rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-14304 ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure
Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd. has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.
Problem types: cwe_id: CWE-693
description: CWE-693 Protection Mechanism Failure
Affected products: vendor: ASRock
product: Intel 500 chipset motherboard
default_status: unaffected
vendor: ASRockRack
product: Intel 500 chipset motherboard
default_status: unaffected
vendor: ASRockInd
product: Intel 500 chipset motherboard
default_status: unaffected
vendor: ASRock
product: Intel 600 chipset motherboard
default_status: unaffected
vendor: ASRockRack
product: Intel 600 chipset motherboard
default_status: unaffected
vendor: ASRockInd
product: Intel 600 chipset motherboard
default_status: unaffected
vendor: ASRock
product: Intel 700 chipset motherboard
default_status: unaffected
vendor: ASRockRack
product: Intel 700 chipset motherboard
default_status: unaffected
vendor: ASRockInd
product: Intel 700 chipset motherboard
default_status: unaffected
vendor: ASRock
product: Intel 800 chipset motherboard
default_status: unaffected
vendor: ASRockRack
product: Intel 800 chipset motherboard
default_status: unaffected
vendor: ASRockInd
product: Intel 800 chipset motherboard
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-12-17T03:23:24.677Z
CVE-2025-14305 Acer｜ListCheck.exe - Local Privilege Escalation
ListCheck.exe developed by Acer has a Local Privilege Escalation vulnerability. Authenticated local attackers can replace ListCheck.exe with a malicious executable of the same name, which will be executed by the system and result in privilege escalation.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Acer
product: ListCheck.exe
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-12-17T03:30:05.509Z
CVE-2025-14306 Directory Traversal in Robocode's CacheCleaner Component
A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Robocode Project
product: Robocode
default_status: unknown
Credits: lang: en
value: titancaproject@gmail.com
Published: 2025-12-09T07:19:29.686Z
CVE-2025-14307 Insecure Temporary File Creation in Robocode's AutoExtract Component
An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.
Problem types: cwe_id: CWE-377
description: CWE-377
Affected products: vendor: Robocode Project
product: Robocode
default_status: unaffected
Credits: lang: en
value: titancaproject@gmail.com
Published: 2025-12-09T07:29:52.225Z
CVE-2025-14308 Integer Overflow in Robocode's Buffer Write Method
An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overflows and arbitrary code execution. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the data length, leading to potential unauthorized code execution.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Robocode Project
product: Robocode
default_status: unaffected
Credits: lang: en
value: titancaproject@gmail.com
Published: 2025-12-09T07:44:34.003Z
CVE-2025-14309 
NULL Pointer Dereference vulnerability in ravynsoft ravynos.This issue affects ravynos: through 0.5.2.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: ravynsoft
product: ravynos
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-12-09T07:49:48.786Z
CVE-2025-14310 
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb.This issue affects rethinkdb: before 2.4.4.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: rethinkdb
product: rethinkdb
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-12-09T07:54:05.255Z
CVE-2025-14311 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in JMRI.This issue affects JMRI: before 5.13.3.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: JMRI
product: JMRI
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2025-12-09T07:56:34.477Z
CVE-2025-14312 Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via counter
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Advance WP Query Search Filter
default_status: unknown
Credits: lang: en
value: Yevgen Goncharuk
lang: en
value: WPScan
Published: 2025-12-30T06:00:03.998Z
CVE-2025-14313 Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Advance WP Query Search Filter
default_status: unknown
Credits: lang: en
value: Yevgen Goncharuk
lang: en
value: WPScan
Published: 2025-12-30T06:00:04.941Z
CVE-2025-14314 WordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Injection.This issue affects PopupKit: from n/a through <= 2.1.5.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Roxnor
product: PopupKit
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: 0xd4rk5id3 | Patchstack Bug Bounty Program
Published: 2025-12-18T07:21:40.676Z
CVE-2025-14316 AhaChat Messenger Marketing <= 1.1 - Reflected XSS
The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: AhaChat Messenger Marketing
default_status: unknown
Credits: lang: en
value: Yevgen Goncharuk
lang: en
value: WPScan
Published: 2026-01-26T06:00:13.528Z
CVE-2025-14317 User Enumeration in Crazy Bubble Tea mobile application
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data.


This issue was fixed in version 915 (Android) and 7.4.1 (iOS).
Problem types: cwe_id: CWE-359
description: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected products: vendor: Emaintenance
product: Crazy Bubble Tea
default_status: unaffected
vendor: Emaintenance
product: Crazy Bubble Tea
default_status: unaffected
Credits: lang: en
value: Tobiasz „Palidon” Kostrzewa
Published: 2026-01-14T13:28:02.872Z
CVE-2025-14318 Improper access validation in M-Files Server
Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module being enabled.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: M-Files Corporation
product: M-Files Server
default_status: unaffected
Published: 2025-12-18T07:32:34.230Z
CVE-2025-14320 XSS in Tegsoft's Online Support Application
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited Company Online Support Application allows Reflected XSS.

