rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-53505 
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. If this vulnerability is exploited, information on the server hosting the product may be exposed.
Problem types: cwe_id: CWE-22
description: Improper limitation of a pathname to a restricted directory ('Path Traversal')
Affected products: vendor: Intermesh BV
product: Group-Office
vendor: Intermesh BV
product: Group-Office
Published: 2025-08-21T04:29:44.539Z
CVE-2025-53506 Apache Tomcat: DoS via excessive h2 streams at connection start
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: Kanatoko
Published: 2025-07-10T19:14:23.249Z
CVE-2025-53507 
Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as admin password, may be disclosed. As for the details of affected product names and versions, refer to the information under [Product Status].
Problem types: cwe_id: CWE-922
description: Insecure storage of sensitive information
Affected products: vendor: iND Co.,Ltd
product: HL330-DLS (for module MC7700)
vendor: iND Co.,Ltd
product: HL330-DLS (for module MC7330)
vendor: iND Co.,Ltd
product: HL320-DLS (for module MC7700)
vendor: iND Co.,Ltd
product: HL320-DLS (for module MC7330)
vendor: iND Co.,Ltd
product: LM-100
vendor: iND Co.,Ltd
product: LM-200 (for module AMP570)
vendor: iND Co.,Ltd
product: LM-200 (for module EC25-J)
vendor: iND Co.,Ltd
product: L2X Assist
vendor: iND Co.,Ltd
product: L2X Assist-RS-A
vendor: iND Co.,Ltd
product: L2X Assist-RS-E
vendor: iND Co.,Ltd
product: F2L Assist-SS-A
vendor: iND Co.,Ltd
product: F2L Assist-SS-E
Published: 2025-08-29T04:13:58.310Z
CVE-2025-53508 
Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed and sensitive information may be obtained. As for the details of affected product names and versions, refer to the information under [Product Status].
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: iND Co.,Ltd
product: HL330-DLS (for module MC7700)
vendor: iND Co.,Ltd
product: HL330-DLS (for module MC7330)
vendor: iND Co.,Ltd
product: HL320-DLS (for module MC7700)
vendor: iND Co.,Ltd
product: HL320-DLS (for module MC7330)
vendor: iND Co.,Ltd
product: LM-100
vendor: iND Co.,Ltd
product: LM-200 (for module AMP570)
vendor: iND Co.,Ltd
product: LM-200 (for module EC25-J)
vendor: iND Co.,Ltd
product: L2X Assist
vendor: iND Co.,Ltd
product: L2X Assist-RS-A
vendor: iND Co.,Ltd
product: L2X Assist-RS-E
vendor: iND Co.,Ltd
product: F2L Assist-SS-A
vendor: iND Co.,Ltd
product: F2L Assist-SS-E
Published: 2025-08-29T04:14:39.074Z
CVE-2025-53509 Advantech iView Argument Injection
A vulnerability exists in Advantech iView that allows for argument 
injection in the NetworkServlet.restoreDatabase(). This issue requires 
an authenticated attacker with at least user-level privileges. An input 
parameter can be used directly in a command without proper sanitization,
 allowing arbitrary arguments to be injected. This can result in 
information disclosure, including sensitive database credentials.
Problem types: cwe_id: CWE-88
description: CWE-88
Affected products: vendor: Advantech
product: iView
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Alex Williams of Converge Technology Solutions reported these vulnerabilities to CISA.
Published: 2025-07-10T23:29:10.103Z
CVE-2025-53510 
A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .psd file, an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
Problem types: cwe_id: CWE-680
description: CWE-680: Integer Overflow to Buffer Overflow
Affected products: vendor: SAIL Image Decoding Library
product: SAIL Image Decoding Library
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by a member of Cisco Talos.
Published: 2025-08-25T14:17:41.763Z
CVE-2025-53511 
A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: The Biosig Project
product: libbiosig
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Mark Bereza and Lilith &gt;_&gt; of Cisco Talos.
Published: 2025-08-25T13:53:39.120Z
CVE-2025-53512 Sensitive log retrieval in Juju
The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
cwe_id: CWE-285
description: CWE-285 Improper Authentication
Affected products: vendor: Canonical
product: Juju
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-07-08T16:47:44.427Z
CVE-2025-53513 Zip slip vulnerability in Juju
The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.
Problem types: cwe_id: CWE-24
description: CWE-24: Path Traversal: '../filedir'
Affected products: vendor: Canonical
product: Juju
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-08T16:57:06.351Z
CVE-2025-53514 Unexpected Input to Server Webhook endpoint Causes DoS in Mattermost Confluence Plugin
Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Mattermost
product: Mattermost Confluence Plugin
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
baseSeverity: MEDIUM
baseScore: 5.9
Credits: lang: en
value: Lorenzo Gallegos
Published: 2025-08-11T18:57:01.515Z
CVE-2025-53515 Advantech iView SQL Injection
A vulnerability exists in Advantech iView that allows for SQL injection 
and remote code execution through NetworkServlet.archiveTrap(). This 
issue requires an authenticated attacker with at least user-level 
privileges. Certain input parameters are not sanitized, allowing an 
attacker to perform SQL injection and potentially execute code in the 
context of the 'nt authority\local service' account.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Advantech
product: iView
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Alex Williams of Converge Technology Solutions reported these vulnerabilities to CISA.
Published: 2025-07-10T23:25:51.561Z
CVE-2025-53516 
A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:50:09.451Z
CVE-2025-53518 
An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ABF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: The Biosig Project
product: libbiosig
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Mark Bereza and Lilith &gt;_&gt; of Cisco Talos.
