rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41403 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection while fetching service account audit data.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2025-05-22T10:39:59.813Z
CVE-2025-41404 
Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier. If this vulnerability is exploited, non-public contents may be viewed by an attacker who can log in to the affected product.
Problem types: cwe_id: CWE-425
description: Direct request ('Forced Browsing')
Affected products: vendor: iroha Soft Co., Ltd.
product: iroha Board
Published: 2025-06-26T06:04:32.064Z
CVE-2025-41406 
Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the moderator user.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: UCHIDA YOKO CO., LTD.
product: wivia 5
Published: 2025-05-30T06:36:08.387Z
CVE-2025-41407 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection in the OU History report.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2025-05-23T10:29:58.652Z
CVE-2025-41408 
Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack.
Problem types: cwe_id: CWE-939
description: Improper authorization in handler for custom URL scheme
Affected products: vendor: LY Corporation
product: "Yahoo! Shopping" App for Android
Published: 2025-09-05T05:25:15.422Z
CVE-2025-41410 Slack import bypasses email verification for team access controls
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
baseSeverity: MEDIUM
baseScore: 5.4
Credits: lang: en
value: daw10
Published: 2025-10-16T08:39:58.233Z
CVE-2025-41413 Fuji Electric Smart Editor Out-of-bounds Write
Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Fuji Electric
product: Smart Editor
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2025-06-17T20:22:05.902Z
CVE-2025-41414 BIG-IP HTTP/2 vulnerability
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. 

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: BIG-IP Next SPK
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-05-07T22:04:09.501Z
CVE-2025-41415 AVEVA PI Integrator Insertion of Sensitive Information into Sent Data
The vulnerability, if exploited, could allow an authenticated miscreant 
(with privileges to access publication targets) to retrieve sensitive 
information that could then be used to gain additional access to 
downstream resources.
Problem types: cwe_id: CWE-201
description: CWE-201
Affected products: vendor: AVEVA
product: PI Integrator
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Maxime Escourbiac, Michelin CERT, and Adam Bertrand, Abicom for Michelin CERT reported these vulnerabilities to AVEVA.
Published: 2025-08-21T19:57:26.099Z
CVE-2025-41418 
Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders. The CGI process may be terminated abnormally by processing  a specially crafted request.
Problem types: cwe_id: CWE-120
description: Buffer overflow
Affected products: vendor: TB-eye Ltd.
product: XRN-410SN/TE
vendor: TB-eye Ltd.
product: XRN-810SN/TE
vendor: TB-eye Ltd.
product: XRN-1610SN/TE
vendor: TB-eye Ltd.
product: PRN-4011N/TE
vendor: TB-eye Ltd.
product: HRX-421FN/TE
vendor: TB-eye Ltd.
product: HRX-821/TE
vendor: TB-eye Ltd.
product: HRX-1621/TE
vendor: TB-eye Ltd.
product: HRX-435FN/TE
vendor: TB-eye Ltd.
product: HRX-835/TE
vendor: TB-eye Ltd.
product: HRX-1635/TE
vendor: TB-eye Ltd.
product: XRN-425SFN/TE
vendor: TB-eye Ltd.
product: XRN-426S
vendor: TB-eye Ltd.
product: XRN-820S/TE
vendor: TB-eye Ltd.
product: XRN-1620S/TE
vendor: TB-eye Ltd.
product: XRN-3210R/TE
vendor: TB-eye Ltd.
product: XRN-6410R/TE
vendor: TB-eye Ltd.
product: XRN-6410DR/TE
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2025-06-27T05:24:04.762Z
CVE-2025-41420 
A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WWBN
product: AVideo
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2025-07-24T15:11:00.461Z
CVE-2025-41421 Privilege Escalation via Symbolic Link Spoofing in TeamViewer Client
Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an attacker with local, unprivileged access to a device lacking adequate malware protection to escalate privileges by spoofing the update file path. This may result in unauthorized access to sensitive information.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: TeamViewer
product: Full Client
default_status: unaffected
vendor: TeamViewer
product: Host
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: @TwoSevenOneT (X) with ZeroSalarium.com
Published: 2025-10-01T13:48:38.754Z
CVE-2025-41423 Unauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Tobias Weisshaar (kun_19)
Published: 2025-04-24T06:50:12.214Z
CVE-2025-41425 DuraComm DP-10iN-100-MU Cross-site Scripting
DuraComm SPM-500 DP-10iN-100-MU

 is vulnerable to a cross-site scripting attack. This could allow an attacker to prevent legitimate users from accessing the web interface.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: DuraComm Corporation
product: SPM-500 DP-10iN-100-MU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Brandon Vincent of Arizona Public Service reported these vulnerabilities to CISA.
