rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-27510 RCE in the package conda-forge-metadata
conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
Problem types: cwe_id: CWE-829
description: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: conda-forge
product: conda-forge-metadata
Published: 2025-03-04T21:48:12.688Z
CVE-2025-27512 Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods
Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory.
Problem types: cwe_id: CWE-783
description: CWE-783: Operator Precedence Logic Error
cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: coreos
product: zincati
Published: 2025-03-17T14:46:28.219Z
CVE-2025-27513 OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package
OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: open-telemetry
product: opentelemetry-dotnet
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-03-05T18:12:25.867Z
CVE-2025-27514 GLPI is susceptible to Stored XSS attack through project's kanban
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project's kanban. This is fixed in version 10.0.19.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: glpi-project
product: glpi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-07-29T17:39:28.813Z
CVE-2025-27515 Laravel has a File Validation Bypass
Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
Problem types: cwe_id: CWE-155
description: CWE-155: Improper Neutralization of Wildcards or Matching Symbols
Affected products: vendor: laravel
product: framework
Published: 2025-03-05T18:45:50.101Z
CVE-2025-27516 Jinja sandbox breakout through attr filter selecting format method
Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
Problem types: cwe_id: CWE-1336
description: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: pallets
product: jinja
Published: 2025-03-05T20:40:06.568Z
CVE-2025-27517 Volt Allows RCE Via User-Crafted Requests
Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: livewire
product: volt
Published: 2025-03-05T19:11:38.280Z
CVE-2025-27518 Cognita CORS misconfiguration in backend API server
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS configuration in the Cognita backend server allows arbitrary websites to send cross site requests to the application. This vulnerability is fixed in commit 75079c3d3cf376381489b9a82ee46c69024e1a15.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: truefoundry
product: cognita
Published: 2025-03-07T15:36:48.366Z
CVE-2025-27519 Cognita Arbitrary File Write
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. A path traversal issue exists at /v1/internal/upload-to-local-directory which is enabled when the Local env variable is set to true, such as when Cognita is setup using Docker. Because the docker environment sets up the backend uvicorn server with auto reload enabled, when an attacker overwrites the /app/backend/__init__.py file, the file will automatically be reloaded and executed. This allows an attacker to get remote code execution in the context of the Docker container. This vulnerability is fixed in commit a78bd065e05a1b30a53a3386cc02e08c317d2243.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: truefoundry
product: cognita
Published: 2025-03-07T15:36:34.819Z
CVE-2025-27520 BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: bentoml
product: BentoML
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-04-04T14:28:51.574Z
CVE-2025-27521 
Vulnerability of improper access permission in the process management module
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Problem types: cwe_id: CWE-280
description: CWE-280 Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-03-04T07:13:32.851Z
CVE-2025-27522 Apache InLong: JDBC Vulnerability during verification processing
Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.

[1] 

 https://github.com/apache/inlong/pull/11732
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Credits: lang: en
value: yulate
lang: en
value: m4x
Published: 2025-05-28T08:06:04.191Z
CVE-2025-27523 XXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager
XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: Hitachi
product: JP1/IT Desktop Management 2 - Smart Device Manager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2025-05-15T06:22:09.764Z
CVE-2025-27524 Weak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager
Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
Problem types: cwe_id: CWE-326
description: CWE-326 Inadequate Encryption Strength
Affected products: vendor: Hitachi
product: JP1/IT Desktop Management 2 - Smart Device Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-05-15T06:27:32.686Z
CVE-2025-27525 Information Exposure vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager
Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06.
Problem types: cwe_id: CWE-525
description: CWE-525 Use of Web Browser Cache Containing Sensitive Information
Affected products: vendor: Hitachi
product: JP1/IT Desktop Management 2 - Smart Device Manager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:L
version: 3.1
Published: 2025-05-15T06:45:58.849Z
CVE-2025-27526 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass
Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can lead to JDBC Vulnerability URLEncdoe and backspace bypass. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/11747
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Credits: lang: en
value: yulate
lang: en
value: m4x
lang: en
value: h3h3qaq
Published: 2025-05-28T08:07:35.440Z
CVE-2025-27528 Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read
Deserialization of Untrusted Data vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.13.0 through 2.1.0. 

This
vulnerability allows attackers to bypass the security mechanisms of InLong
JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/11747
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Credits: lang: en
value: yulat
lang: en
value: m4x
lang: en
value: h3h3qaq
Published: 2025-05-28T08:12:27.609Z
CVE-2025-27531 Apache InLong: An arbitrary file read vulnerability for JDBC
Deserialization of Untrusted Data vulnerability in Apache InLong. 

This issue affects Apache InLong: from 1.13.0 before 2.1.0, 

this issue would allow an authenticated attacker to read arbitrary files by double writing the param.





Users are recommended to upgrade to version 2.1.0, which fixes the issue.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Credits: lang: en
value: Ming
Published: 2025-06-06T14:55:28.516Z
CVE-2025-27532 
A vulnerability in the “Backup & Restore” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to access secret information via multiple crafted HTTP requests.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Bosch Rexroth AG
product: ctrlX OS - Device Admin
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-04-30T11:49:02.687Z
CVE-2025-27533 Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.

During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.
This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.

Users are recommended to upgrade to version 6.1.6+, 5.19.0+,  5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.

Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Problem types: cwe_id: CWE-789
description: CWE-789 Memory Allocation with Excessive Size Value
Affected products: vendor: Apache Software Foundation
product: Apache ActiveMQ
default_status: unaffected
Published: 2025-05-07T08:59:00.249Z
CVE-2025-27534 arkcompiler_ets_runtime has an out-of-bounds read vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-04-07T02:35:54.626Z
CVE-2025-27535 
Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare Metal OS may allow a denial of service. System software adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Problem types: description: Denial of Service
cwe_id: CWE-782
description: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: n/a
product: Intel(R) Ethernet Connection E825-C.
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2026-02-10T16:25:24.509Z
CVE-2025-27536 arkcompiler_ets_runtime has a type confusion vulnerability
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-08-11T02:55:12.410Z
CVE-2025-27537 
Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Edge Orchestrator software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
Published: 2025-08-12T16:59:28.501Z
CVE-2025-27538 MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users
Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: 0x7oda7123
Published: 2025-04-16T07:45:01.229Z
CVE-2025-27539 
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'VerifyUser' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.  (ZDI-CAN-25914)
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: TeleControl Server Basic
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2025-04-16T17:37:24.315Z
CVE-2025-27540 
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'Authenticate' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25913)
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: TeleControl Server Basic
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2025-04-16T17:37:25.783Z