rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-4226 PHPGurukul/Campcodes Cyber Cafe Management System add-computer.php sql injection
A vulnerability classified as critical has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. This affects an unknown part of the file /add-computer.php. The manipulation of the argument compname/comploc leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Cyber Cafe Management System
vendor: Campcodes
product: Cyber Cafe Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: diyuzhishen (VulDB User)
Published: 2025-05-03T11:00:09.135Z
CVE-2025-4228 Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Broker VM
default_status: unaffected
Credits: lang: en
value: This issue was discovered during an internal penetration test
Published: 2025-06-12T23:41:37.071Z
CVE-2025-4231 PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface
A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user.

The attacker must have network access to the management web interface and successfully authenticate to exploit this issue.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Palo Alto Networks
product: Cloud NGFW
default_status: unaffected
vendor: Palo Alto Networks
product: PAN-OS
cpes: cpe:2.3:o:palo_alto_networks:pan-os:11.0.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.0.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:11.0.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.14:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.13:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.12:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.11:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.10:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.7:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.6:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.5:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.4:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.1:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:10.1.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Palo Alto Networks
product: Prisma Access
default_status: unaffected
Credits: lang: en
value: spcnvdr
Published: 2025-06-12T23:27:31.432Z
CVE-2025-4233 Prisma Access Browser: Inappropriate implementation in Cache
An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies.
Problem types: cwe_id: CWE-524
description: CWE-524: Use of Cache Containing Sensitive Information
Affected products: vendor: Palo Alto Networks
product: Prisma Access Browser
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks Tan Inn Fung, Yu Ann Ong, Zhang Bosen from the GovTech Cybersecurity Group for discovering and reporting this issue.
Published: 2025-06-12T22:14:53.314Z
CVE-2025-4234 Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials
A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these application logs are only viewable by local users and are included when generating logs for troubleshooting purposes. This means that these credentials are exposed to recipients of the application logs.
Problem types: cwe_id: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
Affected products: vendor: Palo Alto Networks
product: Cortex XDR Microsoft 365 Defender Pack
default_status: unaffected
Credits: lang: en
value: RC
Published: 2025-09-12T17:18:11.618Z
CVE-2025-4235 User-ID Credential Agent: Cleartext Exposure of Service Account password
An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The impact varies by configuration:
  *  Minimally Privileged Accounts: Enable disruption of User-ID Credential Agent operations (e.g., uninstalling or disabling the agent service), weakening network security policies that leverage  Credential Phishing Prevention https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention  under a  Domain Credential Filter https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention/methods-to-check-for-corporate-credential-submissions  configuration.
  *  Elevated Accounts (Server Operator, Domain Join, Legacy Features): Permit increased impacts, including server control (e.g., shutdown/restart), domain manipulation (e.g., rogue computer objects), and network compromise via reconnaissance or client probing.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Palo Alto Networks
product: User-ID Credential Agent
default_status: unaffected
Credits: lang: en
value: Palo Alto Networks thanks an external reporter for discovering and reporting this issue.
