rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-62645 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 9.9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62646 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62647 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62648 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62649 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders.
Problem types: cwe_id: CWE-603
description: CWE-603 Use of Client-Side Authentication
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62650 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
Problem types: cwe_id: CWE-603
description: CWE-603 Use of Client-Side Authentication
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 8.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62651 
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Restaurant Brands International
product: assistant platform
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: 2025-10-17T00:00:00.000Z
CVE-2025-62652 Stored XSS in WebAuthn key name
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki WebAuthn extension
default_status: unaffected
Credits: lang: en
value: Roan Kattouw
Published: 2025-10-17T22:15:26.903Z
CVE-2025-62653 Stored XSS through system messages in PollNY
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extension allows Stored XSS.This issue affects MediaWiki PollNY extension: 1.39, 1.43, 1.44.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki PollNY extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-17T22:23:05.370Z
CVE-2025-62654 Stored XSS through system messages in QuizGame
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extension allows Stored XSS.This issue affects MediaWiki QuizGame extension: 1.39, 1.43, 1.44.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki QuizGame extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-17T22:38:54.033Z
CVE-2025-62655 SQL injection in Cargo via Special:CargoExport
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki Cargo extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-17T22:46:28.849Z
CVE-2025-62656 GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking extension allows Stored XSS.This issue affects MediaWiki GlobalBlocking extension: 1.43, 1.44.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki GlobalBlocking extension
default_status: unaffected
Credits: lang: en
value: Dreamy_Jazz
Published: 2025-10-20T20:15:14.947Z
CVE-2025-62657 Stored XSS through system messages in PageForms
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.This issue affects MediaWiki PageForms extension: 1.44.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki PageForms extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-20T20:19:32.576Z
CVE-2025-62658 SQL injection in WatchAnalytics through Special:ClearPendingReviews
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki WatchAnalytics extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-20T20:23:22.126Z
CVE-2025-62659 The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki CookieConsent extension: from v0.1.0 before v2.0.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: MediaWiki CookieConsent extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-22T15:31:28.899Z
CVE-2025-62661 Do permission checking when getting counts of global and local edits, new articles and thanks
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension
default_status: unaffected
Credits: lang: en
value: dom_walden
lang: en
value: mszwarc
Published: 2025-10-21T19:33:26.399Z
CVE-2025-62662 Stored XSS through system messages in AdvancedSearch
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - AdvancedSearch Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:19:31.193Z
CVE-2025-62663 Stored XSS through a system message in UploadWizard
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - UploadWizard Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:16:00.908Z
CVE-2025-62664 Stored XSS through a system message in ImageRating
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - ImageRating Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:13:27.379Z
CVE-2025-62665 Stored XSS through system messages in Skin:BlueSky
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Wikimedia Foundation
product: Mediawiki - Skin:BlueSky
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:10:27.081Z
CVE-2025-62666 DoS vector through the cirrusbuilddoc query API
Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - CirrusSearch Extension
default_status: unaffected
Credits: lang: en
value: dreamy_jazz
lang: en
value: dcausse
Published: 2025-10-18T04:47:52.437Z
CVE-2025-62667 Stored XSS through article extracts in GrowthExperiments
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - GrowthExperiments Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:42:30.610Z
CVE-2025-62668 Insufficient permission checks in action=growthsetmentor
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - GrowthExperiments Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
lang: en
value: Urbanecm_WMF
Published: 2025-10-18T04:39:28.390Z
CVE-2025-62669 UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - CentralAuth Extension
default_status: unaffected
Credits: lang: en
value: dom_walden
lang: en
value: mszabo
Published: 2025-10-18T04:34:34.614Z
CVE-2025-62670 Stored XSS through a system message in FlexDiagrams
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - FlexDiagrams Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:29:48.409Z
CVE-2025-62671 Stored XSS through wikitext in Cargo
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: The Wikimedia Foundation
product: Mediawiki - Cargo Extension
default_status: unaffected
Credits: lang: en
value: SomeRandomDeveloper
Published: 2025-10-18T04:24:35.915Z
CVE-2025-62672 
rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. This occurs in memcpy in the RPLAY_DATA case in rplay_unpack in librplay/rplay.c, potentially reachable via packet data with no authentication.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: boyns
product: rplay
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: 2025-10-19T00:00:00.000Z
CVE-2025-62673 Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a maliciously formed field.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: TP-Link Systems Inc.
product: Archer AX53 v1.0
default_status: unaffected
Credits: lang: en
value: Lilith >_> of Cisco Talos
Published: 2026-02-03T18:53:32.813Z
CVE-2025-62674 Missing Authentication for RTSP in iCam Cameras
The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an attacker unauthorized access to camera configuration information.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: iCam365
product: P201
default_status: unaffected
vendor: iCam365
product: QC021
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Truong Nguyen Long
Published: 2025-11-20T20:37:27.482Z
CVE-2025-62676 
An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, FortiClientWindows 7.2.0 through 7.2.12, FortiClientWindows 7.0 all versions may allow a local low-privilege attacker to perform an arbitrary file write with elevated permissions via crafted named pipe messages.
Problem types: cwe_id: CWE-59
description: Escalation of privilege
Affected products: vendor: Fortinet
product: FortiClientWindows
cpes: cpe:2.3:a:fortinet:forticlientwindows:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2026-02-10T15:39:12.816Z
CVE-2025-62686 
A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 on macOS. Due to the absence of a hardened runtime and a __RESTRICT segment, a local user may exploit the DYLD_INSERT_LIBRARIES environment variable to inject a dynamic library, potentially resulting in code execution with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-03T00:00:00.000Z
CVE-2025-62687 
Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed.
Problem types: cwe_id: CWE-352
description: Cross-site request forgery (CSRF)
Affected products: vendor: LogStare Inc.
product: LogStare Collector (for Windows)
vendor: LogStare Inc.
product: LogStare Collector (for Linux)
Published: 2025-11-21T06:17:59.189Z
CVE-2025-62688 AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for a critical resource vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an attacker with low-privileged credentials to change their role, gaining full control access to the project.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: AutomationDirect
product: Productivity Suite
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-622 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-550E CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 3000 P3-530 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 2000 P2-622 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 2000 P2-550 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 1000 P1-550 CPU
default_status: unaffected
vendor: AutomationDirect
product: Productivity 1000 P1-540 CPU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Luca Borzacchiello of Nozomi Networks reported these vulnerabilities to AutomationDirect.
Published: 2025-10-23T21:58:16.532Z
CVE-2025-62689 
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.
Problem types: cwe_id: CWE-122
description: Heap-based buffer overflow
Affected products: vendor: GNU Project
product: GNU libbmicrohttpd
Published: 2025-11-10T04:10:57.970Z