rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-52044 
In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into inventory_dimensions_dict parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-16T00:00:00.000Z
CVE-2025-52046 
Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-17T00:00:00.000Z
CVE-2025-52047 
In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the filters.disabled parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-30T00:00:00.000Z
CVE-2025-52048 
In Frappe 15.x.x before 15.72.0 and 14.x.x before 14.96.10, in the function add_tag() at `frappe/desk/doctype/tag/tag.py` is vulnerable to SQL Injection, which allows an attacker to extract information from databases by injecting a SQL query into the `dt` parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-15T00:00:00.000Z
CVE-2025-52049 
In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting SQL query into the timelog parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-30T00:00:00.000Z
CVE-2025-52050 
In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable to SQL Injection, which allows an attacker to extract all information from databases by injecting a SQL query into the expiry_date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-30T00:00:00.000Z
CVE-2025-52053 
TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 function via the file_name parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-15T00:00:00.000Z
CVE-2025-52054 
An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate with network services on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-28T00:00:00.000Z
CVE-2025-52074 
PHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameter when adding a product to the cart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-12T00:00:00.000Z
CVE-2025-52078 
File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privileges via a crafted POST request to the /file-upload endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-05T00:00:00.000Z
CVE-2025-52079 
The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_set.ccp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-21T00:00:00.000Z
CVE-2025-52080 
In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the share_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-15T00:00:00.000Z
CVE-2025-52081 
In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the usb_folder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-15T00:00:00.000Z
CVE-2025-52082 
In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing the read_access parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-15T00:00:00.000Z
CVE-2025-52085 
An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-52089 
A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-11T00:00:00.000Z
CVE-2025-52094 
Insecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\Setup\SmartDeploy component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-52095 
An issue in PDQ Smart Deploy V.3.0.2040 allows an attacker to escalate privileges via the Credential encryption routines in SDCommon.dll
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-52101 
linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attackers can bypass the authentication and retrieve the encrypted "password" and "salt". The password can then be obtained through brute-force cracking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-01T00:00:00.000Z
CVE-2025-52122 
Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-27T00:00:00.000Z
CVE-2025-52130 
File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-52131 
The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: xwiki-contrib
product: Mocca Calendar
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-08-03T00:00:00.000Z
CVE-2025-52132 
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: xwiki-contrib
product: Mocca Calendar
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-08-03T00:00:00.000Z
CVE-2025-52133 
The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: xwiki-contrib
product: Mocca Calendar
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2025-08-03T00:00:00.000Z
CVE-2025-52136 
In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: EMQX
product: EMQX
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
Published: 2025-08-10T00:00:00.000Z
CVE-2025-52159 
Hardcoded credentials in default configuration of PPress 0.0.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-19T00:00:00.000Z
CVE-2025-52161 
Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-08T00:00:00.000Z
CVE-2025-52162 
agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-52163 
A Server-Side Request Forgery (SSRF) in the component TunnelServlet of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows attackers to forcefully initiate connections to arbitrary internal and external resources via a crafted request. This can lead to sensitive data exposure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-52164 
Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-52166 
Incorrect access control in Software GmbH Agorum core open v11.9.2 & v11.10.1 allows authenticated attackers to escalate privileges to Administrator and access sensitive components and information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-52168 
Incorrect access control in the dynawebservice component of agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 allows unauthenticated attackers to access arbitrary files on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-52169 
agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-18T00:00:00.000Z
CVE-2025-52179 
Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-30T00:00:00.000Z
CVE-2025-52180 
Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-30T00:00:00.000Z
CVE-2025-52184 
Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52186 
Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to send HTTP requests to arbitrary URLs
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-13T00:00:00.000Z
CVE-2025-52187 
GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my_profile_update_form1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-30T00:00:00.000Z
CVE-2025-52194 
A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-21T00:00:00.000Z
CVE-2025-52196 
Server-Side Request Forgery (SSRF) vulnerability in Ctera Portal 8.1.x (8.1.1417.24) allows remote attackers to induce the server to make arbitrary HTTP requests via a crafted HTML file containing an iframe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-16T00:00:00.000Z
CVE-2025-52203 
A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are subsequently stored in the database. When a legitimate user logs in and is redirected to the Dashboard panel "automatically upon authentication the malicious script executes in the user's browser context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-52204 
A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-23T00:00:00.000Z
CVE-2025-52206 
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2025-52207 
PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: MIKO
product: MikoPBX
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 9.9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Published: 2025-06-27T00:00:00.000Z
CVE-2025-52217 
SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing injection of arbitrary HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52218 
SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allows attackers to inject arbitrary text or limited HTML into the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52219 
SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary external links via HTML Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-26T00:00:00.000Z
CVE-2025-52221 
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-08T00:00:00.000Z
CVE-2025-52222 
D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-8004w v16.07.26A1, DI-8100 v16.07.26A1, and DI-8100G v17.12.20A1 were discovered to contain a buffer overflow via the rd_en, rd_auth, rd_acct, http_hadmin, http_hadminpwd, rd_key, and rd_ip parameters in the radius_asp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-08T00:00:00.000Z
CVE-2025-52237 
An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-05T00:00:00.000Z
CVE-2025-52239 
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-04T00:00:00.000Z
CVE-2025-52263 
An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-27T00:00:00.000Z
CVE-2025-52264 
StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-27T00:00:00.000Z
CVE-2025-52268 
StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-27T00:00:00.000Z
CVE-2025-52277 
Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-52284 
Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-52287 
OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2025-52288 
Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (AMF) component, in Open5GS thru 2.7.5 allowing attackers to cause a denial of service or other unspecified impacts via repeated UE connect and disconnect message sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-08T00:00:00.000Z
CVE-2025-52289 
A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-31T00:00:00.000Z
CVE-2025-52294 
Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen and view the wallet balance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-01T00:00:00.000Z
CVE-2025-52322 
An issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a crafted Create Session Request message to the SMF (PGW-C), using the IP address of a legitimate UE in the PDN Address Allocation (PAA) field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-52327 
SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-01T00:00:00.000Z
CVE-2025-52331 
Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-12T00:00:00.000Z
CVE-2025-52335 
EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-14T00:00:00.000Z
CVE-2025-52337 
An authenticated arbitrary file upload vulnerability in the Content Explorer feature of LogicData eCommerce Framework v5.0.9.7000 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-19T00:00:00.000Z
CVE-2025-52338 
An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and compromise user accounts via a bruteforce attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-19T00:00:00.000Z
CVE-2025-52344 
Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's browser via the Group name and Project Description input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-15T00:00:00.000Z