rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-25612 
FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25613 
FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-20T00:00:00.000Z
CVE-2025-25614 
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25615 
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25616 
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25617 
Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-07T00:00:00.000Z
CVE-2025-25618 
Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25620 
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-10T00:00:00.000Z
CVE-2025-25621 
Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses/teacher/index?teacher_id=2&semester_id=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25625 
A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages which then present the user name without encoding special characters will then cause the injected code to be parsed by the browsers of other users accessing the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-13T00:00:00.000Z
CVE-2025-25632 
Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-25634 
A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src leads to stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2025-25635 
TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface of /bin/boa.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-28T00:00:00.000Z
CVE-2025-25650 
An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25652 
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-13T00:00:00.000Z
CVE-2025-25662 
Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the argument remark/type/time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25663 
A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25664 
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25667 
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25668 
Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25674 
Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form_fast_setting_wifi_set via the parameter ssid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25675 
Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmd_buf variable, which is directly used in the doSystemCmd function, causing an arbitrary command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25676 
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25678 
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25679 
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-20T00:00:00.000Z
CVE-2025-25680 
LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya_ipc_direct_connect function of the anyka_ipc process. The vulnerability allows arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25683 
AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-12T00:00:00.000Z
CVE-2025-25684 
A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25685 
An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2025-25686 
semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-27T00:00:00.000Z
CVE-2025-25691 
A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-30T00:00:00.000Z
CVE-2025-25692 
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-30T00:00:00.000Z
CVE-2025-25709 
An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the addUser and updateUser endpoints
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
Published: 2025-03-12T00:00:00.000Z
CVE-2025-25711 
An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API endpoint
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2025-03-12T00:00:00.000Z
CVE-2025-25723 
Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-28T00:00:00.000Z
CVE-2025-25724 
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
Problem types: cwe_id: CWE-252
description: CWE-252 Unchecked Return Value
Affected products: vendor: libarchive
product: libarchive
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Published: 2025-03-02T00:00:00.000Z
CVE-2025-25727 
Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25728 
Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintext, allowing attackers to access sensitive information via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25729 
An information disclosure vulnerability in Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 allows attackers to obtain hardcoded cleartext credentials via the update or boot process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25730 
An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate unauthorized attackers to access USB debugging, leading to control of the host device itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25732 
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-25733 
Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-25734 
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-25735 
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-25736 
Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-25737 
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass authentication via a bruteforce attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-25740 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25741 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2025-25742 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2025-25743 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2025-25744 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2025-25745 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-14T00:00:00.000Z
CVE-2025-25746 
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2025-25747 
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25748 
A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25749 
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-11T00:00:00.000Z
CVE-2025-25758 
An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-20T00:00:00.000Z
CVE-2025-25759 
An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25760 
A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25761 
HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2025-25763 
crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-06T00:00:00.000Z
CVE-2025-25765 
MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25766 
An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25767 
A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25768 
MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25769 
Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25770 
Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25772 
A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-21T00:00:00.000Z
CVE-2025-25774 
An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-12T00:00:00.000Z
CVE-2025-25775 
Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-25T00:00:00.000Z
CVE-2025-25776 
Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-28T00:00:00.000Z
CVE-2025-25777 
Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-24T00:00:00.000Z
CVE-2025-25783 
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-26T00:00:00.000Z