deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-36601
Published: 2025-09-25
Description: Dell PowerScale OneFS, versions 9.5.0.0 through 9.11.0.0, contains an exposure of sensitive information to an unauthorized actor vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://www.dell.com/support/kbdoc/en-us/000353080/dsa-2025-272-security-update-for-dell-powerscale-onefs-multiple-third-party-component-vulnerabilities
CVE: CVE-2025-36857
Published: 2025-09-25
Description: Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management.

This vulnerability was remediated in version 7.5.021 of the product.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: https://docs.rapid7.com/insight/releasenotes-2025sep/#application-security-insightappsec-and-appspider
CVE: CVE-2025-40836
Published: 2025-09-25
Description: Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE: CVE-2025-40837
Published: 2025-09-25
Description: Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE: CVE-2025-40838
Published: 2025-09-25
Description: Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.ericsson.com/en/about-us/security/psirt/e2025-09-25
CVE: CVE-2025-46148
Published: 2025-09-25
Description: In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results.
CVSS Score: 5.3 (MEDIUM)
References: https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a; https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093; https://github.com/pytorch/pytorch/issues/151198
CVE: CVE-2025-46149
Published: 2025-09-25
Description: In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a; https://github.com/pytorch/pytorch/issues/147848; https://github.com/pytorch/pytorch/pull/147961
CVE: CVE-2025-46150
Published: 2025-09-25
Description: In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.
CVSS Score: 5.3 (MEDIUM)
References: https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a; https://github.com/pytorch/pytorch/issues/141538; https://github.com/pytorch/pytorch/issues/141538#issuecomment[PII_REDACTED]
CVE: CVE-2025-46152
Published: 2025-09-25
Description: In PyTorch before 2.7.0, bitwise_right_shift produces incorrect output for certain out-of-bounds values of the "other" argument.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a; https://github.com/pytorch/pytorch/issues/143555; https://github.com/pytorch/pytorch/pull/143635
CVE: CVE-2025-46153
Published: 2025-09-25
Description: PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallback_random=True.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1176
References: https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a; https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a; https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0
CVE: CVE-2025-55551
Published: 2025-09-25
Description: An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/151401; https://github.com/pytorch/pytorch/issues/151401
CVE: CVE-2025-59823
Published: 2025-09-25
Description: Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP providers prior to version 1.46.0. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This affects all Gardener installations where Terraformer is used/can be enabled for infrastructure provisioning with any of the affected components. This issue has been patched in Gardener Extensions for AWS providers version 1.64.0, Azure providers version 1.55.0, OpenStack providers version 1.49.0, and GCP providers version 1.46.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/gardener/gardener-extension-provider-aws/releases/tag/v1.64.0; https://github.com/gardener/gardener-extension-provider-aws/security/advisories/GHSA-227x-7mh8-3cf6; https://github.com/gardener/gardener-extension-provider-azure/releases/tag/v1.55.0
CVE: CVE-2025-59830
Published: 2025-09-25
Description: Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71; https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm
CVE: CVE-2025-59832
Published: 2025-09-25
Description: Horilla is a free and open source Human Resource Management System (HRMS). Prior to version 1.4.0, there is a stored XSS vulnerability in the ticket comment editor. A low-privilege authenticated user could run arbitrary JavaScript in an admin’s browser, exfiltrate the admin’s cookies/CSRF token, and hijack their session. This issue has been patched in version 1.4.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-79
References: https://github.com/Mmo-kali/CVE/blob/main/CVE-2025-59832/2025-08-Horilla_Vulnerability_1.pdf; https://github.com/horilla-opensource/horilla/security/advisories/GHSA-8x78-6q9g-hv2h; https://github.com/horilla-opensource/horilla/security/advisories/GHSA-8x78-6q9g-hv2h
CVE: CVE-2025-59838
Published: 2025-09-25
Description: Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/monkeytypegame/monkeytype/commit/f025b121cbe437e29de432b4aa72e0de22c755b7; https://github.com/monkeytypegame/monkeytype/releases/tag/v25.44.0; https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-j4xx-fww5-774w
CVE: CVE-2024-48014
Published: 2025-09-25
Description: Dell BSAFE Micro Edition Suite, versions prior to 5.0.2.3 contain an Out-of-bounds Write vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.dell.com/support/kbdoc/en-us/000256131/dsa-2024-459-dell-bsafe-micro-edition-suite-security-update
CVE: CVE-2025-10911
Published: 2025-09-25
Description: A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-825
References: https://access.redhat.com/errata/RHSA-2026:11015; https://access.redhat.com/security/cve/CVE-2025-10911; https://bugzilla.redhat.com/show_bug.cgi?id=2397838
CVE: CVE-2025-10952
Published: 2025-09-25
Description: A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function stream_handler of the file ml_logger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/geyang/ml-logger/issues/74; https://vuldb.com/?ctiid.325822; https://vuldb.com/?id.325822
CVE: CVE-2025-10953
Published: 2025-09-25
Description: A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /goform/formApMail. The manipulation of the argument senderEmail leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/8.md; https://github.com/cymiao1978/cve/blob/main/9.md; https://vuldb.com/?ctiid.325824
CVE: CVE-2025-20333
Published: 2025-09-25
Description: A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker with valid VPN user credentials could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of the affected device.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-120
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20333
CVE: CVE-2025-20362
Published: 2025-09-25
Description: Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS) conditions. Cisco strongly recommends that all customers upgrade to the fixed software releases that are listed in the Fixed Software ["#fs"] section of this advisory.
