rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-25784 
An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25785 
JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25789 
FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25790 
An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25791 
An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25792 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25793 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25794 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25796 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25797 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25799 
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25800 
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25802 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25813 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25818 
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25823 
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25825 
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25827 
A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z
CVE-2025-25871 
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-25872 
An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-25873 
Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-25875 
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL injection to obtain sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25876 
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25877 
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL injection to obtain sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25878 
A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL injection to obtain sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25891 
A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-25892 
A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-25893 
An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-25894 
An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-25895 
An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-25896 
A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2025-25897 
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2025-25898 
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2025-25899 
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2025-25900 
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2025-25901 
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-13T00:00:00.000Z
CVE-2025-25905 
Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-25T00:00:00.000Z
CVE-2025-25907 
tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25908 
A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25914 
SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25916 
wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-28T00:00:00.000Z
CVE-2025-25925 
A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25927 
A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25928 
A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25929 
A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25939 
Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25940 
VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25942 
An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memory allocated in SampleArray::SampleArray in Mp4Fragment.cpp is not properly released.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2025-25943 
Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in Ap4Stz2Atom.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2025-25944 
Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2025-25945 
An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFromStream at Ap4DescriptorFactory.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2025-25946 
An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcessor::Initialize and AP4_Processor::Process, during the execution of mp4encrypt with a specially crafted MP4 input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2025-25947 
An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the execution of mp4encrypt with a specially crafted MP4 input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2025-25948 
Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25949 
A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25950 
Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25951 
An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25952 
An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information via a crafted API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25953 
Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnerability allows authenticated attackers to escalate privileges and access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25957 
Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25958 
Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25960 
Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25962 
An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-29T00:00:00.000Z
CVE-2025-25967 
Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-03T00:00:00.000Z
CVE-2025-25968 
DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25973 
A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a crafted script to the article.title, article.category, and article.tags parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25975 
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-12T00:00:00.000Z
CVE-2025-25977 
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25983 
An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based sharing component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-25984 
An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via UART component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-25985 
An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mnt/mtd/mvconf/user_info.ini components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-25988 
Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25990 
Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25991 
SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25992 
SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25993 
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z