rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41358 Direct reference to insecure objects (IDOR) in CronosWeb from CronosWeb i2A
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: CronosWeb i2A
product: CronosWeb
default_status: unaffected
Credits: lang: en
value: Félix Sánchez Medina
Published: 2025-12-10T11:16:28.620Z
CVE-2025-41359 Multiple vulnerabilities in Small HTTP server by Smallsrv
Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a higher priority directory, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could allow arbitrary code execution, unauthorized access to the system, or service disruption. To mitigate the risk, the service path must be properly quoted, and systems must be kept up to date with security patches, while restricting physical and network access.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted search path or element
Affected products: vendor: Smallsrv
product: Small HTTP
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2026-03-26T12:20:03.730Z
CVE-2025-41360 Uncontrolled resource consumption vulnerability in IDF and ZLF
Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:45:26.228Z
CVE-2025-41361 Uncontrolled resource consumption vulnerability in IDF and ZLF
Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit this vulnerability, PROCOME ports must be configured and active, with communications encryption active.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:53:10.953Z
CVE-2025-41362 Code injection vulnerability in IDF and ZLF
Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:46:28.479Z
CVE-2025-41363 CORS vulnerability in IDF and ZLF
In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Problem types: cwe_id: CWE-942
description: CWE-942: Permissive Cross-domain Policy with Untrusted Domains
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:47:55.640Z
CVE-2025-41364 Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:49:03.631Z
CVE-2025-41365 Code injection vulnerability in IDF and ZLF
Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:49:51.858Z
CVE-2025-41366 CORS vulnerability in IDF and ZLF
In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
Problem types: cwe_id: CWE-942
description: CWE-942: Permissive Cross-domain Policy with Untrusted Domains
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:50:42.685Z
CVE-2025-41367 Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ZIV
product: IDF and ZLF
default_status: unaffected
Credits: lang: en
value: Aarón Flecha Menéndez
lang: en
value: Gabriel Vía Echezarreta
Published: 2025-06-06T11:51:36.441Z
CVE-2025-41368 Multiple vulnerabilities in Small HTTP server by Smallsrv
Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outside the document root configured on the server.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Smallsrv
product: Small HTTP
default_status: unaffected
Credits: lang: en
value: Rafael Pedrero
Published: 2026-03-26T11:37:52.747Z
CVE-2025-41370 SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb/html/view/acceso.php.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TESI
product: Gandia Integra Total
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-08-01T12:28:12.959Z
CVE-2025-41371 SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb_v4/integra/html/view/acceso.php
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TESI
product: Gandia Integra Total
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-08-01T12:28:36.860Z
CVE-2025-41372 SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/informe_campo_entrevistas.php.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TESI
product: Gandia Integra Total
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-08-01T12:29:13.628Z
CVE-2025-41373 SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TESI
product: Gandia Integra Total
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-08-01T12:29:25.136Z
CVE-2025-41374 SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/hislistadoacciones.php.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TESI
product: Gandia Integra Total
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-08-01T12:29:35.137Z
CVE-2025-41375 SQL Injection in Limesurvey
SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnerability allows an attacker to retrieve, create, update and delete database via 'token' parameter in '/index.php' endpoint.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LimeSurvey
product: LimeSurvey
default_status: unaffected
Credits: lang: en
value: B3xal
Published: 2025-08-01T12:29:48.916Z
CVE-2025-41376 CRLF Injection in Limesurvey
CRLF Injection vulnerability in Limesurvey v2.65.1+170522.  This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response splitting attacks via '/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC'.