 A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that are related to remote access VPN that should otherwise be inaccessible without authentication.
 This vulnerability is due to improper validation of user-supplied input in HTTP(S) requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on a device. A successful exploit could allow the attacker to access a restricted URL without authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW; https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20362
CVE: CVE-2025-20363
Published: 2025-09-25
Description: A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device. 
 This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web service on an affected device after obtaining additional information about the system, overcoming exploit mitigations, or both. A successful exploit could allow the attacker to execute arbitrary code as root, which may lead to the complete compromise of the affected device.
 For more information about this vulnerability, see the Details ["#details"] section of this advisory.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-122
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
CVE: CVE-2025-26333
Published: 2025-09-25
Description: Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated data. A remote attacker could potentially exploit this vulnerability, leading to information exposure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-209
References: https://www.dell.com/support/kbdoc/en-us/000296144/dsa-2025-100-dell-bsafe-crypto-j-security-update
CVE: CVE-2025-33116
Published: 2025-09-25
Description: IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7246140
CVE: CVE-2025-43943
Published: 2025-09-25
Description: Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000372457/dsa-2025-354-security-update-for-dell-cloud-disaster-recovery-rce-vulnerability
CVE: CVE-2025-55552
Published: 2025-09-25
Description: pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-682
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/147847; https://github.com/pytorch/pytorch/issues/147847
CVE: CVE-2025-55553
Published: 2025-09-25
Description: A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/151432; https://github.com/pytorch/pytorch/pull/154645
CVE: CVE-2025-55554
Published: 2025-09-25
Description: pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/151510
CVE: CVE-2025-55556
Published: 2025-09-25
Description: TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-506
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/tensorflow/tensorflow/issues/82317
CVE: CVE-2025-55557
Published: 2025-09-25
Description: A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/151738; https://github.com/pytorch/pytorch/pull/151931
CVE: CVE-2025-55558
Published: 2025-09-25
Description: A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/151523; https://github.com/pytorch/pytorch/pull/151887
CVE: CVE-2025-55559
Published: 2025-09-25
Description: An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/tensorflow/tensorflow/issues/84205; https://github.com/tensorflow/tensorflow/issues/84205
CVE: CVE-2025-55560
Published: 2025-09-25
Description: An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc; https://github.com/pytorch/pytorch/issues/151522; https://github.com/pytorch/pytorch/pull/151897
CVE: CVE-2025-57446
Published: 2025-09-25
Description: An issue in O-RAN Near Realtime RIC ric-plt-submgr in the J-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the Subscription Manager API component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/ting1197/vulnerability-research/tree/main/CVE-2025-57446; https://lf-o-ran-sc.atlassian.net/browse/RIC-1073
CVE: CVE-2025-59841
Published: 2025-09-25
Description: Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation. Authenticated users can continue to access protected endpoints, such as /api/profile, even after logging out. CSRF tokens are also still valid post-logout, which can allow unauthorized actions. This issue has been patched in version 2.3.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384, CWE-613
References: https://github.com/FlagForgeCTF/flagForge/commit/304b6c82a4f76871b336404b91e5cdd8a7d7d5bd; https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-h6pr-4cwv-6cjg
CVE: CVE-2025-60018
Published: 2025-09-25
Description: glib-networking's OpenSSL backend fails to properly check the return value of a call to BIO_write(), resulting in an out of bounds read.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/security/cve/CVE-2025-60018; https://bugzilla.redhat.com/show_bug.cgi?id=2398135; https://gitlab.gnome.org/GNOME/glib-networking/-/issues/226
CVE: CVE-2025-60019
Published: 2025-09-25
Description: glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.
CVSS Score: 3.7 (LOW)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-60019; https://bugzilla.redhat.com/show_bug.cgi?id=2398140; https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227
CVE: CVE-2025-10879
Published: 2025-09-25
Description: All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-268-01
CVE: CVE-2025-10880
Published: 2025-09-25
Description: All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietary "Dingtian Binary" protocol password by sending an unauthenticated GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-268-01
CVE: CVE-2025-34227
Published: 2025-09-25
Description: Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://theyhack.me/CVE-2025-34227-Nagios-XI-Wizard-Command-Injection/; https://www.nagios.com/changelog/; https://www.nagios.com/products/security/
CVE: CVE-2025-10958
Published: 2025-09-25
Description: A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md; https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md#poc; https://vuldb.com/?ctiid.325826
CVE: CVE-2025-10959
Published: 2025-09-25
Description: A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/DMZ.md; https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/DMZ.md#poc; https://vuldb.com/?ctiid.325827