rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-55472 
SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2025-55473 
Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in the /ip.php endpoint, which processes and displays the X-Forwarded-For HTTP header without proper sanitization or output encoding. This allows an attacker to inject malicious JavaScript code that will execute in visitor browsers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2025-55474 
Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2025-55476 
FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This parameter is unsafely evaluated in a SQL ORDER BY clause without proper sanitization, allowing an attacker to inject arbitrary SQL subqueries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2025-55482 
Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the formSetCfm function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-55483 
Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-55495 
Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-27T00:00:00.000Z
CVE-2025-55498 
Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-55499 
Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-55503 
Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-20T00:00:00.000Z
CVE-2025-55521 
An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-55522 
Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-55523 
An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-55524 
Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-55526 
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-55551 
An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55552 
pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55553 
A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55554 
pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan_to_num-.long().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55556 
TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55557 
A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55558 
A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55559 
An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55560 
An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-55564 
Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-55573 
QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55574 
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-55575 
SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=service_detail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-55579 
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-29T00:00:00.000Z
CVE-2025-55580 
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-29T00:00:00.000Z
CVE-2025-55581 
D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the `dcp` and `signalc` binaries without validating their integrity, origin, or permissions. An attacker with filesystem access (e.g., via UART or firmware modification) may replace these binaries to achieve persistent arbitrary code execution with root privileges. The issue stems from improper handling of executable trust and absence of integrity checks in the watchdog logic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55582 
D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `signalc` without verifying integrity, authenticity, or permissions. An attacker with local filesystem access (via physical access, firmware modification, or debug interfaces) can replace these binaries with malicious payloads. The script executes these binaries as root in an infinite loop, leading to persistent privilege escalation and arbitrary code execution. This issue is mitigated in v1.09.02, but the product is officially End-of-Life and unsupported.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-27T00:00:00.000Z
CVE-2025-55583 
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-55584 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55585 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55586 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55587 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55588 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55589 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters at /boafrm/formMapDelDevice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55590 
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55591 
TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-18T00:00:00.000Z
CVE-2025-55599 
D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formWlanSetup function via the parameter f_wds_wepKey.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55602 
D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formSysCmd function via the submit-url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55603 
Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromSetSysTime function via the ntpServer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55605 
Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the saveParentControlInfo function via the deviceName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55606 
Tenda AX3 V16.03.12.10_CN is vulnerable to Buffer Overflow in the fromAdvSetMacMtuWan function via the serverName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55611 
D-Link DIR-619L 2.06B01 is vulnerable to Buffer Overflow in the formLanguageChange function via the nextPage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55613 
Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55618 
In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-27T00:00:00.000Z
CVE-2025-55619 
Reolink v4.54.0.4.20250526 was discovered to contain a hardcoded encryption key and initialization vector. An attacker can leverage this vulnerability to decrypt access tokens and web session tokens stored inside the app via reverse engineering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55620 
A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55621 
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55622 
Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. NOTE: this is disputed by the Supplier because it is intentional behavior to ensure a predictable user experience.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55623 
An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55624 
An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55625 
An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior that supports redirection to Alexa URLs, which are not guaranteed to remain at the same domain indefinitely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55626 
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55627 
Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows authenticated attackers to create accounts with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55629 
Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users' passwords via manipulation of the userName value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55630 
A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to enumerate existing accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55631 
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to manage users' sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service (DoS) via resource exhaustion. NOTE: the Supplier reports that the system-wide limit is intentional.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55634 
Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to cause a Denial of Service (DoS) via initiating a large number of simultaneous ffmpeg-based stream pushes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55637 
Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-55664 
A heap buffer overflow in the m2tsdmx_send_packet function (filters/dmx_m2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-55668 Apache Tomcat: session fixation via rewrite valve
Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Problem types: cwe_id: CWE-384
description: CWE-384 Session Fixation
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: Greg K (https://github.com/gregk4sec)
Published: 2025-08-13T13:21:35.743Z
CVE-2025-55669 BIG-IP HTTP/2 vulnerability
When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-672
description: CWE-672 Operation on a Resource after Expiration or Release
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:45.362Z
CVE-2025-55670 BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability
On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: F5
product: BIG-IP Next SPK
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
vendor: F5
product: BIG-IP Next for Kubernetes
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:48.494Z
CVE-2025-55671 
Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: kujirahand
product: TkEasyGUI
Published: 2025-09-05T05:24:45.422Z