rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-13782 taosir WTCMS SlideController SlideController.class.php delete sql injection
A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file application/Admin/Controller/SlideController.class.php of the component SlideController. The manipulation of the argument ids leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: taosir
product: WTCMS
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: sT1TcH (VulDB User)
Published: 2025-11-30T03:02:08.567Z
CVE-2025-13783 taosir WTCMS CommentadminController CommentadminController.class.php delete sql injection
A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument ids results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: taosir
product: WTCMS
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sT1TcH (VulDB User)
Published: 2025-11-30T06:02:08.577Z
CVE-2025-13784 yungifez Skuul School Management System SVG File edit cross site scripting
A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1/edit of the component SVG File Handler. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: yungifez
product: Skuul School Management System
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Zeeshan Khan (VulDB User)
Published: 2025-11-30T07:02:05.901Z
CVE-2025-13785 yungifez Skuul School Management System Image profile information disclosure
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: yungifez
product: Skuul School Management System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Zeeshan Khan (VulDB User)
Published: 2025-11-30T07:32:05.160Z
CVE-2025-13786 taosir WTCMS index.php fetch code injection
A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: taosir
product: WTCMS
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: sT1TcH (VulDB User)
Published: 2025-11-30T09:02:05.334Z
CVE-2025-13787 ZenTao File control.php delete privileges management
A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/file/control.php of the component File Handler. Executing manipulation of the argument fileID can lead to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 21.7.7 is sufficient to fix this issue. You should upgrade the affected component.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: n/a
product: ZenTao
CVSS v3.1: version: 3.1
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: ez-lbz (VulDB User)
Published: 2025-11-30T10:32:08.651Z
CVE-2025-13788 Chanjet CRM upgradeattribute.php sql injection
A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Chanjet
product: CRM
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: HALA (VulDB User)
Published: 2025-11-30T12:32:05.610Z
CVE-2025-13789 ZenTao model.php makeRequest server-side request forgery
A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model.php. The manipulation of the argument Base results in server-side request forgery. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 21.7.6 mitigates this issue. It is suggested to upgrade the affected component.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: n/a
product: ZenTao
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: ez-lbz (VulDB User)
Published: 2025-11-30T13:32:16.964Z
CVE-2025-13790 Scada-LTS cross-site request forgery
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: n/a
product: Scada-LTS
cpes: cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err02 (VulDB User)
lang: en
value: VulDB
Published: 2025-11-30T14:32:06.199Z
CVE-2025-13791 Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: n/a
product: Scada-LTS
cpes: cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err02 (VulDB User)
lang: en
value: VulDB
Published: 2025-11-30T15:32:05.524Z
CVE-2025-13792 Qualitor getResumo.php eval code injection
A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento/request/getResumo.php. Performing a manipulation of the argument passageiros results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. Upgrading to version 8.20.105 and 8.24.98 addresses this issue. Upgrading the affected component is advised.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: n/a
product: Qualitor
cpes: cpe:2.3:a:qualitor:qualitor:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: mtzsec (VulDB User)
lang: en
value: Dante Michelon (VulDB User)
Published: 2025-11-30T16:02:05.632Z
CVE-2025-13793 winston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting
A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown functionality of the file /includes/header_menu.php of the component GET Parameter Handler. Executing manipulation of the argument Error can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: winston-dsouza
product: Ecommerce-Website
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: dream123 (VulDB User)
Published: 2025-11-30T17:02:06.228Z
CVE-2025-13794 Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: themeisle
product: Auto Featured Image (Auto Post Thumbnail)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Dmitrii Ignatyev
Published: 2025-12-16T05:25:19.785Z
CVE-2025-13795 codingWithElias School Management System Edit Student Info student-view.php cross site scripting
A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of the file /student-view.php of the component Edit Student Info Page. This manipulation of the argument First Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: codingWithElias
