2025-3648
Published: 2025-07-08
Description: A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.

To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.

Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.

Customers, please review the KB Articles in the References section.
CWE: CWE-1220
References: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567; https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712
CVE: CVE-2025-43019
Published: 2025-07-08
Description: A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file deletion.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]5980-16/hpsbgn04031
CVE: CVE-2025-5464
Published: 2025-07-08
Description: Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEs
CVE: CVE-2025-6771
Published: 2025-07-08
Description: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3  and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2025-6770-CVE-2025-6771?language=en_US
CVE: CVE-2025-7184
Published: 2025-07-08
Description: A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. This affects an unknown part of the file /user/teacher/books.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/HeDunSec/cve/issues/2; https://vuldb.com/?ctiid.315123
CVE: CVE-2025-7185
Published: 2025-07-08
Description: A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /approve.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/HeDunSec/cve/issues/1; https://vuldb.com/?ctiid.315124
CVE: CVE-2024-36348
Published: 2025-07-08
Description: A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage.
CVSS Score: 3.8 (LOW)
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html; http://www.openwall.com/lists/oss-security/2025/08/28/2
CVE: CVE-2024-36349
Published: 2025-07-08
Description: A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage.
CVSS Score: 3.8 (LOW)
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
CVE: CVE-2024-36350
Published: 2025-07-08
Description: A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.
CVSS Score: 5.6 (MEDIUM)
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html; http://www.openwall.com/lists/oss-security/2025/08/28/2; http://xenbits.xen.org/xsa/advisory-471.html
CVE: CVE-2024-36357
Published: 2025-07-08
Description: A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.
CVSS Score: 5.6 (MEDIUM)
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html; http://www.openwall.com/lists/oss-security/2025/08/28/2; http://xenbits.xen.org/xsa/advisory-471.html
CVE: CVE-2025-21164
Published: 2025-07-08
Description: Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-62.html
CVE: CVE-2025-21165
Published: 2025-07-08
Description: Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-62.html
CVE: CVE-2025-21166
Published: 2025-07-08
Description: Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d_designer/apsb25-62.html