rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-44000 
A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:49:39.469Z
CVE-2025-44001 Unauthorized Channel Subscription Read in Mattermost Confluence Plugin
Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Mattermost
product: Mattermost Confluence Plugin
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
baseSeverity: MEDIUM
baseScore: 4
Credits: lang: en
value: Lorenzo Gallegos
Published: 2025-08-11T18:56:57.280Z
CVE-2025-44002 Arbitrary File Creation via Symbolic Link leading to Denial-of-Service
Race Condition in the Directory Validation Logic in the TeamViewer Full Client and Host prior version 15.69 on Windows allows a local non-admin user to create arbitrary files with SYSTEM privileges, potentially leading to a denial-of-service condition, via symbolic link manipulation during directory verification.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: TeamViewer
product: Full Client
default_status: unaffected
vendor: TeamViewer
product: Host
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Trend Micro Zero Day Initiative
Published: 2025-08-26T11:05:22.270Z
CVE-2025-44003 
Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perform a limited denial of service when 125 kHz Card Technology is enabled.

This issue affects T-Series Readers: 9.20 prior to vCR9.20.250213a (distributed in 9.20.1827 (MR2)), 9.10 prior to vCR9.10.250213a (distributed in 9.10.2692(MR5)), 9.00 prior to vCR9.00.250619a (distributed in  vEL9.00.3371 (MR7)),  all versions of 8.90 and prior.
Problem types: cwe_id: CWE-772
description: CWE-772 Missing Release of Resource after Effective Lifetime
Affected products: vendor: Gallagher
product: T-Series Readers
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-07-10T03:09:43.640Z
CVE-2025-44004 Unauthenticated Channel Subscription Creation in Mattermost Confluence Plugin
Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Mattermost
product: Mattermost Confluence Plugin
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
baseSeverity: HIGH
baseScore: 7.2
Credits: lang: en
value: Lorenzo Gallegos
Published: 2025-08-11T18:56:58.269Z
CVE-2025-44005 
An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: smallstep
product: Step-CA
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 10
baseSeverity: CRITICAL
Credits: lang: en
value: Stephen Kubik of the Cisco Advanced Security Initiatives Group (ASIG)
Published: 2025-12-17T15:16:16.495Z
CVE-2025-44006 Qsync Central
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:08:57.826Z
CVE-2025-44007 Qsync Central
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:05.407Z
CVE-2025-44008 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:12.168Z
CVE-2025-44009 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:19.789Z
CVE-2025-44010 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:26.964Z
CVE-2025-44011 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:38.293Z
CVE-2025-44012 Qsync Central
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:44.519Z
CVE-2025-44013 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-01-02T14:52:34.169Z
CVE-2025-44014 Qsync Central
An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:09:51.496Z
CVE-2025-44015 HybridDesk Station
A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.18 and later
Problem types: cwe_id: CWE-77
description: CWE-77
cwe_id: CWE-78
description: CWE-78
Affected products: vendor: QNAP Systems Inc.
product: HybridDesk Station
default_status: unaffected
Credits: lang: en
value: Dohwan Kim, Junwoo Kwon (neko_hat, wnsdn1583 from Chung-Ang Univ.)
Published: 2025-08-29T17:17:15.478Z
CVE-2025-44016 File Hash Validation Bypass in NomadBranch.exe
A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to bypass file integrity validation via a crafted request. By providing a valid hash for a malicious file, an attacker can cause the service to incorrectly validate and process the file as trusted, enabling arbitrary code execution under the Nomad Branch service context.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: TeamViewer
product: DEX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Threat Hunt Team of Bank of America
Published: 2025-12-11T11:24:37.520Z
CVE-2025-44017 
"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT (JSON Web Token).
Problem types: cwe_id: CWE-201
description: Insertion of sensitive information into sent data
Affected products: vendor: Gunosy Inc.
product: "Gunosy" App for Android
vendor: Gunosy Inc.
product: "Gunosy" App for iOS
Published: 2025-09-02T07:41:47.056Z
CVE-2025-44018 
A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: GL-Inet
product: GL-AXT1800
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Lilith &gt;_&gt; of Cisco Talos.
Published: 2025-11-24T15:11:02.641Z
CVE-2025-44019 AVEVA PI Data Archive Uncaught Exception
AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if 
exploited, could allow an authenticated user to shut down certain 
necessary PI Data Archive subsystems, resulting in a denial of service. 
Depending on the timing of the crash, data present in snapshots/write 
cache may be lost.
Problem types: cwe_id: CWE-248
description: CWE-248
Affected products: vendor: AVEVA
product: PI Data Archive
default_status: unaffected
vendor: AVEVA
product: PI Data Archive
default_status: unaffected
vendor: AVEVA
product: PI Data Archive
default_status: unaffected
vendor: AVEVA
product: PI Server
default_status: unaffected
vendor: AVEVA
product: PI Server
default_status: unaffected
vendor: AVEVA
product: PI Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: AVEVA reported these vulnerabilities to CISA.
Published: 2025-06-12T19:51:56.663Z
CVE-2025-44021 
OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as a node owner can provide a path to any local file (readable by ironic-conductor), which may then be written to the target node disk. This is difficult to exploit in practice, because a node deployed in this manner should never reach the ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled. The fixed versions are 24.1.3, 26.1.1, and 29.0.1.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: OpenStack
product: Ironic
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 2.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Published: 2025-05-08T00:00:00.000Z
CVE-2025-44022 
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2025-44023 
An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the account_mgr.cgi->cgi_chg_admin_pw components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-44024 
Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-44033 
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-29T00:00:00.000Z
CVE-2025-44034 
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-16T00:00:00.000Z
CVE-2025-44039 
CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive information without any authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-44040 
An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication decisions may be made via PHP loose-equality comparisons if a specific MD5 value is present in the credential store. NOTE: this is disputed by the Supplier because an adversary has no way to place the specific MD5 value into the credential store (unless they already have full privileges) and because the specific MD5 value would not realistically be present otherwise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-21T00:00:00.000Z
CVE-2025-44043 
Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory value when making POST requests to the affected components. In doing so an attacker can get the SearchUnit server to read and write configuration and log files from/to the attackers server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-10T00:00:00.000Z
CVE-2025-44044 
Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-10T00:00:00.000Z
CVE-2025-44071 
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-44072 
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-44073 
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-06T00:00:00.000Z
CVE-2025-44074 
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-05T00:00:00.000Z
CVE-2025-44083 
An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-21T00:00:00.000Z
CVE-2025-44084 
D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-20T00:00:00.000Z
CVE-2025-44091 
yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-12T00:00:00.000Z
CVE-2025-44108 
A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-19T00:00:00.000Z
CVE-2025-44109 
A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-23T00:00:00.000Z
CVE-2025-44110 
FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-44115 
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-02T00:00:00.000Z
CVE-2025-44134 
A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php. Manipulation of parameter class will lead to SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-24T00:00:00.000Z
CVE-2025-44135 
A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php. Manipulating the parameter username will cause SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-24T00:00:00.000Z
CVE-2025-44136 
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z