rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-15329 Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
Problem types: cwe_id: CWE-201
description: Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Tanium
product: Threat Response
cpes: cpe:2.3:a:tanium:service_threatresponse:4.5.249:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.6.517:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.9.296:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published: 2026-02-05T18:23:27.646Z
CVE-2025-15330 Tanium addressed an improper input validation vulnerability in Deploy.
Tanium addressed an improper input validation vulnerability in Deploy.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Tanium
product: Deploy
cpes: cpe:2.3:a:tanium:service_deploy:2.26.1278:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_deploy:2.30.174:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: 2026-02-05T18:24:27.066Z
CVE-2025-15331 Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
Problem types: cwe_id: CWE-459
description: Incomplete Cleanup
Affected products: vendor: Tanium
product: Connect
cpes: cpe:2.3:a:tanium:service_connect:5.22.99:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_connect:5.26.86:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: 2026-02-05T18:23:51.939Z
CVE-2025-15332 Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
Problem types: cwe_id: CWE-532
description: Insertion of Sensitive Information into Log File
Affected products: vendor: Tanium
product: Threat Response
cpes: cpe:2.3:a:tanium:service_threatresponse:4.5.249:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.6.517:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.9.296:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published: 2026-02-05T18:22:45.788Z
CVE-2025-15333 Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Threat Response
cpes: cpe:2.3:a:tanium:service_threatresponse:4.5.265:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.6.535:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.9.323:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Filip Waeytens
lang: en
value: Frank Lycops
lang: en
value: Jean-Michel Huguet
lang: en
value: Jorge Escabias
lang: en
value: Justin Hocquel from NCIA/NCSC
Published: 2026-02-05T18:20:14.854Z
CVE-2025-15334 Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Threat Response
cpes: cpe:2.3:a:tanium:service_threatresponse:4.5.265:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.6.535:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.9.323:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Filip Waeytens
lang: en
value: Frank Lycops
lang: en
value: Jean-Michel Huguet
lang: en
value: Jorge Escabias
lang: en
value: Justin Hocquel from NCIA/NCSC
Published: 2026-02-05T18:18:04.149Z
CVE-2025-15335 Tanium addressed an information disclosure vulnerability in Threat Response.
Tanium addressed an information disclosure vulnerability in Threat Response.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Threat Response
cpes: cpe:2.3:a:tanium:service_threatresponse:4.5.265:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.6.535:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_threatresponse:4.9.323:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Filip Waeytens
lang: en
value: Frank Lycops
lang: en
value: Jean-Michel Huguet
lang: en
value: Jorge Escabias
lang: en
value: Justin Hocquel at NCIA/NCSC
Published: 2026-02-05T18:17:28.244Z
CVE-2025-15336 Tanium addressed an incorrect default permissions vulnerability in Performance.
Tanium addressed an incorrect default permissions vulnerability in Performance.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Performance
cpes: cpe:2.3:a:tanium:service_performance:1.17.133:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_performance:1.21.140:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_performance:1.22.287:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:16:28.770Z
CVE-2025-15337 Tanium addressed an incorrect default permissions vulnerability in Patch.
Tanium addressed an incorrect default permissions vulnerability in Patch.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Patch
cpes: cpe:2.3:a:tanium:service_patch:3.17.2299:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_patch:3.19.231:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_patch:3.24.136:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:16:28.498Z
CVE-2025-15338 Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
Tanium addressed an incorrect default permissions vulnerability in Partner Integration.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Partner Integration
cpes: cpe:2.3:a:tanium:service_partnerintegration:1.0.223:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_partnerintegration:1.2.32:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_partnerintegration:1.3.39:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:16:28.993Z
CVE-2025-15339 Tanium addressed an incorrect default permissions vulnerability in Discover.
Tanium addressed an incorrect default permissions vulnerability in Discover.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Discover
cpes: cpe:2.3:a:tanium:service_discover:4.10.117:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:16:29.455Z
CVE-2025-15340 Tanium addressed an incorrect default permissions vulnerability in Comply.
Tanium addressed an incorrect default permissions vulnerability in Comply.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Comply
cpes: cpe:2.3:a:tanium:service_comply:2.24.158:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_comply:2.29.123:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_comply:2.32.154:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:16:29.226Z
CVE-2025-15341 Tanium addressed an incorrect default permissions vulnerability in Benchmark.
Tanium addressed an incorrect default permissions vulnerability in Benchmark.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Benchmark
cpes: cpe:2.3:a:tanium:service_benchmark:2.7.97:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_benchmark:2.9.187:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_benchmark:2.12.81:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:16:29.666Z
CVE-2025-15342 Tanium addressed an improper access controls vulnerability in Reputation.
Tanium addressed an improper access controls vulnerability in Reputation.
Problem types: cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: Tanium
product: Reputation
cpes: cpe:2.3:a:tanium:service_reputation:6.3.226:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_reputation:6.5.49:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_reputation:6.6.71:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published: 2026-02-05T18:13:01.081Z
CVE-2025-15343 Tanium addressed an incorrect default permissions vulnerability in Enforce.
Tanium addressed an incorrect default permissions vulnerability in Enforce.
Problem types: cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: Tanium
product: Enforce
cpes: cpe:2.3:a:tanium:service_enforce:2.7.366:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_enforce:2.8.600:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_enforce:2.9.573:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Published: 2026-02-05T18:11:30.318Z
CVE-2025-15344 Tanium addressed a SQL injection vulnerability in Asset.
Tanium addressed a SQL injection vulnerability in Asset.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Tanium
product: Asset
cpes: cpe:2.3:a:tanium:service_asset:1.28.253:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_asset:1.32.160:*:*:*:*:*:*:*
cpe:2.3:a:tanium:service_asset:1.33.249:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Published: 2026-01-28T23:46:49.415Z
CVE-2025-15345 MapGeo - Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter
The MapGeo – Interactive Geo Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'map' parameter in the display-map shortcode in all versions up to, and including, 1.6.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: interactivegeomaps
product: MapGeo – Interactive Geo Maps
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Dmitrii Ignatyev
Published: 2026-05-14T05:30:29.901Z
CVE-2025-15346 wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement
A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced. 

