rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-12939 SourceCodester Interview Management System addCandidate.php sql injection
A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /addCandidate.php. The manipulation of the argument candName results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Interview Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Yuki77 (VulDB User)
Published: 2025-11-10T13:02:06.050Z
CVE-2025-12940 Credentials recorded in logs in NETGEAR WAX610 and WAX610Y
Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610
and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6
Access Points). An user having access to the syslog server can read the logs containing these credentials. 

This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.


Devices
managed with Insight get automatic updates. If not, please check the firmware version
and update to the latest. 





Fixed in:



WAX610 firmware
11.8.0.10 or later.



WAX610Y firmware
11.8.0.10 or later.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: NETGEAR
product: WAX610
default_status: unaffected
vendor: NETGEAR
product: WAX610Y
default_status: unaffected
Credits: lang: en
value: filiperfonseca
Published: 2025-11-11T16:17:25.837Z
CVE-2025-12941 Denial of Service Vulnerability in NETGEAR C6220 and C6230
Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the router.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: NETGEAR
product: C6220
default_status: unaffected
vendor: NETGEAR
product: C6230
default_status: unaffected
Credits: lang: en
value: Quickdraw
Published: 2025-12-09T17:01:04.702Z
CVE-2025-12942 Improper input validation in NETGEAR R6260 and R6850
Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.86; R6850: through 1.1.0.86.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NETGEAR
product: R6260
default_status: unaffected
vendor: NETGEAR
product: R6850
default_status: unaffected
Credits: lang: en
value: dcmtruman
Published: 2025-11-11T16:17:37.212Z
CVE-2025-12943 Improper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300
Improper certificate
validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream
AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band
WiFi 6E Router) allows attackers with the ability to intercept and
tamper traffic destined to the device to execute arbitrary commands on the
device.

Devices
with automatic updates enabled may already have this patch applied. If not,
please check the firmware version and update to the
latest.



Fixed in:



RAX30 firmware
1.0.14.108 or later.



RAXE300 firmware
1.0.9.82 or later
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: NETGEAR
product: RAX30
default_status: unaffected
vendor: NETGEAR
product: RAXE300
default_status: unaffected
Credits: lang: en
value: rqu4
Published: 2025-11-11T16:17:44.766Z
CVE-2025-12944 Improper input validation in NETGEAR DGN2200v4
Improper input validation
in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with
direct network access to the device to potentially execute code on the device.

Please check the firmware version and update to the latest.



Fixed
in:



 DGN2200v4
firmware 1.0.0.132 or later
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NETGEAR
product: DGN2200v4
default_status: unaffected
Credits: lang: en
value: crixer
Published: 2025-11-11T16:17:51.202Z
CVE-2025-12945 Improper input validation in NETGEAR Nighthawk router R7000P
A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation. 



This issue affects R7000P: through 1.3.3.154.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NETGEAR
product: R7000P
default_status: unaffected
Credits: lang: en
value: SmallS
Published: 2025-12-09T17:01:38.595Z
CVE-2025-12946 Improper input validation in NETGEAR Nighthawk routers
A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-in-the-middle techniques (MiTM) to manipulate DNS responses and execute commands when speedtests are run. 



This issue affects RS700: through 1.0.7.82; RAX54Sv2 : before V1.1.6.36; RAX41v2: before V1.1.6.36; RAX50: before V1.2.14.114; RAXE500: before V1.2.14.114; RAX41: before V1.0.17.142; RAX43: before V1.0.17.142; RAX35v2: before V1.0.17.142; RAXE450: before V1.2.14.114; RAX43v2: before V1.1.6.36; RAX42: before V1.0.17.142; RAX45: before V1.0.17.142; RAX50v2: before V1.1.6.36; MR90: before V1.0.2.46; MS90: before V1.0.2.46; RAX42v2: before V1.1.6.36; RAX49S: before V1.1.6.36.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NETGEAR
product: RS700
default_status: unaffected
vendor: NETGEAR
product: RAX54Sv2
default_status: unaffected
vendor: NETGEAR
product: RAX41v2
default_status: unaffected
vendor: NETGEAR
product: RAX50
default_status: unaffected
vendor: NETGEAR
product: RAXE500
default_status: unaffected
vendor: NETGEAR
product: RAX41
default_status: unaffected
vendor: NETGEAR
product: RAX43
default_status: unaffected
vendor: NETGEAR
product: RAX35v2
default_status: unaffected
vendor: NETGEAR
product: RAXE450
default_status: unaffected
vendor: NETGEAR
product: RAX43v2
default_status: unaffected
vendor: NETGEAR
product: RAX42
default_status: unaffected
vendor: NETGEAR
product: RAX45
default_status: unaffected
vendor: NETGEAR
product: RAX50v2
default_status: unaffected
vendor: NETGEAR
product: MR90
default_status: unaffected
vendor: NETGEAR
product: RAX42v2
default_status: unaffected
vendor: NETGEAR
product: RAX49S
default_status: unaffected
vendor: NETGEAR
product: MS90
default_status: unaffected
Credits: lang: en
value: molybdenum
Published: 2025-12-09T17:02:20.739Z
CVE-2025-12952 Privilege Escalation in Dialogflow CX via Webhook Admin Role
A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX.

Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. 
This allows the attacker to escalate their privileges from agent-level to project-level, granting them unauthorized access to manage resources in services associated with the project, leading to unexpected costs and resource depletion for the producer project.

A fix was applied on the server side to protect from this vulnerability in February 2025. No customer action is required.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Google Cloud
product: Dialogflow CX
default_status: unaffected
Credits: lang: en
value: asterfiester
Published: 2025-12-10T07:11:31.026Z
CVE-2025-12953 Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and "rtcl_ajax_delete_listing_type" function in all versions up to, and including, 5.2.0. This makes it possible for authenticated attackers, with subscriber level access and above, to add, update, or delete listing types.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: techlabpro1
product: Classified Listing – AI-Powered Classified ads & Business Directory Plugin
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Rafshanzani Suhada
Published: 2025-11-11T11:03:45.759Z
CVE-2025-12954 Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
Problem types: description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: Timetable and Event Schedule by MotoPress
default_status: unaffected
Credits: lang: en
value: bRpsd
lang: en
value: WPScan
Published: 2025-12-03T06:00:05.630Z
CVE-2025-12955 Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the "getOrders" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: rajeshsingh520
product: PiWeb Live sales notification for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Athiwat Tiprasaharn
Published: 2025-11-18T09:27:36.608Z
CVE-2025-12956 Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: ENOVIA Collaborative Industry Innovator
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published: 2025-12-08T08:38:45.621Z
CVE-2025-12957 All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type validation detecting VTT files, allowing double extension files to bypass sanitization while being accepted as a valid VTT file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: plugins360
product: All-in-One Video Gallery
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Michael Mazzolini
Published: 2026-01-16T04:44:35.026Z
CVE-2025-12958 Rankology SEO and Analytics Tool <= 2.0 - Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation
The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'rankology_code_block' page in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to add header and footer code blocks.
Problem types: cwe_id: CWE-285
description: CWE-285 Improper Authorization
Affected products: vendor: rankology
product: Rankology SEO and Analytics Tool
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
baseScore: 2.7
baseSeverity: LOW
Credits: lang: en
value: SangNQ29
Published: 2026-01-07T08:21:54.071Z
CVE-2025-12960 Simple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read
The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[csv]` shortcode. This is due to insufficient path validation before concatenating user-supplied input to a base directory path. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: iworks
product: Simple CSV Table
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Ivan Cese
Published: 2025-12-12T08:20:03.966Z
CVE-2025-12961 Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification
The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJAX action in all versions up to, and including, 1.3.3. This is due to the absence of any capability verification in the `dlpn_save_settings()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to arbitrarily modify plugin settings including display text, download links, button colors, and other visual customizations.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: arkadiykilesso
product: Download Panel (Biggiko Team)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Ivan Cese
Published: 2025-11-18T08:27:37.109Z
CVE-2025-12962 Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode
The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the `url` parameter in the `[syndicate_local]` shortcode. This is due to the use of `wp_remote_get()` instead of `wp_safe_remote_get()` which lacks protections against requests to internal/private IP addresses and localhost. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal networks, and access resources that should not be accessible from external networks.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: willbontrager
product: Local Syndication
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Ivan Cese
Published: 2025-11-18T08:27:32.912Z
CVE-2025-12963 LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.2.29 - Missing Authorization to Uanuthenticated Privilege Escalation
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: lazycoders
product: LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Athiwat Tiprasaharn
Published: 2025-12-12T03:20:55.445Z
CVE-2025-12964 Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget
The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nalam-1
product: Magical Shop Builder – WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Abu Hurayra
Published: 2025-11-21T09:27:00.601Z
CVE-2025-12965 Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget
The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: nalam-1
product: Magical Posts Display – Elementor Advanced Posts widgets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Abu Hurayra
Published: 2025-12-12T11:15:50.299Z
CVE-2025-12966 All-in-One Video Gallery 4.5.4 - 4.5.7 – Authenticated (Author+) Arbitrary File Upload via Import ZIP
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: plugins360
product: All-in-One Video Gallery
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Kenneth Dunn
Published: 2025-12-06T09:25:57.785Z
CVE-2025-12967 
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

We recommend customers upgrade to the following versions: AWS JDBC Wrapper to v2.6.5, AWS Go Wrapper to 2025-10-17, AWS NodeJS Wrapper to v2.0.1, AWS Python Wrapper to v1.4.0 and AWS PGSQL ODBC driver to v1.0.1
Problem types: cwe_id: CWE-470
description: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products: vendor: AWS
product: JDBC Wrapper
default_status: unaffected
vendor: AWS
product: Go Wrapper
default_status: unaffected
vendor: AWS
product: NodeJS Wrapper
default_status: unaffected
vendor: AWS
product: Python Wrapper
default_status: unaffected
vendor: AWS
product: ODBC driver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-11-10T18:09:10.157Z
CVE-2025-12968 Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload
The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` class only validating the MIME type which can be easily spoofed, and the `import_data` function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: infility
product: Infility Global
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Kenneth Dunn
Published: 2025-12-12T03:20:44.458Z
CVE-2025-12969 CVE-2025-12969
Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, attackers can inject forged log records, flood alerting systems, or manipulate routing decisions, compromising the authenticity and integrity of ingested logs.
Problem types: description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: FluentBit
product: Fluent Bit
Published: 2025-11-24T14:41:05.630Z