rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-29490 
libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29491 
An allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DoS) via supplying a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29492 
libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29493 
libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29494 
libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29496 
libming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29497 
libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29504 
Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-03T00:00:00.000Z
CVE-2025-29509 
Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external website in the app and the exposure of electronAPI, with a lack of filtering of URL when calling shell.openExternal().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-29512 
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code and potentially render the blacklist IP functionality unusable until content is removed via the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-29513 
Cross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API Access token generator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-29514 
Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration file via providing a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29515 
Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29516 
D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the backup function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29517 
D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29519 
A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to execute arbitrary commands via supplying a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29520 
Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attackers with low-level privileges to arbitrarily change the high-privileged account passwords and escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29521 
Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to escalate privileges via a bruteforce attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29522 
D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29523 
D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29524 
Incorrect access control in the component /cgi-bin/system_diagnostic_main.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29525 
DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-29526 
A Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execute arbitrary Javascript via injecting a crafted payload into the SearchTerm parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-23T00:00:00.000Z
CVE-2025-29529 
ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-24T00:00:00.000Z
CVE-2025-29534 
An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-28T00:00:00.000Z
CVE-2025-29547 
In Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to cause a denial of service because of a null pointer dereference from IOCtl 0x96202000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2025-29556 
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control. Since version 6.3, ExaGrid enforces restrictions preventing users with the Admin role from creating or modifying users with the Security Officer role without approval. However, a flaw in the account creation process allows an attacker to bypass these restrictions via API request manipulation. An attacker with an Admin access can intercept and modify the API request during user creation, altering the parameters to assign the new account to the ExaGrid Security Officers group without the required approval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-29557 
ExaGrid EX10 6.3 - 7.0.1.P08 is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint, where users with operator-level privileges can issue an HTTP request to retrieve SMTP credentials, including plaintext passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-29568 
A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects some unknown features in the file /Scheduling/pages/class_sched.php. Manipulating the class parameter can lead to cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-24T00:00:00.000Z
CVE-2025-29570 
An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binary named rc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-03T00:00:00.000Z
CVE-2025-29573 
Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-29592 
oasys v1.1 is vulnerable to Directory Traversal in ProcedureController.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-10T00:00:00.000Z
CVE-2025-29594 
A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately validated before being processed. Specifically, the $_GET['errorcode'] parameter can be manipulated to access unauthorized error codes, leading to Cross-Site Scripting (XSS) attacks and information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-07T00:00:00.000Z
CVE-2025-29602 
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-07T00:00:00.000Z
CVE-2025-29606 
py-libp2p before 0.2.3 allows a peer to cause a denial of service (resource consumption) via a large RSA key.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: libp2p
product: py-libp2p
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: 2025-07-14T00:00:00.000Z
CVE-2025-29621 
Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuration under the My Preferences module. This vulnerability allows attackers to manipulate application settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2025-29625 
A buffer overflow vulnerability in Astrolog v7.70 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via an overly long environment variable passed to FileOpen function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-29627 
An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Biometric Authentication Module
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-09T00:00:00.000Z
CVE-2025-29628 
A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 leaving the string vulnerable to interception and modification through a Man-in-the-Middle attack. This may result in the attacker capturing device credentials or taking control of vulnerable home kits.
Problem types: cwe_id: CWE-924
description: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Affected products: vendor: Gardyn
product: Home Kit Firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.4
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published: 2025-07-25T00:00:00.000Z
CVE-2025-29629 
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gardyn Home Kits.
Problem types: cwe_id: CWE-1392
description: CWE-1392 Use of Default Credentials
Affected products: vendor: Gardyn
product: Home Kit Firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.1
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: 2025-07-25T00:00:00.000Z
CVE-2025-29631 
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the operating system for execution. The vulnerability may allow an attacker to execute arbitrary operating system commands on a target Home Kit.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Gardyn
product: Home Kit Firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.8
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2025-07-25T00:00:00.000Z
CVE-2025-29632 
Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-29T00:00:00.000Z
CVE-2025-29635 
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-25T00:00:00.000Z
CVE-2025-29640 
Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the parameter searchdata..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2025-29641 
Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2025-29646 
An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and (teid = 0 or teid >= ogs_pfcp_pdr_teid_pool.size).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-18T00:00:00.000Z
CVE-2025-29647 
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-03T00:00:00.000Z
CVE-2025-29659 
Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function located in the "cmd" binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-21T00:00:00.000Z
CVE-2025-29660 
A vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a TCP service on port 6789. This service lacks proper input validation, allowing attackers to execute arbitrary scripts present on the device by sending specially crafted TCP requests using directory traversal techniques.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-21T00:00:00.000Z
CVE-2025-29661 
Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29662 
A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29686 
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-29688 
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-29689 
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-29690 
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-29691 
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-29699 
NetSurf 3.11 is vulnerable to Use After Free in dom_node_set_text_content function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-03T00:00:00.000Z
CVE-2025-29705 
code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-15T00:00:00.000Z
CVE-2025-29708 
SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2025-29709 
SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2025-29710 
SourceCodester Company Website CMS 1.0 is vulnerable to Cross Site Scripting (XSS) via /dashboard/Services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-16T00:00:00.000Z
CVE-2025-29719 
SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and Address text fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-02T00:00:00.000Z
CVE-2025-29720 
Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-14T00:00:00.000Z
CVE-2025-29722 
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29743 
D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-22T00:00:00.000Z
CVE-2025-29744 
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-12T00:00:00.000Z
CVE-2025-29745 
A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NTLMv2 hash information via a specially created A2S (Emsisoft Custom Scan) extension file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-05T00:00:00.000Z
CVE-2025-29746 
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-07T00:00:00.000Z
CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters
SunGrow's back end users system  iSolarCloud https://isolarcloud.com  uses an MQTT service to transport data from the user's connected devices to the user's web browser. 
The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. 
While the data that is transmitted through the MQTT server is encrypted and the credentials for the MQTT server are obtained though an API call, the credentials could be used to subscribe to any topic and the encryption key can be used to decrypt all messages received.
An attack with an account on iSolarCloud.com could extract MQTT credentials and the decryption key from the browser and then use an external program to subscribe to the topic '#' and thus recieve all messages from all connected devices.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: SunGrow
product: iSolarCloud
default_status: unaffected
Credits: lang: en
value: Harm van den Brink (DIVD)
lang: en
value: Frank Breedijk (DIVD)
lang: en
value: ENCS (https://encs.eu/)
Published: 2025-06-11T08:01:16.794Z