Instruction: Please provide detailed information about CVE-2025-1771

CVE:CVE-2025-1771
Description:The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
published:2025-03-15T05:15:47.253


Instruction: Please provide detailed information about CVE-2025-1773

CVE:CVE-2025-1773
Description:The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
published:2025-03-15T05:15:47.403


Instruction: Please provide detailed information about CVE-2025-30066

CVE:CVE-2025-30066
Description:tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
published:2025-03-15T06:15:12.193


Instruction: Please provide detailed information about CVE-2025-2157

CVE:CVE-2025-2157
Description:A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.
published:2025-03-15T07:15:34.930


Instruction: Please provide detailed information about CVE-2025-2325

CVE:CVE-2025-2325
Description:The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-15T07:15:35.107


Instruction: Please provide detailed information about CVE-2025-1057

CVE:CVE-2025-1057
Description:A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store agent registration data as bytes, whereas the updated registrar expects str. This issue leads to an exception when processing agent registration requests, causing the agent to fail.
published:2025-03-15T09:15:10.770


Instruction: Please provide detailed information about CVE-2025-1530

CVE:CVE-2025-1530
Description:The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-15T12:15:11.890


Instruction: Please provide detailed information about CVE-2025-2025

CVE:CVE-2025-2025
Description:The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
published:2025-03-15T12:15:12.207


Instruction: Please provide detailed information about CVE-2025-2321

CVE:CVE-2025-2321
Description:A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to business logic errors. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-15T12:15:12.393


Instruction: Please provide detailed information about CVE-2025-2333

CVE:CVE-2025-2333
Description:Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
published:2025-03-15T12:15:12.610


Instruction: Please provide detailed information about CVE-2025-2322

CVE:CVE-2025-2322
Description:A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-15T14:15:28.220


Instruction: Please provide detailed information about CVE-2025-2323

CVE:CVE-2025-2323
Description:A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQuestionCou of the file /api/mjkj-chat/chat/mng/update/questionCou of the component Number of Question Handler. The manipulation leads to enforcement of behavioral workflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-15T17:15:36.610


Instruction: Please provide detailed information about CVE-2025-25225

CVE:CVE-2025-25225
Description:A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
published:2025-03-15T18:15:13.380


Instruction: Please provide detailed information about CVE-2025-23744

CVE:CVE-2025-23744
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton allows Reflected XSS. This issue affects Random Posts, Mp3 Player + ShareButton: from n/a through 1.4.1.
published:2025-03-15T22:15:12.777


Instruction: Please provide detailed information about CVE-2025-26548

CVE:CVE-2025-26548
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Random Image Selector allows Reflected XSS. This issue affects Random Image Selector: from n/a through 2.4.
published:2025-03-15T22:15:12.933


Instruction: Please provide detailed information about CVE-2025-26553

CVE:CVE-2025-26553
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin allows Reflected XSS. This issue affects Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin: from n/a through 2.2.
published:2025-03-15T22:15:13.117


Instruction: Please provide detailed information about CVE-2025-26554

CVE:CVE-2025-26554
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP Discord Post allows Reflected XSS. This issue affects WP Discord Post: from n/a through 2.1.0.
published:2025-03-15T22:15:13.267


Instruction: Please provide detailed information about CVE-2025-26555

CVE:CVE-2025-26555
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Debug-Bar-Extender allows Reflected XSS. This issue affects Debug-Bar-Extender: from n/a through 0.5.
published:2025-03-15T22:15:13.413


Instruction: Please provide detailed information about CVE-2025-26556

CVE:CVE-2025-26556
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS allows Reflected XSS. This issue affects WP AntiDDOS: from n/a through 2.0.
published:2025-03-15T22:15:13.553


Instruction: Please provide detailed information about CVE-2025-26875

CVE:CVE-2025-26875
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce allows SQL Injection. This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through 1.3.
published:2025-03-15T22:15:13.690


Instruction: Please provide detailed information about CVE-2025-26886

CVE:CVE-2025-26886
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors allows SQL Injection. This issue affects PublishPress Authors: from n/a through 4.7.3.
published:2025-03-15T22:15:13.837


Instruction: Please provide detailed information about CVE-2025-26895

CVE:CVE-2025-26895
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maennchen1.de m1.DownloadList allows DOM-Based XSS. This issue affects m1.DownloadList: from n/a through 0.19.
published:2025-03-15T22:15:14.013


