rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-4260 zhangyanbo2007 youkefu TemplateController.java impsave deserialization
A vulnerability was found in zhangyanbo2007 youkefu up to 4.2.0 and classified as problematic. Affected by this issue is the function impsave of the file m\web\handler\admin\system\TemplateController.java. The manipulation of the argument dataFile leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-502
description: Deserialization
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: zhangyanbo2007
product: youkefu
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Serein123y (VulDB User)
Published: 2025-05-05T02:31:04.576Z
CVE-2025-4261 GAIR-NLP factool tool.py run_single code injection
A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affects the function run_single of the file factool/factool/math/tool.py. The manipulation leads to code injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: GAIR-NLP
product: factool
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: ybdesire (VulDB User)
lang: en
value: ybdesire (VulDB User)
Published: 2025-05-05T03:00:06.085Z
CVE-2025-4262 PHPGurukul Online DJ Booking Management System user-search.php sql injection
A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/user-search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Online DJ Booking Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: YeyukongXiaodengli (VulDB User)
Published: 2025-05-05T03:31:05.162Z
CVE-2025-4263 PHPGurukul Online DJ Booking Management System booking-search.php sql injection
A vulnerability was found in PHPGurukul Online DJ Booking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Online DJ Booking Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: YeyukongXiaodengli (VulDB User)
Published: 2025-05-05T04:00:09.327Z
CVE-2025-4264 PHPGurukul Emergency Ambulance Hiring Portal edit-ambulance.php sql injection
A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/edit-ambulance.php. The manipulation of the argument dconnum leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Emergency Ambulance Hiring Portal
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: xiguala123 (VulDB User)
Published: 2025-05-05T04:31:05.832Z
CVE-2025-4265 PHPGurukul Emergency Ambulance Hiring Portal contact-us.php sql injection
A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/contact-us.php. The manipulation of the argument mobnum leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Emergency Ambulance Hiring Portal
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: xiguala123 (VulDB User)
Published: 2025-05-05T05:00:08.791Z
CVE-2025-4266 PHPGurukul Notice Board System bwdates-reports-details.php sql injection
A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. Affected by this issue is some unknown functionality of the file /bwdates-reports-details.php?vid=2. The manipulation of the argument fromdate/tomdate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Notice Board System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: bottle (VulDB User)
Published: 2025-05-05T05:31:05.206Z
CVE-2025-4267 SourceCodester/oretnom23 Stock Management System Purchase Order Details Page view_po sql injection
A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. This affects an unknown part of the file /admin/?page=purchase_order/view_po of the component Purchase Order Details Page. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Stock Management System
vendor: oretnom23
product: Stock Management System
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Th3W0lf (VulDB User)
Published: 2025-05-05T06:00:06.417Z
CVE-2025-4268 TOTOLINK A720R cstecgi.cgi missing authentication
A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input RebootSystem leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: TOTOLINK
product: A720R
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: 153528990 (VulDB User)
Published: 2025-05-05T06:31:07.005Z
CVE-2025-4269 TOTOLINK A720R Log cstecgi.cgi access control
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: TOTOLINK
product: A720R
CVSS v3.1: version: 3.1
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: 153528990 (VulDB User)
Published: 2025-05-05T07:00:06.643Z
CVE-2025-4270 TOTOLINK A720R Config cstecgi.cgi information disclosure
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: TOTOLINK
product: A720R
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: 153528990 (VulDB User)
Published: 2025-05-05T07:31:07.013Z
CVE-2025-4271 TOTOLINK A720R cstecgi.cgi information disclosure
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: TOTOLINK
product: A720R
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: 153528990 (VulDB User)
Published: 2025-05-05T08:00:08.825Z
CVE-2025-4272 Mechrevo Control Console GCUService csCAPI.dll uncontrolled search path
A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\csCAPI.dll of the component GCUService. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path
cwe_id: CWE-426
description: Untrusted Search Path
Affected products: vendor: Mechrevo
product: Control Console
CVSS v3.1: version: 3.1
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: Ba1_Ma0 (VulDB User)
Published: 2025-05-05T11:00:07.406Z
CVE-2025-4275 SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate
A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.
Problem types: description: cwe-284: Improper Access Control
Affected products: vendor: Insyde Software
product: InsydeH2O
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Thanks to Nikolaj Schlej, independent firmware security researcher, for reporting the vulnerability and engaging in this coordinated disclosure.
Published: 2025-06-11T00:25:17.737Z
CVE-2025-4276 UsbCoreDxe: improper input validation may lead to arbitrary code execution
UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Insyde Software
product: InsydeH2O
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-08-13T01:41:56.834Z
CVE-2025-4277 Tcg2Smm: improper input validation may lead to arbitrary code execution
Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Insyde Software
product: InsydeH2O
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-08-13T01:46:22.998Z
CVE-2025-4278 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
Credits: lang: en
value: Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2025-06-12T10:02:25.006Z
CVE-2025-4279 External image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload
The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_posts::replace_post' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: muromuro
product: External image replace
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2025-05-05T18:22:39.421Z
CVE-2025-4280 TCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.app
MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions
granted by the user to the main application bundle. An attacker with local user access can
invoke this interpreter with arbitrary commands or scripts, leveraging the
application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Poedit, potentially disguising attacker's malicious intent.