Published: 2025-07-22T21:38:45.479Z
CVE-2025-41426 Vertiv Liebert RDU101 and UNITY Stack-based Buffer Overflow
Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Vertiv
product: Liebert RDU101
default_status: unaffected
vendor: Vertiv
product: Liebert IS-UNITY
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Vera Mens of Claroty Team82 reported this these vulnerabilities to CISA.
Published: 2025-05-21T19:22:29.596Z
CVE-2025-41427 
WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-X3000GS
vendor: ELECOM CO.,LTD.
product: WRC-X3000GSA
vendor: ELECOM CO.,LTD.
product: WRC-X3000GSN
Published: 2025-06-24T04:37:09.818Z
CVE-2025-41428 
Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in TimeWorks 10.0 to 10.3. If exploited, arbitrary JSON files on the server may be viewed by a remote unauthenticated attacker.
Problem types: cwe_id: CWE-22
description: Improper limitation of a pathname to a restricted directory ('Path Traversal')
Affected products: vendor: Keiyo System Co., LTD
product: TimeWorks
Published: 2025-06-03T08:09:40.730Z
CVE-2025-41429 
a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session.
Problem types: cwe_id: CWE-117
description: Improper output neutralization for logs
Affected products: vendor: appleple inc.
product: a-blog cms
vendor: appleple inc.
product: a-blog cms
vendor: appleple inc.
product: a-blog cms
vendor: appleple inc.
product: a-blog cms
vendor: appleple inc.
product: a-blog cms
vendor: appleple inc.
product: a-blog cms
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: 2025-05-19T08:07:38.068Z
CVE-2025-41430 BIG-IP SSL Orchestrator vulnerability
When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: SSL Orchestrator
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:48.081Z
CVE-2025-41431 TMM Vulnerability
When connection mirroring is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate in the standby BIG-IP systems in a traffic group. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-05-07T22:04:11.279Z
CVE-2025-41432 arkcompiler_ets_runtime has an out-of-bounds write vulnerability
in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds write
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published: 2026-03-16T07:09:53.417Z
CVE-2025-41433 BIG-IP SIP ALG profile vulnerability
When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-05-07T22:04:09.139Z
CVE-2025-41436 Unauthorized access to archived channel content via threads interface
Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
baseScore: 3.1
Credits: lang: en
value: BhaRat (hackit_bharat)
Published: 2025-11-14T08:00:42.467Z
CVE-2025-41437 Reflected XSS
Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network Configuration Manager, Firewall Analyzer and OpUtils versions 128565 and below are vulnerable to Reflected XSS on the login page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ManageEngine
product: OpManager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Andrey Alekseev (Positive Technologies)
Published: 2025-06-09T10:44:08.879Z
CVE-2025-41438 Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default
The CS5000 Fire Panel is vulnerable due to a default account that exists
 on the panel. Even though it is possible to change this by SSHing into 
the device, it has remained unchanged on every installed system 
observed. This account is not root but holds high-level permissions that
 could severely impact the device's operation if exploited.
Problem types: cwe_id: CWE-1188
description: CWE-1188
Affected products: vendor: Consilium Safety
product: CS5000 Fire Panel
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Andrew Tierney of Pen Test Partners reported these vulnerabilities to CISA.
Published: 2025-05-29T23:17:18.012Z
CVE-2025-41439 
A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Ricoh Company, Ltd.
product: RICOH Streamline NX
Published: 2025-06-30T09:16:19.377Z
CVE-2025-41441 
Mailform Pro CGI prior to 4.3.4 generates error messages containing sensitive information, which may allow a remote unauthenticated attacker to obtain coupon codes. This vulnerability only affects products that use the coupon feature.
Problem types: cwe_id: CWE-209
description: Generation of error message containing sensitive information
Affected products: vendor: SYNCK GRAPHICA
product: Mailform Pro CGI
Published: 2025-05-26T06:27:12.284Z
CVE-2025-41442 Advantech iView Cross-site Scripting
A vulnerability exists in Advantech iView versions prior to 5.7.05 build
 7057, which could allow a reflected cross-site scripting (XSS) attack. 
By manipulating certain input parameters, an attacker could execute 
unauthorized scripts in the user's browser, potentially leading to 
information disclosure or other malicious activities.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Advantech
product: iView
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Alex Williams of Converge Technology Solutions reported these vulnerabilities to CISA.
Published: 2025-07-10T23:15:27.981Z
CVE-2025-41443 Guest user can discover active public channels
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
baseScore: 4.3
Credits: lang: en
value: lordwillmore
Published: 2025-10-16T08:10:40.582Z
CVE-2025-41444 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2025-06-09T11:14:58.186Z