Instruction: Please provide detailed information about CVE-2025-26899

CVE:CVE-2025-26899
Description:Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce allows Cross Site Request Forgery. This issue affects Recapture for WooCommerce: from n/a through 1.0.43.
published:2025-03-15T22:15:14.250


Instruction: Please provide detailed information about CVE-2025-26921

CVE:CVE-2025-26921
Description:Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager allows Object Injection. This issue affects Booking and Rental Manager: from n/a through 2.2.6.
published:2025-03-15T22:15:14.517


Instruction: Please provide detailed information about CVE-2025-26924

CVE:CVE-2025-26924
Description:Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Ohio Extra allows Code Injection. This issue affects Ohio Extra: from n/a through 3.4.7.
published:2025-03-15T22:15:14.663


Instruction: Please provide detailed information about CVE-2025-26940

CVE:CVE-2025-26940
Description:Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
published:2025-03-15T22:15:14.810


Instruction: Please provide detailed information about CVE-2025-26961

CVE:CVE-2025-26961
Description:Missing Authorization vulnerability in NotFound Fresh Framework allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fresh Framework: from n/a through 1.70.0.
published:2025-03-15T22:15:14.960


Instruction: Please provide detailed information about CVE-2025-26969

CVE:CVE-2025-26969
Description:Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.
published:2025-03-15T22:15:15.120


Instruction: Please provide detailed information about CVE-2025-26972

CVE:CVE-2025-26972
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.
published:2025-03-15T22:15:15.263


Instruction: Please provide detailed information about CVE-2025-26976

CVE:CVE-2025-26976
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.4.
published:2025-03-15T22:15:15.407


Instruction: Please provide detailed information about CVE-2025-26978

CVE:CVE-2025-26978
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound FS Poster. This issue affects FS Poster: from n/a through 6.5.8.
published:2025-03-15T22:15:15.553


Instruction: Please provide detailed information about CVE-2025-27281

CVE:CVE-2025-27281
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cookforweb All In Menu allows Blind SQL Injection. This issue affects All In Menu: from n/a through 1.1.5.
published:2025-03-15T22:15:15.697


Instruction: Please provide detailed information about CVE-2025-0524

CVE:CVE-2025-0524
Description:Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
published:2025-03-15T23:15:36.430


Instruction: Please provide detailed information about CVE-2025-2334

CVE:CVE-2025-2334
Description:A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-15T23:15:36.980


Instruction: Please provide detailed information about CVE-2025-2335

CVE:CVE-2025-2335
Description:A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T03:15:37.907


Instruction: Please provide detailed information about CVE-2025-30074

CVE:CVE-2025-30074
Description:Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine.
published:2025-03-16T03:15:39.117


Instruction: Please provide detailed information about CVE-2025-30076

CVE:CVE-2025-30076
Description:Koha before 24.11.02 allows admins to execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter.
published:2025-03-16T03:15:39.273


Instruction: Please provide detailed information about CVE-2025-30077

CVE:CVE-2025-30077
Description:Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.
published:2025-03-16T03:15:39.437


Instruction: Please provide detailed information about CVE-2025-24856

CVE:CVE-2025-24856
Description:An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking attack, leading to Account Takeover. The attack can only be exploited if the following requirements are met: (1) an attacker can anticipate the e-mail address of the user, (2) an attacker can register a public frontend user account using that e-mail address before the user's first OIDC login, and (3) the IDP returns an email field containing the e-mail address of the user,
published:2025-03-16T04:15:14.517


Instruction: Please provide detailed information about CVE-2025-1619

CVE:CVE-2025-1619
Description:The GDPR Cookie Compliance  WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-16T06:15:12.610


Instruction: Please provide detailed information about CVE-2025-1620

CVE:CVE-2025-1620
Description:The GDPR Cookie Compliance  WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-16T06:15:12.730


Instruction: Please provide detailed information about CVE-2025-1621

CVE:CVE-2025-1621
Description:The GDPR Cookie Compliance  WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-16T06:15:12.857


Instruction: Please provide detailed information about CVE-2025-1622

CVE:CVE-2025-1622
Description:The GDPR Cookie Compliance  WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-16T06:15:12.977


Instruction: Please provide detailed information about CVE-2025-1623

CVE:CVE-2025-1623
Description:The GDPR Cookie Compliance  WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-16T06:15:13.093


Instruction: Please provide detailed information about CVE-2025-1624

CVE:CVE-2025-1624
Description:The GDPR Cookie Compliance  WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
published:2025-03-16T06:15:13.210