Published: 2025-08-25T13:53:51.327Z
CVE-2025-53519 Advantech iView Cross-site Scripting
A vulnerability exists in Advantech iView versions prior to 5.7.05 build
 7057, which could allow a reflected cross-site scripting (XSS) attack. 
By manipulating specific parameters, an attacker could execute 
unauthorized scripts in the user's browser, potentially leading to 
information disclosure or other malicious activities.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Advantech
product: iView
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Alex Williams of Converge Technology Solutions reported these vulnerabilities to CISA.
Published: 2025-07-10T23:14:37.185Z
CVE-2025-53520 EG4 Electronics EG4 Inverters Download of Code Without Integrity Check
The affected product allows firmware updates to be downloaded from EG4's
 website, transferred via USB dongles, or installed through EG4's 
Monitoring Center (remote, cloud-connected interface) or via a serial 
connection, and can install these files without integrity checks. The 
TTComp archive format used for the firmware is unencrypted and can be 
unpacked and altered without detection.
Problem types: cwe_id: CWE-494
description: CWE-494
Affected products: vendor: EG4 Electronics
product: EG4 12kPV
default_status: unaffected
vendor: EG4 Electronics
product: EG4 18kPV
default_status: unaffected
vendor: EG4 Electronics
product: EG4 Flex 21
default_status: unaffected
vendor: EG4 Electronics
product: EG4 Flex 18
default_status: unaffected
vendor: EG4 Electronics
product: EG4 6000XP
default_status: unaffected
vendor: EG4 Electronics
product: EG4 12000XP
default_status: unaffected
vendor: EG4 Electronics
product: EG4 GridBoss
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Anthony Rose of BC Security reported these vulnerabilities to CISA.
Published: 2025-08-08T16:09:02.072Z
CVE-2025-53521 BigIP APM Vulnerability
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: F5 would like to thank Kristian Vlaardingerbroek, Hugo Trippaers, and other people of Schuberg Philis; Bart Vrancken; Fox-IT; and the National Cyber Security Centre (NCSC) in the Netherlands for their assistance in investigating this issue and following the highest standards of coordinated disclosure.
Published: 2025-10-15T13:55:52.694Z
CVE-2025-53522 
Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unauthenticated attacker.
Problem types: cwe_id: CWE-348
description: Use of less trusted source
Affected products: vendor: Six Apart Ltd.
product: Movable Type (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type Advanced (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type Advanced (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type Premium (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type Premium (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type Premium (Advanced Edition) (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type Premium (Advanced Edition) (Software Edition)
vendor: Six Apart Ltd.
product: Movable Type (Cloud Edition)
vendor: Six Apart Ltd.
product: Movable Type (Cloud Edition)
vendor: Six Apart Ltd.
product: Movable Type Premium  (Cloud Edition)
vendor: Six Apart Ltd.
product: Movable Type Premium  (Cloud Edition)
Published: 2025-08-20T04:22:51.144Z
CVE-2025-53523 
Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. A logged-in user can prepare a malicious page or URL, and an arbitrary script may be executed on the web browser when another user accesses it.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Japan Total System Co.,Ltd.
product: GroupSession Free edition
vendor: Japan Total System Co.,Ltd.
product: GroupSession byCloud
vendor: Japan Total System Co.,Ltd.
product: GroupSession ZION
Published: 2025-12-12T05:01:23.633Z
CVE-2025-53524 Fuji Electric Monitouch V-SFT-6 Out-of-bounds Write
Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write 
while processing a specially crafted project file, which may allow an 
attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: Fuji Electric
product: Monitouch V-SFT-6
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Rocco Calvi with TecSecurity working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2025-12-17T00:19:13.321Z
CVE-2025-53525 WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameter
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: LabRedesCefetRJ
product: WeGIA
Published: 2025-07-07T16:30:25.627Z
CVE-2025-53526 WeGIA allows Stored XSS attacks in novo_memorando.php
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php.
After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: LabRedesCefetRJ
product: WeGIA
Published: 2025-07-07T16:36:45.447Z
CVE-2025-53527 WeGIA allows Time-Based Blind SQL Injection in the relatorio_geracao.php endpoint
WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LabRedesCefetRJ
product: WeGIA
Published: 2025-07-07T16:47:04.624Z
CVE-2025-53528 Cadwyn is vulnerable to an XSS attack through its docs page
Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" endpoint is vulnerable to a Reflected XSS (Cross-Site Scripting) attack. This XSS would notably allow an attacker to execute JavaScript code on a user's session for any application based on Cadwyn via a one-click attack. The vulnerability has been fixed in version 5.4.3.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: zmievsa
product: cadwyn
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
Published: 2025-07-21T20:15:17.464Z
CVE-2025-53529 WeGIA allows SQL Injection in html/funcionario/profile_funcionario.php (id_funcionario parameter)
WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: LabRedesCefetRJ
product: WeGIA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-07T16:51:03.848Z
CVE-2025-53530 WeGIA  allows Uncontrolled Resource Consumption via the errorstr parameter
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks.  This vulnerability is fixed in 3.3.0.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: LabRedesCefetRJ
product: WeGIA
Published: 2025-07-07T17:00:57.957Z
CVE-2025-53531 WeGIA allows Uncontrolled Resource Consumption via the fid parameter
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks. This vulnerability is fixed in 3.3.0.
Problem types: cwe_id: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
Affected products: vendor: LabRedesCefetRJ
product: WeGIA
Published: 2025-07-07T17:02:33.439Z