rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-29014 WordPress FoodMenu <= 1.20 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects FoodMenu: from n/a through 1.20.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ZoomIt
product: FoodMenu
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
Published: 2025-08-14T10:34:31.546Z
CVE-2025-29015 
Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29017 
A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parameter within pages_view_client.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-10T00:00:00.000Z
CVE-2025-29018 
A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking System 2.0.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-09T00:00:00.000Z
CVE-2025-29029 
Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-29030 
Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-29031 
Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-29032 
Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2025-29033 
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-29036 
An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-29039 
An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29040 
An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29041 
An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29042 
An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the macaddr key value to the function 0x42232c
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29043 
An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x417234
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29044 
Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key value
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29045 
Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key value
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29046 
Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPSMinute3 key value
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29047 
Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hiddenIndex in the function StorageEditUser
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29049 
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-29058 
An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-29062 
An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead webservice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-02T00:00:00.000Z
CVE-2025-29063 
An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not handled properly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-02T00:00:00.000Z
CVE-2025-29064 
An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-03T00:00:00.000Z
CVE-2025-29069 
A heap buffer overflow vulnerability has been identified in the lcms2-2.16. The vulnerability exists in the UnrollChunkyBytes function in cmspack.c, which is responsible for handling color space transformations. NOTE: this is disputed by the Supplier because the finding identified a bug in a third-party calling program, not in lcms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-29070 
A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause a denial of service. NOTE: the Supplier disputes this because "this is not exploitable as this function is never called on normal color management, is there only as a helper for low-level programming and investigation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-29072 
An integer overflow in Nethermind Juno before v.12.05 within the Sierra bytecode decompression logic within the "cairo-lang-starknet-classes" library could allow remote attackers to trigger an infinite loop (and high CPU usage) by submitting a malicious Declare v2/v3 transaction. This results in a denial-of-service condition for affected Starknet full-node implementations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-29083 
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Plugin_Manager.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-23T00:00:00.000Z
CVE-2025-29084 
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrade.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-23T00:00:00.000Z
CVE-2025-29085 
SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-02T00:00:00.000Z
CVE-2025-29087 
In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer, and thus malloc may not allocate enough memory.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: SQLite
product: SQLite
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.2
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Published: 2025-04-07T00:00:00.000Z
CVE-2025-29088 
In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: SQLite
product: SQLite
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Published: 2025-04-10T00:00:00.000Z
CVE-2025-29089 
An issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain sensitive information
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-29093 
File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-04T00:00:00.000Z
CVE-2025-29094 
Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Marketing/Offers and Content/Pages components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-04T00:00:00.000Z
CVE-2025-29100 
Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the parameter list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-24T00:00:00.000Z
CVE-2025-29101 
Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29118 
Tenda AC8 V16.03.34.06 was discovered to contain a stack overflow via the src parameter in the function sub_47D878.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-19T00:00:00.000Z
CVE-2025-29121 
A vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality of the /goform/fast_setting_wifi_set file form_fast_setting_wifi_set. Using the timeZone parameter causes a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29135 
A stack-based buffer overflow vulnerability in Tenda AC7 V15.03.06.44 allows a remote attacker to execute arbitrary code through a stack overflow attack using the security parameter of the formWifiBasicSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-24T00:00:00.000Z
CVE-2025-29137 
Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which can cause RCE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-19T00:00:00.000Z
CVE-2025-29149 
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29150 
BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-10T00:00:00.000Z
CVE-2025-29152 
Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical Level Registration, Decision Level Registration, Perspective Registration, Company Group Registration, Company Registration, News Registration, Employee Editing, Goal Team Registration, Learning Resource Type Registration, Learning Resource Family Registration, Learning Resource Supplier Registration, and Cycle Maintenance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-07T00:00:00.000Z
CVE-2025-29153 
SQL Injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the Data export, filters functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-07T00:00:00.000Z
CVE-2025-29154 
HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted/solicitacao_treinamento/, .galera.app/rh/metas/perspectiva_estrategica/edicao/, .galera.app/rh/cadastros/perspectivas/listagem/adc/, .galera.app/escolaridade/listagem/, .galera.app/estados_civis/cadastro/, .galera.app/nivel_hierarquico/listagem/, .galera.app/nivel_decisorio/cadastro/, .galera.app/escolaridade/cadastro/, .galera.app/nivel_decisorio/listagem/, .galera.app/rh/cadastros/perspectivas/listagem/, .galera.app/empresas_grupo/cadastro/, .galera.app/empresas/edicao/, .galera.app/liais/listagem/, .galera.app/noticias/listagem/, .galera.app/gerenciamento-de-ciclo/abertura/cadastrar, .galera.app/colaborador/cadastro/cursos/adc/edicao/, .galera.app/colaborador/cadastro/adc/, .galera.app/cads_aux/escalact/, .galera.app/ncf/tec/cadastro/ct/ .galera.app/rh/metas/painel/, .galera.app/rh/metas/equipe/edicao/, .galera.app/rh/pdi/tipo_recursos/edicao/, .galera.app/rh/pdi/familia_recursos/cadastro/, .galera.app/rh/pdi/fornecedores/edicao/, and .galera.app/rh/pdi/recursos/cadastro/ components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-07T00:00:00.000Z
CVE-2025-29155 
An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-29156 
Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-29157 
An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page exposing sensitive information including the Servlet name (default) and server version
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-29165 
An issue in D-Link DIR-1253 MESH V1.6.1684 allows an attacker to escalate privileges via the etc/shadow.sample component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2025-29180 
In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are directly concatenated into SQL statements without filtering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29181 
FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-17T00:00:00.000Z
CVE-2025-29189 
Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-09T00:00:00.000Z
CVE-2025-29192 
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: FlowiseAI
product: Flowise
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Published: 2025-10-06T00:00:00.000Z
CVE-2025-29208 
CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-01T00:00:00.000Z
CVE-2025-29209 
TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2025-29213 
A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-15T00:00:00.000Z
CVE-2025-29214 
Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29215 
Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29217 
Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29218 
Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-29223 
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2025-29226 
In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2025-29227 
In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize"] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2025-29228 
Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-23T00:00:00.000Z
CVE-2025-29229 
linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-23T00:00:00.000Z
CVE-2025-29230 
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-21T00:00:00.000Z
CVE-2025-29231 
A stored cross-site scripting (XSS) vulnerability in the page_save component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hostname and domainName parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-16T00:00:00.000Z
CVE-2025-29266 
Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.
Problem types: cwe_id: CWE-289
description: CWE-289 Authentication Bypass by Alternate Name
Affected products: vendor: Unraid
product: Unraid
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.6
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-03-31T00:00:00.000Z
CVE-2025-29267 
SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the cid parameter in the GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-08T00:00:00.000Z
CVE-2025-29268 
ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-29269 
ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in the popen.cgi endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-04T00:00:00.000Z
CVE-2025-29270 
Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-31T00:00:00.000Z