Instruction: Please provide detailed information about CVE-2025-2337

CVE:CVE-2025-2337
Description:A vulnerability, which was classified as critical, has been found in tbeu matio 1.5.28. This issue affects the function Mat_VarPrint of the file src/mat.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-16T10:15:25.793


Instruction: Please provide detailed information about CVE-2025-2338

CVE:CVE-2025-2338
Description:A vulnerability, which was classified as critical, was found in tbeu matio 1.5.28. Affected is the function strdup_vprintf of the file src/io.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-16T13:15:37.827


Instruction: Please provide detailed information about CVE-2025-2339

CVE:CVE-2025-2339
Description:A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-16T13:15:38.003


Instruction: Please provide detailed information about CVE-2025-2340

CVE:CVE-2025-2340
Description:A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-16T14:15:12.597


Instruction: Please provide detailed information about CVE-2025-2341

CVE:CVE-2025-2341
Description:A vulnerability was found in IROAD Dash Cam X5 up to 20250203. It has been rated as problematic. This issue affects some unknown processing of the component SSID. The manipulation leads to use of default credentials. The attack needs to be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T15:15:36.523


Instruction: Please provide detailed information about CVE-2025-2342

CVE:CVE-2025-2342
Description:A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the component API Endpoint. The manipulation leads to hard-coded credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T16:15:11.613


Instruction: Please provide detailed information about CVE-2025-2343

CVE:CVE-2025-2343
Description:A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionality of the component Device Pairing. The manipulation leads to hard-coded credentials. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T18:15:11.830


Instruction: Please provide detailed information about CVE-2025-2344

CVE:CVE-2025-2344
Description:A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T18:15:12.113


Instruction: Please provide detailed information about CVE-2025-2345

CVE:CVE-2025-2345
Description:A vulnerability, which was classified as very critical, was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. This affects an unknown part. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T19:15:36.510


Instruction: Please provide detailed information about CVE-2025-2346

CVE:CVE-2025-2346
Description:A vulnerability has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308 and classified as problematic. This vulnerability affects unknown code of the component Domain Handler. The manipulation of the argument Domain Name leads to origin validation error. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.
published:2025-03-16T20:15:11.603


Instruction: Please provide detailed information about CVE-2025-2347

CVE:CVE-2025-2347
Description:A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of default password. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-16T21:15:37.617


Instruction: Please provide detailed information about CVE-2025-2348

CVE:CVE-2025-2348
Description:A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been classified as problematic. Affected is an unknown function of the file /mnt/extsd/event/ of the component HTTP/RTSP. The manipulation leads to information disclosure. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
published:2025-03-16T21:15:37.783


Instruction: Please provide detailed information about CVE-2025-2349

CVE:CVE-2025-2349
Description:A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/passwd of the component Password Hash Handler. The manipulation leads to password hash with insufficient computational effort. Access to the local network is required for this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
published:2025-03-16T22:15:11.747


Instruction: Please provide detailed information about CVE-2025-2350

CVE:CVE-2025-2350
Description:A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been rated as critical. Affected by this issue is some unknown functionality of the file /action/upload_file. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
published:2025-03-16T22:15:13.023


Instruction: Please provide detailed information about CVE-2025-2351

CVE:CVE-2025-2351
Description:A vulnerability classified as critical was found in DayCloud StudentManage 1.0. This vulnerability affects unknown code of the file /admin/adminScoreUrl of the component Login Endpoint. The manipulation of the argument query leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T23:15:47.710


Instruction: Please provide detailed information about CVE-2025-2352

CVE:CVE-2025-2352
Description:A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /admin/indexConfigs/save of the component Backend. The manipulation of the argument categoryName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-16T23:15:47.890


Instruction: Please provide detailed information about CVE-2025-2353

CVE:CVE-2025-2353
Description:A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registry_id/plane_icao leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T00:15:11.893


Instruction: Please provide detailed information about CVE-2025-2354

CVE:CVE-2025-2354
Description:A vulnerability has been found in VAM Virtual Airlines Manager 2.6.2 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vam/index.php. The manipulation of the argument registry_id/plane_icao/hub_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T00:15:12.873


Instruction: Please provide detailed information about CVE-2025-30089

CVE:CVE-2025-30089
Description:gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.
published:2025-03-17T00:15:13.067