Because the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag was not included, the behavior effectively matched CERT_OPTIONAL: a peer certificate was verified if presented, but connections were incorrectly authenticated when no client certificate was provided. 

This results in improper authentication, allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake. 

The issue affects versions up to and including 5.8.2.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: wolfSSL
product: wolfSSL-py
default_status: unaffected
Credits: lang: en
value: Matan Radomski
Published: 2026-01-07T23:32:11.146Z
CVE-2025-15347 Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor level access and above, to update arbitrary WordPress options.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: getwpfunnels
product: Creator LMS – Online Courses and eLearning Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Sarawut Poolkhet
Published: 2026-01-20T14:26:33.130Z
CVE-2025-15348 Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27833.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Anritsu
product: ShockLine
default_status: unknown
Published: 2026-01-23T03:30:47.913Z
CVE-2025-15349 Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability
Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Anritsu ShockLine. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SCPI component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27315.
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Anritsu
product: ShockLine
default_status: unknown
Published: 2026-01-23T03:31:19.599Z
CVE-2025-15350 Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27039.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Anritsu
product: VectorStar
default_status: unknown
Published: 2026-01-23T03:31:26.025Z
CVE-2025-15351 Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27040.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Anritsu
product: VectorStar
default_status: unknown
Published: 2026-01-23T03:31:31.696Z
CVE-2025-15353 itsourcecode Society Management System edit_admin_query.php edit_admin_query sql injection
A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is the function edit_admin_query of the file /admin/edit_admin_query.php. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Society Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: BUPT_2025201 (VulDB User)
Published: 2025-12-30T19:32:07.432Z
CVE-2025-15354 itsourcecode Society Management System add_admin.php sql injection
A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/add_admin.php. Executing manipulation of the argument Username can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Society Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: BUPT_2025201 (VulDB User)
Published: 2025-12-30T20:02:07.091Z
CVE-2025-15355 NetVision Information｜ISOinsight - Reflected Cross-site Scripting
ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: NetVision Information
product: ISOinsight
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-12-30T07:33:23.259Z
CVE-2025-15356 Tenda AC20 PowerSaveSet sscanf buffer overflow
A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation of the argument powerSavingEn/time/powerSaveDelay/ledCloseType leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: AC20
cpes: cpe:2.3:o:tenda:ac20_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: xuanyu (VulDB User)
Published: 2025-12-30T20:32:08.560Z
CVE-2025-15357 D-Link DI-7400G+ msp_info.htm command injection
A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-77
description: Command Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: D-Link
product: DI-7400G+
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: xuanyu (VulDB User)
Published: 2025-12-30T21:02:08.930Z
CVE-2025-15358 DVP-12SE11T - Denial of Service Vulnerability
DVP-12SE11T - Denial of Service Vulnerability
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Delta Electronics
product: DVP-12SE11T
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Nhan Nguyen, Hoa X. Nguyen, and Tue Lam of Unit 515 from OPSWAT
Published: 2025-12-30T09:04:41.325Z
CVE-2025-15359 DVP-12SE11T - Out-of-bound memory write Vulnerability
DVP-12SE11T - Out-of-bound memory write Vulnerability
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Delta Electronics
product: DVP-12SE11T
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Nhan Nguyen, Hoa X. Nguyen, and Tue Lam of Unit 515 from OPSWAT
Published: 2025-12-30T09:07:04.319Z
CVE-2025-15360 newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload
A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: n/a
product: newbee-mall-plus
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: zyhsec (VulDB User)
Published: 2025-12-30T21:32:06.648Z
CVE-2025-15363 Get Use APIs < 2.0.10 - Contributor+ Stored XSS
The Get Use APIs  WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Get Use APIs
default_status: unaffected
Credits: lang: en
value: Ahmed Makawi
lang: en
value: WPScan
Published: 2026-03-18T06:00:09.938Z