Problem types: cwe_id: CWE-93
description: CWE-93
Affected products: vendor: LimeSurvey
product: LimeSurvey
default_status: unaffected
Credits: lang: en
value: B3xal
Published: 2025-08-01T12:29:59.023Z
CVE-2025-41377 SQL injection vulnerability in Gandia Integra Total
A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. The vulnerability allows an authenticated attacker to retrieve, create, update and delete databases through the 'idestudio' parameter in /encuestas/integraweb[_v4]/integra/html/view/consultacuotasred.php.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: TESI
product: Gandia Integra Total
default_status: unaffected
Credits: lang: en
value: David Utón Amaya (m3n0sd0n4ld)
Published: 2025-05-23T12:37:48.645Z
CVE-2025-41378 Injection vulnerability in Iridium Certus 700
The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Intellian Technologies
product: Iridium Certus 700
default_status: unaffected
Credits: lang: en
value: Gabriel González García
Published: 2025-05-23T12:40:14.121Z
CVE-2025-41379 Injection vulnerability in Iridium Certus 700
The Intellian C700 web panel allows you to add firewall rules. Each of these rules has an associated ID, but there is a problem when adding a new rule, the ID used to create the database entry may be different from the JSON ID. If the rule needs to be deleted later, the system will use the JSON ID and therefore fail. This can be exploited by an attacker to create rules that cannot be deleted unless the device is reset to factory defaults.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Intellian Technologies
product: Iridium Certus 700
default_status: unaffected
Credits: lang: en
value: Gabriel González García
Published: 2025-05-23T12:41:09.682Z
CVE-2025-41380 Injection vulnerability in Iridium Certus 700
Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Intellian Technologies
product: Iridium Certus 700
default_status: unaffected
Credits: lang: en
value: Gabriel González García
Published: 2025-05-23T12:41:58.459Z
CVE-2025-41384 Reflected Cross-Site Scripting (XSS) in SuiteCRM
Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SuiteCRM
product: SuiteCRM
default_status: unaffected
Published: 2025-10-27T12:53:51.383Z
CVE-2025-41385 
An OS Command Injection issue exists in wivia 5 all versions. If this vulnerability is exploited, an arbitrary OS command may be executed by a logged-in administrative user.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: UCHIDA YOKO CO., LTD.
product: wivia 5
Published: 2025-05-30T06:35:56.222Z
CVE-2025-41388 Fuji Electric Smart Editor Stack-based Buffer Overflow
Fuji Electric Smart Editor is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Fuji Electric
product: Smart Editor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2025-06-17T20:24:26.869Z
CVE-2025-41390 
An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability.
Problem types: cwe_id: CWE-829
description: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: Truffle Security Co.
product: TruffleHog
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Adam Reiser of Cisco ASIG
Published: 2025-10-20T14:15:29.418Z
CVE-2025-41391 
Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be executed on the browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Alfasado Inc.
product: PowerCMS
vendor: Alfasado Inc.
product: PowerCMS
vendor: Alfasado Inc.
product: PowerCMS
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published: 2025-07-31T07:25:10.798Z
CVE-2025-41392 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Read
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Ashlar-Vellum
product: Cobalt
default_status: unaffected
vendor: Ashlar-Vellum
product: Xenon
default_status: unaffected
vendor: Ashlar-Vellum
product: Argon
default_status: unaffected
vendor: Ashlar-Vellum
product: Lithium
default_status: unaffected
vendor: Ashlar-Vellum
product: Cobalt Share
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2025-08-18T21:07:20.484Z
CVE-2025-41393 
Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. As for the details of affected product names and versions, refer to the information provided by the vendors under [References].
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Ricoh Company, Ltd.
product: Multiple laser printers and MFPs which implement Web Image Monitor
vendor: KONICA MINOLTA JAPAN, INC.
product: Multiple MFPs which implement Web Image Monitor
Published: 2025-05-12T08:04:39.693Z
CVE-2025-41395 Webapp DoS via malicious retrospective post in Playbooks
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
Problem types: cwe_id: CWE-1287
description: CWE-1287: Improper Validation of Specified Type of Input
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: c0rydoras (c0rydoras)
Published: 2025-04-24T06:48:31.087Z
CVE-2025-41396 
A path traversal issue exists in file uploading feature of multiple versions of PowerCMS. Arbitrary files may be overwritten by a product user.
Problem types: cwe_id: CWE-22
description: Improper limitation of a pathname to a restricted directory ('Path Traversal')
Affected products: vendor: Alfasado Inc.
product: PowerCMS
vendor: Alfasado Inc.
product: PowerCMS
vendor: Alfasado Inc.
product: PowerCMS
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Published: 2025-07-31T07:24:20.561Z
CVE-2025-41399 SCTP Vulnerability
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: BIG-IP Next
default_status: unknown
vendor: F5
product: BIG-IP Next SPK
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-05-07T22:04:07.220Z
CVE-2025-41402 
Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. 

This issue affects Command Centre Server: 

 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: Gallagher
product: Command Centre Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-10-23T03:38:22.200Z