rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-34222 Vasion Print (formerly PrinterLogic) Unauthenticated Admin APIs Used to Modify SSL Certificates
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose four admin routes – /admin/hp/cert_upload, /admin/hp/cert_delete, /admin/certs/ca, and /admin/certs/serviceclients/{scid} – without any authentication check. The routes are defined in the /var/www/app/routes/web.php file inside the printercloud/pi Docker container and are handled by the HPCertificateController class, which performs no user validation.  An unauthenticated attacker can therefore upload a new TLS/SSL certificate replacing the trusted root used by the appliance, delete an existing certificate causing immediate loss of trust for services that rely on it, or download any stored CA or client certificate via the service‑clients endpoint which also suffers an IDOR that allows enumeration of all client IDs. This vulnerability has been identified by the vendor as: V-2024-028 — Unauthenticated Admin APIs Used to Modify SSL Certificates.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:41:52.953Z
CVE-2025-34223 Vasion Print (formerly PrinterLogic) Insecure Installation Credentials
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation‑time endpoint at `/admin/query/update_database.php` that can be accessed without authentication. An attacker who can reach the installation web interface can POST arbitrary `root_user` and `root_password` values, causing the script to replace the default admin credentials with attacker‑controlled ones. The script also contains hard‑coded SHA‑512 and SHA‑1 hashes of the default password, allowing the attacker to bypass password‑policy validation. As a result, an unauthenticated remote attacker can obtain full administrative control of the system during the initial setup. This vulnerability has been identified by the vendor as: V-2024-022 — Insecure Installation Credentials.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:38:05.154Z
CVE-2025-34224 Vasion Print (formerly PrinterLogic) Unauthenticated Device Modification
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication.  An unauthenticated remote attacker can invoke these endpoints to re‑configure networked printers, add or delete RFID badge devices, or otherwise modify device settings. This vulnerability has been identified by the vendor as: V-2024-029 — No Authentication to Modify Devices.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:42:51.341Z
CVE-2025-34225 Vasion Print (formerly PrinterLogic) SSRF via console_release Directory
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `console_release` directory is reachable from the internet without any authentication.  Inside that directory are dozens of PHP scripts that build URLs from user‑controlled values and then invoke either 'curl_exec()` or `file_get_contents()` without proper validation. Although many files attempt to mitigate SSRF by calling `filter_var', the checks are incomplete. Because the endpoint is unauthenticated, any remote attacker can supply a hostname and cause the server to issue requests to internal resources. This enables internal network reconnaissance, potential pivoting, or data exfiltration. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:39:49.179Z
CVE-2025-34226 OpenPLC Runtime v3 Persistent DoS
OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate until a restart; on restart the runtime can fail to start because of corrupted database entries, resulting in persistent denial of service requiring complete rebase of the product to recover. This vulnerability was remediated by commit 095ee09.
Problem types: cwe_id: CWE-664
description: CWE-664 Improper Control of a Resource Through Its Lifetime
cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Autonomy Logic
product: OpenPLC Runtime
default_status: unaffected
Credits: lang: en
value: Eyodav (Mike G.A)
Published: 2025-10-03T15:36:03.516Z
CVE-2025-34227 Nagios XI < 2026R1 Configuration Wizard Authenticated Command Injection
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Nagios
product: Nagios XI
default_status: unaffected
Credits: lang: en
value: M. Cory Billington of theyhack.me
Published: 2025-09-25T17:08:52.921Z
CVE-2025-34228 Vasion Print (formerly PrinterLogic) SSRF via Lexmark update.php
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a server-side request forgery (SSRF) vulnerability. The `/var/www/app/console_release/lexmark/update.php` script is reachable from the internet without any authentication.  The PHP script builds URLs from user‑controlled values and then invokes either 'curl_exec()` or `file_get_contents()` without proper validation. Because the endpoint is unauthenticated, any remote attacker can supply a hostname and cause the server to issue requests to internal resources. This enables internal network reconnaissance, potential pivoting, or data exfiltration. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:41:29.156Z
CVE-2025-34229 Vasion Print (formerly PrinterLogic) Blind SSRF via HP installApp.php
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/hp/installApp.php script that can be exploited by an unauthenticated user. When a printer is registered, the software stores the printer’s host name in the variable $printer_vo->str_host_address. The code later builds a URL like 'http://<host‑address>:80/DevMgmt/DiscoveryTree.xml' and sends the request with curl. No validation, whitelist, or private‑network filtering is performed before the request is made. Because the request is blind, an attacker cannot see the data directly, but can still: probe internal services, trigger internal actions, or gather other intelligence. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:41:05.882Z