This issue affects Online Support Application: from V3 through 31122025.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: Tegsoft Management and Information Services Trade Limited Company
product: Online Support Application
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Selay YURDAGÜL
Published: 2026-05-04T07:41:35.813Z
CVE-2025-14321 Use-after-free in the WebRTC: Signaling component
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Igor Morgenstern
Published: 2025-12-09T13:37:53.872Z
CVE-2025-14322 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Oskar L
Published: 2025-12-09T13:37:55.159Z
CVE-2025-14323 Privilege escalation in the DOM: Notifications component
Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: tiebuchen
Published: 2025-12-09T13:37:56.358Z
CVE-2025-14324 JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Lingming Zhang
Published: 2025-12-09T13:37:57.533Z
CVE-2025-14325 JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: zx
Published: 2025-12-09T13:37:58.843Z
CVE-2025-14326 Use-after-free in the Audio/Video: GMP component
Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrew McCreight
Published: 2025-12-09T13:38:00.695Z
CVE-2025-14327 Spoofing issue in the Downloads Panel component
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Caro Kann
Published: 2025-12-09T13:38:02.260Z
CVE-2025-14328 Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Ameen Basha M K
Published: 2025-12-09T13:38:03.509Z
CVE-2025-14329 Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: satrya wira yudha
Published: 2025-12-09T13:38:04.796Z
CVE-2025-14330 JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Rong Bao
Published: 2025-12-09T13:38:05.995Z
CVE-2025-14331 Same-origin policy bypass in the Request Handling component
Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Igor Morgenstern
Published: 2025-12-09T13:38:07.191Z
CVE-2025-14332 Memory safety bugs fixed in Firefox 146 and Thunderbird 146
Memory safety bugs present in Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Jon Coppeard, Maurice Dauer and the Mozilla Fuzzing Team
Published: 2025-12-09T13:38:08.758Z
CVE-2025-14333 Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Maurice Dauer and the Mozilla Fuzzing Team
Published: 2025-12-09T13:38:09.979Z
CVE-2025-14334 itsourcecode Student Management System new_adviser.php sql injection
A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: shaww (VulDB User)
Published: 2025-12-09T18:32:07.612Z
CVE-2025-14335 itsourcecode Student Management System new_school_year.php sql injection
A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_school_year.php. The manipulation of the argument sy leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: shaww (VulDB User)
Published: 2025-12-09T19:02:07.412Z
CVE-2025-14336 itsourcecode Student Management System promote.php sql injection
A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The manipulation of the argument sy results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: shaww (VulDB User)
Published: 2025-12-09T19:02:10.154Z
CVE-2025-14337 itsourcecode Student Management System new_grade.php sql injection
A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the argument grade causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: shaww (VulDB User)
Published: 2025-12-09T19:32:08.304Z
CVE-2025-14338 Polkit authentication dis isabled by default in inputplumber
Polkit authentication dis isabled by default and a race
condition in the Polkit authorization check in versions before v0.69.0 can
lead to the same issues as in CVE-2025-66005.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: https://github.com/ShadowBlip
product: inputplumber
default_status: unaffected
Credits: lang: en
value: Matthias Gerstner of SUSE
Published: 2026-01-14T11:55:31.845Z
CVE-2025-14339 weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: wedevs
product: weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Angus Girvan
Published: 2026-02-21T09:27:59.721Z
CVE-2025-14340 Admin Account Takeover via malicious URL payload
Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Payara Platform
product: Payara Server
default_status: unaffected
Credits: lang: en
value: Camilo G. AkA Dédalo [https://x.com/SeguridadBlanca] (DeepSecurity Perú - [https://www.deepsecurity.pe])
Published: 2026-02-18T13:39:11.316Z
CVE-2025-14341 Input Data Manipulation in DivvyDrive Information Technologies' DivvyDrive
Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Excessive Allocation, Flooding.

This issue affects DivvyDrive: from 4.8.2.19 before 4.8.3.2.
Problem types: cwe_id: CWE-915
description: CWE-915 Improperly controlled modification of Dynamically-Determined object attributes
cwe_id: CWE-770
description: CWE-770 Allocation of resources without limits or throttling
Affected products: vendor: DivvyDrive Information Technologies Inc.
product: DivvyDrive
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Credits: lang: en
value: Çağatay CEYHAN
Published: 2026-05-07T13:13:47.291Z