rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-5888 jsnjfz WebStack-Guns cross-site request forgery
A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: jsnjfz
product: WebStack-Guns
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: aiyakami (VulDB User)
Published: 2025-06-09T17:31:05.469Z
CVE-2025-5889 juliangruber brace-expansion index.js expand redos
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: juliangruber
product: brace-expansion
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: mmmsssttt (VulDB User)
lang: en
value: tgerbet_enalean (VulDB User)
Published: 2025-06-09T18:16:01.889Z
CVE-2025-5890 actions toolkit glob internal-pattern.ts globEscape redos
A vulnerability classified as problematic has been found in actions toolkit 0.5.0. This affects the function globEscape of the file toolkit/packages/glob/src/internal-pattern.ts of the component glob. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: actions
product: toolkit
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:T/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: mmmsssttt (VulDB User)
Published: 2025-06-09T18:31:05.291Z
CVE-2025-5891 Unitech pm2 Config.js redos
A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: Unitech
product: pm2
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: mmmsssttt (VulDB User)
Published: 2025-06-09T19:00:16.482Z
CVE-2025-5892 RocketChat parseMessage.js parseMessage redos
A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: n/a
product: RocketChat
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:T/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: mmmsssttt (VulDB User)
Published: 2025-06-09T19:31:05.464Z
CVE-2025-5893 Honding Technology Smart Parking Management System - Exposure of Sensitive Information
Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
cwe_id: CWE-256
description: CWE-256 Plaintext Storage of a Password
Affected products: vendor: Honding Technology
product: Smart Parking Management System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-09T06:54:05.495Z
CVE-2025-5894 Honding Technology Smart Parking Management System - Missing Authorization
Smart Parking Management System from Honding Technology has a Missing Authorization vulnerability, allowing remote attackers with regular privileges to access a specific functionality to create administrator accounts, and subsequently log into the system using those accounts.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Honding Technology
product: Smart Parking Management System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-09T07:33:11.758Z
CVE-2025-5895 Metabase dom.js parseDataUri redos
A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: n/a
product: Metabase
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: mmmsssttt (VulDB User)
Published: 2025-06-09T20:00:19.261Z
CVE-2025-5896 tarojs taro index.js redos
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: tarojs
product: taro
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: mmmsssttt (VulDB User)
Published: 2025-06-09T20:31:07.141Z
CVE-2025-5897 vuejs vue-cli Markdown Code HtmlPwaPlugin.js HtmlPwaPlugin redos
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.
Problem types: cwe_id: CWE-1333
description: Inefficient Regular Expression Complexity
cwe_id: CWE-400
description: Resource Consumption
Affected products: vendor: vuejs
product: vue-cli
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:T/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: mmmsssttt (VulDB User)
Published: 2025-06-09T21:00:17.023Z
CVE-2025-5898 GNU PSPP pspp-convert.c parse_variables_option out-of-bounds write
A vulnerability classified as critical has been found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to out-of-bounds write. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: GNU
product: PSPP
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Published: 2025-06-09T21:31:06.185Z
CVE-2025-5899 GNU PSPP pspp-convert.c parse_variables_option free of memory not on the heap
A vulnerability classified as critical was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. Affected by this vulnerability is the function parse_variables_option of the file utilities/pspp-convert.c. The manipulation leads to free of memory not on the heap. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-590
description: Free of Memory not on the Heap
Affected products: vendor: GNU
product: PSPP
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Published: 2025-06-09T22:00:15.952Z
CVE-2025-5900 Tenda AC9 cross-site request forgery
A vulnerability, which was classified as problematic, was found in Tenda AC9 15.03.02.13. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Tenda
product: AC9
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: ysnysn0121 (VulDB User)
Published: 2025-06-09T22:00:19.518Z
CVE-2025-5901 TOTOLINK T10 POST Request cstecgi.cgi UploadCustomModule buffer overflow
A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: T10
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Yangshuangning (VulDB User)
Published: 2025-06-09T22:31:07.562Z
CVE-2025-5902 TOTOLINK T10 POST Request cstecgi.cgi setUpgradeFW buffer overflow
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument slaveIpList leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: T10
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Yangshuangning (VulDB User)
Published: 2025-06-09T23:00:16.214Z
CVE-2025-5903 TOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflow
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: T10
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: ysnysnysn (VulDB User)
Published: 2025-06-09T23:31:07.307Z
CVE-2025-5904 TOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflow
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: T10
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: ysnysn (VulDB User)
Published: 2025-06-10T00:00:16.259Z
CVE-2025-5905 TOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflow
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument Password leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: T10
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: ysnysn0121 (VulDB User)
Published: 2025-06-10T00:00:18.830Z
CVE-2025-5906 code-projects Laundry System data missing authentication
A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: code-projects
product: Laundry System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: DS_Leo (VulDB User)
Published: 2025-06-10T00:31:05.610Z
CVE-2025-5907 TOTOLINK EX1200T HTTP POST Request formFilter buffer overflow
A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: EX1200T
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: wang_lun (VulDB User)
Published: 2025-06-10T00:31:08.647Z
CVE-2025-5908 TOTOLINK EX1200T HTTP POST Request formIpQoS buffer overflow
A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: EX1200T
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: wang_lun (VulDB User)
Published: 2025-06-10T01:00:24.382Z
CVE-2025-5909 TOTOLINK EX1200T HTTP POST Request formReflashClientTbl buffer overflow
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: EX1200T
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: wang_lun (VulDB User)
Published: 2025-06-10T01:31:07.748Z
CVE-2025-5910 TOTOLINK EX1200T HTTP POST Request formWsc buffer overflow
A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: EX1200T
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: wang_lun (VulDB User)
Published: 2025-06-10T02:00:13.598Z
CVE-2025-5911 TOTOLINK EX1200T HTTP POST Request formDMZ buffer overflow
A vulnerability was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: TOTOLINK
product: EX1200T
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: wang_lun (VulDB User)
Published: 2025-06-10T02:31:06.182Z
CVE-2025-5912 D-Link DIR-632 HTTP POST Request do_file stack-based overflow
A vulnerability was found in D-Link DIR-632 FW103B08. It has been declared as critical. This vulnerability affects the function do_file of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: D-Link
product: DIR-632
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: xiaobor123 (VulDB User)
Published: 2025-06-10T03:00:17.489Z
CVE-2025-5913 PHPGurukul Vehicle Record Management System search-vehicle.php sql injection
A vulnerability was found in PHPGurukul Vehicle Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchinputdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: PHPGurukul
product: Vehicle Record Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Jww0KA (VulDB User)
Published: 2025-06-10T03:31:06.816Z
CVE-2025-5915 Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c
A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
cpes: cpe:/a:redhat:openshift:4
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
version: 3.1
Published: 2025-06-09T19:49:02.143Z