rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-48649 
In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-06-01T21:14:50.748Z
CVE-2025-48650 
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-02T18:42:27.914Z
CVE-2025-48651 
In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Unknown
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-04-06T18:20:31.044Z
CVE-2025-48652 
In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-06-01T21:14:50.877Z
CVE-2025-48653 
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-02T18:42:28.923Z
CVE-2025-48654 
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2026-03-02T18:42:29.942Z
CVE-2025-48695 
An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their privilege by abusing the following API due to the lack of access control: /api/v2/users/user/<user id>/role/ROLE/<Target role> (admin access can be achieved).
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: CyberDAVA
product: CyberDAVA
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48700 
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-23T00:00:00.000Z
CVE-2025-48701 
openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: openDCIM
product: openDCIM
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48703 
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: centos-webpanel
product: CentOS Web Panel
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-09-19T00:00:00.000Z
CVE-2025-48704 
Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Pexip
product: Infinity
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: 2025-12-25T00:00:00.000Z
CVE-2025-48705 
An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message forces the device to reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-20T00:00:00.000Z
CVE-2025-48706 
An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-20T00:00:00.000Z
CVE-2025-48707 
An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information could, in some HA use cases, be shared among administrators, which can cause secret sharing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-25T00:00:00.000Z
CVE-2025-48708 
gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext.
Problem types: cwe_id: CWE-212
description: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
Affected products: vendor: Artifex
product: Ghostscript
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48709 BMC Control-M/Server cleartext database credentials in process lists and logs
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on Windows has a database connection on, it runs 'DBUStatus.exe' frequently, which then calls 'dbu_connection_details.vbs' with the username, password, database hostname, and port written in cleartext, which can be seen in event and process logs in two separate locations. Fixed in PACTV.9.0.21.307.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
cwe_id: CWE-214
description: CWE-214 Invocation of Process Using Visible Sensitive Information
Affected products: vendor: BMC
product: Control-M/Server
default_status: affected
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 3.8
attackVector: LOCAL
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Derrick Polakoff
Published: 2025-08-07T00:00:00.000Z
CVE-2025-48710 
kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
Problem types: cwe_id: CWE-441
description: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
Affected products: vendor: kro.run
product: kro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Published: 2025-06-04T05:50:48.639Z
CVE-2025-48721 QTS, QuTS hero
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version:
QTS 5.2.8.3332 build 20251128 and later
Problem types: cwe_id: CWE-120
description: CWE-120
cwe_id: CWE-121
description: CWE-121
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
Credits: lang: en
value: Yuze Wu(h1J4cker)
Published: 2026-01-02T15:17:38.864Z
CVE-2025-48722 Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:19:33.423Z
CVE-2025-48723 Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-120
description: CWE-120
cwe_id: CWE-122
description: CWE-122
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:19:27.742Z
CVE-2025-48724 Qsync Central
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.4 ( 2026/01/20 ) and later
Problem types: cwe_id: CWE-120
description: CWE-120
cwe_id: CWE-122
description: CWE-122
Affected products: vendor: QNAP Systems Inc.
product: Qsync Central
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:19:22.172Z
CVE-2025-48725 QuTS hero
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following version:
QuTS hero h5.3.2.3354 build 20251225 and later
Problem types: cwe_id: CWE-120
description: CWE-120
cwe_id: CWE-121
description: CWE-121
Affected products: vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2026-02-11T12:19:16.450Z
CVE-2025-48726 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:33.458Z
CVE-2025-48727 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:39.613Z
CVE-2025-48728 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:45.768Z
CVE-2025-48729 QTS, QuTS hero
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:51.245Z
CVE-2025-48730 QTS, QuTS hero
A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.6.3195 build 20250715 and later
QuTS hero h5.2.6.3195 build 20250715 and later
Problem types: cwe_id: CWE-134
description: CWE-134
Affected products: vendor: QNAP Systems Inc.
product: QTS
default_status: unaffected
vendor: QNAP Systems Inc.
product: QuTS hero
default_status: unaffected
Credits: lang: en
value: coral
Published: 2025-10-03T18:10:57.322Z
CVE-2025-48731 Unauthorized Subscription Edit to Confluence Space in Mattermost Confluence Plugin
Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Mattermost
product: Mattermost Confluence Plugin
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseSeverity: MEDIUM
baseScore: 6.4
Credits: lang: en
value: Lorenzo Gallegos
Published: 2025-08-11T18:56:59.077Z
CVE-2025-48732 
An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can request a .phar file to trigger this vulnerability.
Problem types: cwe_id: CWE-184
description: CWE-184: Incomplete Blacklist
Affected products: vendor: WWBN
product: AVideo
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2025-07-24T15:10:56.720Z
CVE-2025-48733 DuraComm DP-10iN-100-MU Missing Authentication for Critical Function
DuraComm SPM-500 DP-10iN-100-MU

 lacks access controls for a function that should require user authentication. This could allow an attacker to repeatedly reboot the device.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: DuraComm Corporation
product: SPM-500 DP-10iN-100-MU
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Brandon Vincent of Arizona Public Service reported these vulnerabilities to CISA.
Published: 2025-07-22T21:35:52.983Z
CVE-2025-48734 Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Improper Access Control vulnerability in Apache Commons.



A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.





Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.

This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils

 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.


Users of the artifact org.apache.commons:commons-beanutils2

 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Apache Software Foundation
product: Apache Commons BeanUtils 1.x
default_status: unaffected
vendor: Apache Software Foundation
product: Apache Commons BeanUtils 2.x
default_status: unaffected
Credits: lang: en
value: Raj (mailto:denesh.raj@zohocorp.com)
lang: en
value: Muthukumar Marikani (mailto:muthukumar.marikani@zohocorp.com)
Published: 2025-05-28T13:32:08.300Z
CVE-2025-48735 
A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote attackers to obtain sensitive information from the database via crafted input in the request body.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: BOS
product: IP camera
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48738 
An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthenticated remote attackers to use the password reset feature without limits. This can lead to several consequences, including mailbox storage exhaustion for targeted users, reputation damage to the SMTP server, potentially causing it to be blacklisted, and overload of the SMTP server's outbound mail queue.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: StrangeBee
product: TheHive
default_status: unaffected
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48739 
A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows remote authenticated attackers with admin permissions (allowing them to access specific API endpoints) to manipulate URLs to direct requests to unexpected hosts or ports. This allows the attacker to use a TheHive server as a proxy to reach internal or otherwise restricted resources. This could be exploited to access other servers on the internal network.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: StrangeBee
product: TheHive
default_status: unaffected
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48740 
A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attacker to trigger requests on their victim's behalf, if the attacker lures a privileged user, authenticated with basic authentication.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: StrangeBee
product: TheHive
default_status: unaffected
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48741 
A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and unprivileged users to retrieve alerts, cases, logs, observables, or tasks, regardless of the user's permissions, through a specific API endpoint.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: StrangeBee
product: TheHive
default_status: unaffected
Published: 2025-05-23T00:00:00.000Z
CVE-2025-48742 
The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: SIGB
product: PMB
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: 2025-05-27T00:00:00.000Z