rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-59755 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CAT.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:27:24.746Z
CVE-2025-59756 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in 'SuppConn in /clt/LOGINFRM_CON.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:27:47.919Z
CVE-2025-59757 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CATOLD.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:30:15.137Z
CVE-2025-59758 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_CYLOG.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:34:01.160Z
CVE-2025-59759 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DELCROIX.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:34:21.531Z
CVE-2025-59760 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DHL.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:34:51.879Z
CVE-2025-59761 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DLG.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:35:18.157Z
CVE-2025-59762 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DLG.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:35:39.228Z
CVE-2025-59763 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_EK.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:36:12.640Z
CVE-2025-59764 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_FCC.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:36:56.961Z
CVE-2025-59765 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LF.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:37:29.171Z
CVE-2025-59766 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LT.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:38:00.891Z
CVE-2025-59767 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_LVE.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:38:43.377Z
CVE-2025-59768 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MNG.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:39:08.452Z
CVE-2025-59769 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MOL.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:39:37.620Z
CVE-2025-59770 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MON.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:41:43.808Z
CVE-2025-59771 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_MRK.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:42:31.892Z
CVE-2025-59772 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_SIL.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:46:29.504Z
CVE-2025-59773 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_TP.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:47:52.132Z
CVE-2025-59774 Multiple vulnerabilities in AndSoft's e-TMS
Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_VON.ASP'.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: AndSoft
product: e-TMS
default_status: unaffected
Credits: lang: en
value: Maximilian Hildebrand (m10x.de)
Published: 2025-10-02T14:48:21.842Z
CVE-2025-59775 Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
Server-Side Request Forgery (SSRF) vulnerability 

 in Apache HTTP Server on Windows 

with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM 
hashes to a malicious server via SSRF and malicious requests or content

Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: Orange Tsai (@orange_8361) from DEVCORE
Published: 2025-12-05T10:17:03.852Z
CVE-2025-59776 AutomationDirect Productivity Suite Relative Path Traversal
A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and create arbitrary directories on the target machine.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: AutomationDirect
product: Productivity Suite
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-622 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-550E CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-530 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 2000 P2-622 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 2000 P2-550 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 1000 P1-550 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 1000 P1-540 CPU
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Luca Borzacchiello of Nozomi Networks reported these vulnerabilities to AutomationDirect.
Published: 2025-10-23T22:17:23.123Z
CVE-2025-59777 
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-476
description: NULL pointer dereference
Affected products: vendor: GNU Project
product: GNU libbmicrohttpd
Published: 2025-11-10T04:10:44.836Z
CVE-2025-59778 VELOS partition container network vulnerability
When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: F5
product: F5OS - Chassis
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:49.239Z
CVE-2025-59780 General Industrial Controls Lynx+ Gateway Missing Authentication for Critical Function
General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which 
could allow an attacker to send GET requests to obtain sensitive device 
information.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: General Industrial Controls
product: Lynx+ Gateway
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Abhishek Pandey from Payatu Security Consulting Pvt. Ltd. reported these vulnerabilities to CISA.
Published: 2025-11-14T23:26:35.691Z
CVE-2025-59781 BIG-IP DNS cache vulnerability
When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-459
description: CWE-459 Incomplete Cleanup
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:46.562Z
CVE-2025-59783 OS Command Injection over API
API endpoint for user synchronization in 2N Access Commander version 3.4.1 did not have a sufficient input validation allowing for OS command injection. 
This vulnerability can only be exploited after authenticating with administrator privileges.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: 2N Telekomunikace a.s.
product: 2N Access Commander
default_status: unaffected
Published: 2026-03-04T15:19:13.116Z
CVE-2025-59784 Log Pollution - Control Characters Not Escaped
2N Access Commander version 3.4.1 and prior is vulnerable to log pollution. Certain parameters sent over API may be included in the logs without prior validation or sanitisation.
This vulnerability can only be exploited after authenticating with administrator privileges.
Problem types: cwe_id: CWE-117
description: CWE-117: Improper Output Neutralization for Logs
Affected products: vendor: 2N Telekomunikace a.s.
product: 2N Access Commander
default_status: unaffected
Published: 2026-03-04T15:26:47.073Z
CVE-2025-59785 API - Insufficient Input Validation
Improper validation of API end-point in 2N Access Commander version 3.4.2 and prior allows attacker to bypass password policy for backup file encryption.
This vulnerability can only be exploited after authenticating with administrator privileges.
Problem types: cwe_id: CWE-1286
description: CWE-1286 – Improper Validation of Syntactic Correctness
Affected products: vendor: 2N Telekomunikace a.s.
product: 2N Access Commander
default_status: unaffected
Published: 2026-03-04T15:30:31.230Z
CVE-2025-59786 Cookies are not Invalidated upon Logout and Password Change
2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: 2N Telekomunikace a.s.
product: 2N Access Commander
default_status: unaffected
Published: 2026-03-04T15:30:35.148Z
CVE-2025-59787 HTTP 5XX Internal Server Errors
2N Access Commander application version 3.4.2 and prior returns HTTP 500 Internal Server Error responses when receiving malformed or manipulated requests, indicating improper handling of invalid input and potential security or availability impacts.
Problem types: cwe_id: CWE-703
description: CWE-703 – Improper Check or Handling of Exceptional Conditions
Affected products: vendor: 2N Telekomunikace a.s.
product: 2N Access Commander
default_status: unaffected
Published: 2026-03-04T15:31:59.211Z
CVE-2025-59788 
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.
Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
Affected products: vendor: Nextcloud
product: Nextcloud
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-12-04T00:00:00.000Z