rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-45798 
A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the /lib/cste_modules/system.so library, specifically in the processing of the IpTo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45800 
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-02T00:00:00.000Z
CVE-2025-45805 
In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile name. This payload is subsequently rendered without proper sanitization, when a user visits the website and selects the doctor to book an appointment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-03T00:00:00.000Z
CVE-2025-45806 
A cross-site scripting (XSS) vulnerability in rrweb-snapshot before v2.0.0-alpha.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-09T00:00:00.000Z
CVE-2025-45809 
SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-03T00:00:00.000Z
CVE-2025-45813 
ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-02T00:00:00.000Z
CVE-2025-45814 
Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-02T00:00:00.000Z
CVE-2025-45818 
Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/item_status.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45819 
Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45820 
Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45835 
A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the environment variable value CONTENT_LENGTH, causing the program to crash and potentially leading to a denial-of-service (DoS) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2025-45841 
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45842 
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45843 
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45844 
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45845 
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45846 
ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the torrentsindex parameter in the formBTClinetSetting function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45847 
ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the targetAPMac parameter in the formWsc function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2025-45851 
An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint /ISAPI/Security/challenge. The vendor has stated that upgrading to V5.7.23_SP2 fixes the issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-27T00:00:00.000Z
CVE-2025-45854 
/server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: JEHc
product: JEHC-BPM
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 10
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-06-03T00:00:00.000Z
CVE-2025-45855 
An arbitrary file upload vulnerability in the component /upload/GoodsCategory/image of erupt v1.12.19 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-03T00:00:00.000Z
CVE-2025-45857 
EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45858 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45859 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45861 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45862 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in the formDhcpv6s interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-20T00:00:00.000Z
CVE-2025-45863 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45864 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in the formDhcpv6s interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45865 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45866 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the formDhcpv6s interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45867 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static_dns1 parameter in the formIpv6Setup interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-45872 
zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-01T00:00:00.000Z
CVE-2025-45878 
A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-17T00:00:00.000Z
CVE-2025-45879 
A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-17T00:00:00.000Z
CVE-2025-45880 
A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-17T00:00:00.000Z
CVE-2025-45885 
PHPGURUKUL Vehicle Parking Management System v1.13 is vulnerable to SQL injection in the /vpms/users/login.php file. Attackers can inject malicious code from the parameter 'emailcont' and use it directly in SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-45887 
Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-09T00:00:00.000Z
CVE-2025-45890 
Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-20T00:00:00.000Z
CVE-2025-45892 
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's editor is not properly sanitized or escaped before being rendered. This allows attackers to inject malicious JavaScript code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45893 
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45931 
An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-30T00:00:00.000Z
CVE-2025-45938 
Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-03T00:00:00.000Z
CVE-2025-45939 
Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45947 
An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account - Change Password component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-28T00:00:00.000Z
CVE-2025-45949 
A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-28T00:00:00.000Z
CVE-2025-45953 
A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-28T00:00:00.000Z
CVE-2025-45956 
A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-29T00:00:00.000Z
CVE-2025-45960 
Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-45968 
An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Direct Object Reference (IDOR) vulnerability, which occurs due to a lack of proper authorization checks when accessing objects referenced by this parameter. This allows direct access to other users' data or internal resources without proper permission. Successful exploitation of this flaw may result in the exposure of sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-45984 
Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_AE4 V4.0.0 and BL-X26_DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub_45B238 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-45985 
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-45986 
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bs_SetMacBlack function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-45987 
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-45988 
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-45994 
An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-26T00:00:00.000Z
CVE-2025-45997 
Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-28T00:00:00.000Z
CVE-2025-46000 
An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploading a crafted SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-46001 
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-46002 
An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-46011 
Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-04T00:00:00.000Z
CVE-2025-46014 
Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-30T00:00:00.000Z
CVE-2025-46018 
CSC Pay Mobile App 2.19.4 (fixed in version 2.20.0) contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-01T00:00:00.000Z
CVE-2025-46035 
Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-12T00:00:00.000Z
CVE-2025-46041 
A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-09T00:00:00.000Z
CVE-2025-46047 
A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.4.2 allows remote attackers to determine valid usernames via the Login parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2025-46052 
An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-46053 
A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-46059 
langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email message. NOTE: this is disputed by the Supplier because the code-execution issue was introduced by user-written code that does not adhere to the LangChain security practices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-46060 
Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-13T00:00:00.000Z
CVE-2025-46066 
An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-46067 
An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-46068 
An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-46070 
An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-12T00:00:00.000Z
CVE-2025-46078 
HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-29T00:00:00.000Z
CVE-2025-46080 
HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-29T00:00:00.000Z