CVE-2025-34230 Vasion Print (formerly PrinterLogic) Blind SSRF via HP log_off_single_sign_on.php
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/hp/log_off_single_sign_on.php script that can be exploited by an unauthenticated user. When a printer is registered, the software stores the printer’s host name in the variable $printer_vo->str_host_address. The code later builds a URL like 'http://<host‑address>:80/DevMgmt/DiscoveryTree.xml' and sends the request with curl. No validation, whitelist, or private‑network filtering is performed before the request is made. Because the request is blind, an attacker cannot see the data directly, but can still: probe internal services, trigger internal actions, or gather other intelligence. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:40:39.074Z
CVE-2025-34231 Vasion Print (formerly PrinterLogic) SSRF via HP badgeSetup.php
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind and non-blind server-side request forgery (SSRF) vulnerability. The '/var/www/app/console_release/hp/badgeSetup.php' script is reachable from the Internet without any authentication and builds URLs from user‑controlled parameters before invoking either the custom processCurl() function or PHP’s file_get_contents(); in both cases the hostname/URL is taken directly from the request with no whitelist, scheme restriction, IP‑range validation, or outbound‑network filtering. Consequently, any unauthenticated attacker can force the server to issue arbitrary HTTP requests to internal resources. This enables internal network reconnaissance, credential leakage, pivoting, and data exfiltration. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:40:11.596Z
CVE-2025-34232 Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script that can be exploited by an unauthenticated user. When a printer is registered, the software stores the printer’s host name in the variable $printer_vo->str_host_address. The code later builds a URL like 'http://<host‑address>:80/DevMgmt/DiscoveryTree.xml' and sends the request with curl. No validation, whitelist, or private‑network filtering is performed before the request is made. Because the request is blind, an attacker cannot see the data directly, but can still: probe internal services, trigger internal actions, or gather other intelligence. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:34:00.950Z
CVE-2025-34233 Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a protection mechanism failure vulnerability within the file_get_contents() function. When an administrator configures a printer’s hostname (or similar callback field), the value is passed unchecked to PHP’s file_get_contents()/cURL functions, which follow redirects and impose no allow‑list, scheme, or IP‑range restrictions. An admin‑level attacker can therefore point the hostname to a malicious web server that issues a 301 redirect to internal endpoints such as the AWS EC2 metadata service. The server follows the redirect, retrieves the metadata, and returns or stores the credentials, enabling the attacker to steal cloud IAM keys, enumerate internal services, and pivot further into the SaaS infrastructure. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: description: CWE‑693 Protection Mechanism Failure
cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:38:49.403Z
CVE-2025-34234 Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlogic/printer-admin-api, and printercloud/pi). The keys are stored in clear text under /var/www/app/config/ as keyfile.ppk.dev and keyfile.saasid.ppk.dev. The application uses these keys as the symmetric secret for AES‑256‑CBC encryption/decryption of the “SaaS Id” (external identifier) through the getEncryptedExternalId() / getDecryptedExternalId() methods. Because the secret is embedded in the deployed image, any attacker who can obtain a copy of the Docker image, read the configuration files, or otherwise enumerate the filesystem can recover the encryption key. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard‑coded Cryptographic Key
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:34:45.051Z
CVE-2025-34235 Vasion Print (formerly PrinterLogic) Weak SSL/TLS Certificate Validation RCE
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (Windows client deployments) contain a registry key that can be enabled by administrators, causing the client to skip SSL/TLS certificate validation. An attacker who can intercept HTTPS traffic can then inject malicious driver DLLs, resulting in remote code execution with SYSTEM privileges; a local attacker can achieve local privilege escalation via a junction‑point DLL injection. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: Vasion
product: Print Virtual Appliance Host
default_status: unaffected
vendor: Vasion
product: Print Application
default_status: unaffected
Credits: lang: en
value: Pierre Barre
Published: 2025-09-29T20:44:01.002Z
CVE-2025-34236 Advantech WebAccess/VPN < 1.1.5 Stored XSS via NetworksController.addNetworkAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:39:40.112Z
CVE-2025-34237 Advantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:40:50.496Z
CVE-2025-34238 Advantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:43:35.153Z
CVE-2025-34239 Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:44:18.796Z
CVE-2025-34240 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:45:02.692Z
CVE-2025-34241 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:45:39.944Z
CVE-2025-34242 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:46:20.183Z
CVE-2025-34243 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Advantech
product: WebAccess/VPN
default_status: unaffected
Credits: lang: en
value: Alex Williams from Pellera Technologies
Published: 2025-11-06T19:47:04.733Z