This issue has been fixed in 3.6.3 version of Poedit.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Poedit
product: Poedit
default_status: unaffected
Credits: lang: en
value: Karol Mazurek - Afine Team
Published: 2025-05-22T09:59:30.632Z
CVE-2025-4281 Shenzhen Sixun Software Sixun Shanghui Group Business Management System LoadData information disclosure
A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7. This affects an unknown part of the file /api/GylOperator/LoadData. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-200
description: Information Disclosure
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: Shenzhen Sixun Software
product: Sixun Shanghui Group Business Management System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: yaozhangYiqiyin (VulDB User)
Published: 2025-05-05T16:00:09.603Z
CVE-2025-4282 SourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: SourceCodester
product: Stock Management System
vendor: oretnom23
product: Stock Management System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: Th3W0lf (VulDB User)
Published: 2025-05-05T18:00:08.512Z
CVE-2025-4283 SourceCodester/oretnom23 Stock Management System Login.php sql injection
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Stock Management System
vendor: oretnom23
product: Stock Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Th3W0lf (VulDB User)
Published: 2025-05-05T18:31:04.418Z
CVE-2025-4284 Reflected XSS in Rolantis Information Technologies' Agentis
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS.

This issue affects Agentis: before 4.32.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Rolantis Information Technologies
product: Agentis
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: Tunahan TEKEOGLU
Published: 2025-07-22T11:31:07.670Z
CVE-2025-4285 SQLi in Rolantis Information Technologies' Agentis
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL Injection.

This issue affects Agentis: before 4.32.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Rolantis Information Technologies
product: Agentis
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 10
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Credits: lang: en
value: Tunahan TEKEOGLU
Published: 2025-07-22T11:21:54.909Z
CVE-2025-4286 Intelbras InControl Dispositivos Edição Page credentials storage
A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
Problem types: cwe_id: CWE-256
description: Unprotected Storage of Credentials
cwe_id: CWE-255
description: Credentials Management
Affected products: vendor: Intelbras
product: InControl
CVSS v3.1: version: 3.1
baseScore: 2.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: eldruin (VulDB User)
Published: 2025-05-05T19:31:04.865Z
CVE-2025-4287 PyTorch nccl.py torch.cuda.nccl.reduce denial of service
A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: PyTorch
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
baseSeverity: LOW
Credits: lang: en
value: Default436352 (VulDB User)
Published: 2025-05-05T20:00:11.130Z
CVE-2025-4288 PCMan FTP Server RNFR Command buffer overflow
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RNFR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-05T20:31:04.050Z
CVE-2025-4289 PCMan FTP Server RNTO Command buffer overflow
A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-05T21:00:11.070Z