product: School Management System
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Al1ce258 (VulDB User)
Published: 2025-11-30T23:02:06.304Z
CVE-2025-13796 deco-cx apps Parameter analyticsScript.ts AnalyticsScript server-side request forgery
A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.120.2 addresses this issue. It is suggested to upgrade the affected component.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery
Affected products: vendor: deco-cx
product: apps
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: cucumbersalad (VulDB User)
lang: en
value: cucumbersalad (VulDB User)
Published: 2025-11-30T23:32:06.222Z
CVE-2025-13797 ADSLR B-QE2W401 send_order.cgi parameterdel_swifimac command injection
A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. Affected by this issue is the function parameterdel_swifimac of the file /send_order.cgi. Performing manipulation of the argument del_swifimac results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ADSLR
product: B-QE2W401
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 2er00ne (VulDB User)
Published: 2025-12-01T00:02:06.184Z
CVE-2025-13798 ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_add command injection
A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. This affects the function ap_macfilter_add of the file /send_order.cgi. Executing manipulation of the argument mac can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ADSLR
product: NBR1005GPEV2
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 2er00ne (VulDB User)
Published: 2025-12-01T00:32:06.723Z
CVE-2025-13799 ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injection
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ADSLR
product: NBR1005GPEV2
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 2er00ne (VulDB User)
Published: 2025-12-01T01:02:05.859Z
CVE-2025-13800 ADSLR NBR1005GPEV2 send_order.cgi set_mesh_disconnect command injection
A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: ADSLR
product: NBR1005GPEV2
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 2er00ne (VulDB User)
Published: 2025-12-01T01:32:05.993Z
CVE-2025-13801 Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: yocoadmin
product: Yoco Payments
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: NumeX
Published: 2026-01-07T09:21:02.177Z
CVE-2025-13802 jairiidriss RestaurantWebsite Make a Reservation cross site scripting
A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown function of the component Make a Reservation. This manipulation of the argument selected_date causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: jairiidriss
product: RestaurantWebsite
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: dream123 (VulDB User)
Published: 2025-12-01T02:02:05.975Z
CVE-2025-13803 MediaCrush Header paths.py http headers for scripting syntax
A vulnerability was identified in MediaCrush 1.0.0/1.0.1. The affected element is an unknown function of the file /mediacrush/paths.py of the component Header Handler. Such manipulation of the argument Host leads to improper neutralization of http headers for scripting syntax. The attack can be launched remotely.
Problem types: cwe_id: CWE-644
description: Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: n/a
product: MediaCrush
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: lakshay12311 (VulDB User)
Published: 2025-12-01T02:32:05.624Z
CVE-2025-13804 nutzam NutzBoot Ethereum Wallet EthModule.java information disclosure
A security flaw has been discovered in nutzam NutzBoot up to 2.6.0-SNAPSHOT. The impacted element is an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Ethereum Wallet Handler. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: nutzam
product: NutzBoot
cpes: cpe:2.3:a:nutzam:nutzboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sh7err03 (VulDB User)
Published: 2025-12-01T03:02:07.501Z
CVE-2025-13805 nutzam NutzBoot LiteRpc-Serializer HttpServletRpcEndpoint.java getInputStream deserialization
A weakness has been identified in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This affects the function getInputStream of the file nutzcloud/nutzcloud-literpc/src/main/java/org/nutz/boot/starter/literpc/impl/endpoint/http/HttpServletRpcEndpoint.java of the component LiteRpc-Serializer. Executing a manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-502
description: Deserialization
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: nutzam
product: NutzBoot
cpes: cpe:2.3:a:nutzam:nutzboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: sh7err03 (VulDB User)
Published: 2025-12-01T03:32:06.023Z
CVE-2025-13806 nutzam NutzBoot Transaction API EthModule.java improper authorization
A security vulnerability has been detected in nutzam NutzBoot up to 2.6.0-SNAPSHOT. This impacts an unknown function of the file nutzboot-demo/nutzboot-demo-simple/nutzboot-demo-simple-web3j/src/main/java/io/nutz/demo/simple/module/EthModule.java of the component Transaction API. The manipulation of the argument from/to/wei leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-285
description: Improper Authorization
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: nutzam
product: NutzBoot
cpes: cpe:2.3:a:nutzam:nutzboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: sh7err03 (VulDB User)
Published: 2025-12-01T04:02:06.300Z