rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-11623 
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Ivanti
product: Endpoint Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-10-13T21:09:07.731Z
CVE-2025-11624 Buffer overwrite when processing file handles with the SFTP server
Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptor size, but smaller than max handle size allowed.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: wolfSSH
product: wolfSSH
default_status: unaffected
Credits: lang: en
value: Stanislav Fort of Aisle Research
Published: 2025-10-21T13:14:19.625Z
CVE-2025-11625 Host verification bypass and credential leak
Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: wolfSSL
product: wolfSSH
default_status: affected
Published: 2025-10-21T13:25:18.120Z
CVE-2025-11626 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-10T22:33:26.431Z
CVE-2025-11627 Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning
The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content into log files, and potentially cause denial of service via disk space exhaustion.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: sminozzi
product: Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Jonas Benjamin Friedli
Published: 2025-10-30T05:28:27.216Z
CVE-2025-11628 jimit105 Project-Online-Shopping-Website Product Inventory delete.php sql injection
A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. This manipulation of the argument product_code causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: jimit105
product: Project-Online-Shopping-Website
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: mahushuai (VulDB User)
Published: 2025-10-12T05:02:05.251Z
CVE-2025-11629 RainyGao DocSys getUserList.do getUserList sql injection
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: RainyGao
product: DocSys
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Tta0 (VulDB User)
Published: 2025-10-12T07:02:06.148Z
CVE-2025-11630 RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal
A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload. Performing manipulation of the argument path results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: RainyGao
product: DocSys
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Tta0 (VulDB User)
Published: 2025-10-12T07:32:04.891Z
CVE-2025-11631 RainyGao DocSys deleteDoc.do path traversal
A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: RainyGao
product: DocSys
CVSS v3.1: version: 3.1
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Tta0 (VulDB User)
Published: 2025-10-12T08:02:06.131Z
CVE-2025-11632 Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate links to billing portal, where they can view and modify billing information of the connected, account, generate chat session tokens, view domain status, etc.
This vulnerability was partially fixed in version 1.5.4 and fully fixed in version 1.5.5
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: jgrietveld
product: Call Now Button – The #1 Click to Call Button for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Burak Kılınç
Published: 2025-10-29T12:31:51.107Z
CVE-2025-11633 Tomofun Furbo 360/Furbo Mini HTTP Traffic collect_logs.sh upload_file_to_s3 certificate validation
A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the component HTTP Traffic Handler. The manipulation leads to improper certificate validation. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T12:02:05.240Z
CVE-2025-11634 Tomofun Furbo 360/Furbo Mini UART information disclosure
A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results in information disclosure. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T12:32:04.763Z
CVE-2025-11635 Tomofun Furbo 360 File Upload resource consumption
A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-400
description: Resource Consumption
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: Tomofun
product: Furbo 360
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X
baseSeverity: MEDIUM
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T14:02:05.607Z
CVE-2025-11636 Tomofun Furbo 360 Account server-side request forgery
A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: Tomofun
product: Furbo 360
CVSS v3.1: version: 3.1
baseScore: 5.6
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X
baseSeverity: MEDIUM
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T15:02:04.833Z
CVE-2025-11637 Tomofun Furbo 360 Audio race condition
A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation results in race condition. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-362
description: Race Condition
Affected products: vendor: Tomofun
product: Furbo 360
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X
baseSeverity: MEDIUM
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T16:32:06.156Z
CVE-2025-11638 Tomofun Furbo 360/Furbo Mini Bluetooth denial of service
A flaw has been found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Bluetooth Handler. Executing manipulation can lead to denial of service. The attacker needs to be present on the local network. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X
baseSeverity: MEDIUM
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T17:02:05.311Z
CVE-2025-11639 Tomofun Furbo 360/Furbo Mini Debug Log S3 Bucket collect_logs.sh sensitive information
A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component Debug Log S3 Bucket Handler. The manipulation leads to insecure storage of sensitive information. An attack has to be approached locally. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-922
description: Insecure Storage of Sensitive Information
cwe_id: CWE-200
description: Information Disclosure
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T17:32:04.778Z
CVE-2025-11640 Tomofun Furbo 360/Furbo Mini Bluetooth Low Energy cleartext transmission
A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-319
description: Cleartext Transmission of Sensitive Information
cwe_id: CWE-310
description: Cryptographic Issues
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T18:02:05.077Z
CVE-2025-11641 Tomofun Furbo 360/Furbo Mini Trial Restriction access control
A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 3.9
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T18:32:05.050Z
CVE-2025-11642 Tomofun Furbo 360/Furbo Mini Registration denial of service
A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 4
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:X
baseSeverity: MEDIUM
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T19:02:05.229Z
CVE-2025-11643 Tomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentials
A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/furbo_img of the component MQTT Client Certificate. Performing manipulation results in hard-coded credentials. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-798
description: Hard-coded Credentials
cwe_id: CWE-259
description: Use of Hard-coded Password
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:X
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T19:32:05.829Z
CVE-2025-11644 Tomofun Furbo 360/Furbo Mini UART sensitive information
A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-922
description: Insecure Storage of Sensitive Information
cwe_id: CWE-200
description: Information Disclosure
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 2
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T20:02:05.648Z
CVE-2025-11645 Tomofun Furbo Mobile App Authentication Token sensitive information
A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-922
description: Insecure Storage of Sensitive Information
cwe_id: CWE-200
description: Information Disclosure
Affected products: vendor: Tomofun
product: Furbo Mobile App
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T20:32:05.707Z
CVE-2025-11646 Tomofun Furbo 360/Furbo Mini GATT Service access control
A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation results in improper access controls. The attack can only be performed from the local network. The exploit is now public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: Tomofun
product: Furbo 360
vendor: Tomofun
product: Furbo Mini
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Calvin Star (Software Secured)
lang: en
value: Julian B (Software Secured)
lang: en
value: jTag Labs (VulDB User)
lang: en
value: jTag Labs (VulDB User)
Published: 2025-10-12T21:02:05.171Z