Published: 2025-09-12T17:16:53.868Z
CVE-2025-4236 PCMan FTP Server MDIR Command buffer overflow
A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component MDIR Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-03T14:00:05.444Z
CVE-2025-4237 PCMan FTP Server MDELETE Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MDELETE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-03T15:00:06.769Z
CVE-2025-4238 PCMan FTP Server MGET Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component MGET Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-03T16:31:03.481Z
CVE-2025-4239 PCMan FTP Server TYPE Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component TYPE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-03T17:00:06.214Z
CVE-2025-4240 PCMan FTP Server LCD Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component LCD Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-03T17:31:04.032Z
CVE-2025-4241 PHPGurukul Teacher Subject Allocation Management System search.php sql injection
A vulnerability classified as critical has been found in PHPGurukul Teacher Subject Allocation Management System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Teacher Subject Allocation Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: bluechips (VulDB User)
Published: 2025-05-03T18:00:10.499Z
CVE-2025-4242 PHPGurukul Online Birth Certificate System between-dates-report.php sql injection
A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Online Birth Certificate System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: bluechips (VulDB User)
Published: 2025-05-03T18:31:05.347Z
CVE-2025-4243 code-projects Online Bus Reservation System print.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Affected by this issue is some unknown functionality of the file /print.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Online Bus Reservation System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: zzzxby (VulDB User)
Published: 2025-05-03T19:00:07.012Z
CVE-2025-4244 code-projects Online Bus Reservation System seatlocation.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. This affects an unknown part of the file /seatlocation.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Online Bus Reservation System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: zzzxby (VulDB User)
Published: 2025-05-03T20:00:04.848Z
CVE-2025-4247 SourceCodester Simple To-Do List System delete_task.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Simple To-Do List System 1.0. Affected is an unknown function of the file /delete_task.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Simple To-Do List System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: zonesec (VulDB User)
Published: 2025-05-04T04:31:04.835Z
CVE-2025-4248 SourceCodester Simple To-Do List System complete_task.php sql injection
A vulnerability has been found in SourceCodester Simple To-Do List System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /complete_task.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Simple To-Do List System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: zonesec (VulDB User)
Published: 2025-05-04T06:00:08.873Z
CVE-2025-4249 PHPGurukul e-Diary Management System manage-categories.php sql injection
A vulnerability was found in PHPGurukul e-Diary Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /manage-categories.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: e-Diary Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: MichaelChong (VulDB User)
lang: en
value: MichaelChong (VulDB User)
Published: 2025-05-04T06:31:05.870Z
CVE-2025-4250 code-projects Nero Social Networking Site index.php sql injection
A vulnerability was found in code-projects Nero Social Networking Site 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument fname/lname/login/password2/cpassword/address/cnumber/email/gender/propic/month leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Nero Social Networking Site
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: zzzxby (VulDB User)
Published: 2025-05-04T09:00:07.131Z
CVE-2025-4251 PCMan FTP Server RMDIR Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. This issue affects some unknown processing of the component RMDIR Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-04T22:00:06.293Z
CVE-2025-4252 PCMan FTP Server APPEND Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component APPEND Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-04T22:31:04.033Z
CVE-2025-4253 PCMan FTP Server HASH Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HASH Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-04T23:00:07.041Z
CVE-2025-4254 PCMan FTP Server LIST Command buffer overflow
A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component LIST Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-04T23:31:03.671Z
CVE-2025-4255 PCMan FTP Server RMD Command buffer overflow
A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. This affects an unknown part of the component RMD Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: PCMan
product: FTP Server
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Fernando Mengali (VulDB User)
Published: 2025-05-05T00:00:07.962Z
CVE-2025-4256 SeaCMS admin_paylog.php cross site scripting
A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of the argument cstatus leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: SeaCMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: zonesec (VulDB User)
Published: 2025-05-05T00:31:03.665Z
CVE-2025-4257 SeaCMS admin_pay.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The manipulation of the argument cstatus leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: SeaCMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: zonesec (VulDB User)
Published: 2025-05-05T01:00:07.156Z
CVE-2025-4258 zhangyanbo2007 youkefu MediaController.java upload unrestricted upload
A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu up to 4.2.0. Affected is the function Upload of the file \youkefu-master\src\main\java\com\ukefu\webim\web\handler\resource\MediaController.java. The manipulation of the argument imgFile leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: zhangyanbo2007
product: youkefu
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: Fc04dB (VulDB User)
Published: 2025-05-05T01:31:04.472Z
CVE-2025-4259 newbee-mall UploadController.java upload unrestricted upload
A vulnerability has been found in newbee-mall 1.0 and classified as critical. Affected by this vulnerability is the function Upload of the file ltd/newbee/mall/controller/common/UploadController.java. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: n/a
product: newbee-mall
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: 1098024193 (VulDB User)
Published: 2025-05-05T02:00:05.736Z