Instruction: Please provide detailed information about CVE-2025-2355

CVE:CVE-2025-2355
Description:A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component API Endpoint Handler. The manipulation of the argument BCS_TOKEN/SECRET_KEY leads to unprotected storage of credentials. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T01:15:36.523


Instruction: Please provide detailed information about CVE-2025-2356

CVE:CVE-2025-2356
Description:A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T01:15:37.487


Instruction: Please provide detailed information about CVE-2025-2357

CVE:CVE-2025-2357
Description:A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
published:2025-03-17T02:15:13.583


Instruction: Please provide detailed information about CVE-2025-2358

CVE:CVE-2025-2358
Description:A vulnerability was found in Shenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Kfxt/Service.asmx of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T03:15:39.000


Instruction: Please provide detailed information about CVE-2025-2359

CVE:CVE-2025-2359
Description:A vulnerability classified as critical has been found in D-Link DIR-823G 1.0.2B05_20181207. Affected is the function SetDDNSSettings of the file /HNAP1/ of the component DDNS Service. The manipulation of the argument SOAPAction leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-17T04:15:11.320


Instruction: Please provide detailed information about CVE-2025-2360

CVE:CVE-2025-2360
Description:A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-17T04:15:16.090


Instruction: Please provide detailed information about CVE-2025-2361

CVE:CVE-2025-2361
Description:A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T05:15:36.713


Instruction: Please provide detailed information about CVE-2025-2362

CVE:CVE-2025-2362
Description:A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/contact-us.php. The manipulation of the argument mobnum leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-17T05:15:37.353


Instruction: Please provide detailed information about CVE-2025-2363

CVE:CVE-2025-2363
Description:A vulnerability classified as critical has been found in lenve VBlog up to 1.0.0. Affected is the function uploadImg of the file blogserver/src/main/java/org/sang/controller/ArticleController.java. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T06:15:25.387


Instruction: Please provide detailed information about CVE-2025-2364

CVE:CVE-2025-2364
Description:A vulnerability classified as problematic was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function addNewArticle of the file blogserver/src/main/java/org/sang/service/ArticleService.java. The manipulation of the argument mdContent/htmlContent leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T06:15:25.683


Instruction: Please provide detailed information about CVE-2025-2395

CVE:CVE-2025-2395
Description:The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter cookies to log in as an administrator.
published:2025-03-17T06:15:25.910


Instruction: Please provide detailed information about CVE-2025-2396

CVE:CVE-2025-2396
Description:The U-Office Force from e-Excellence has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
published:2025-03-17T06:15:26.113


Instruction: Please provide detailed information about CVE-2025-1724

CVE:CVE-2025-1724
Description:Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.
published:2025-03-17T07:15:33.467


Instruction: Please provide detailed information about CVE-2025-2365

CVE:CVE-2025-2365
Description:A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T07:15:33.847


Instruction: Please provide detailed information about CVE-2025-2366

CVE:CVE-2025-2366
Description:A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the component Add Department Page. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T07:15:34.067


Instruction: Please provide detailed information about CVE-2025-2367

CVE:CVE-2025-2367
Description:A vulnerability has been found in Oiwtech OIW-2431APGN-HP 2.5.3-B20131128 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formScript of the component Personal Script Submenu. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T08:15:11.283


Instruction: Please provide detailed information about CVE-2025-2368

CVE:CVE-2025-2368
Description:A vulnerability was found in WebAssembly wabt 1.0.36 and classified as critical. This issue affects the function wabt::interp::(anonymous namespace)::BinaryReaderInterp::OnExport of the file wabt/src/interp/binary-reader-interp.cc of the component Malformed File Handler. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
published:2025-03-17T08:15:11.493


Instruction: Please provide detailed information about CVE-2025-2369

CVE:CVE-2025-2369
Description:A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been classified as critical. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument admpass leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T09:15:12.653


Instruction: Please provide detailed information about CVE-2025-2370

CVE:CVE-2025-2370
Description:A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been declared as critical. Affected by this vulnerability is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliSsid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T09:15:13.510


Instruction: Please provide detailed information about CVE-2025-2199

CVE:CVE-2025-2199
Description:SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query in ‘searchActionsToUpdate’, ‘searchSpecialitiesPending’, ‘searchSpecialitiesLinked’, ‘searchUsersToUpdateProfile’, ‘training_action_data’, ‘showContinuingTrainingCourses’ and ‘showUsersToEdit’ in /local/administration/ajax.php.
published:2025-03-17T10:15:16.243


Instruction: Please provide detailed information about CVE-2025-2200

CVE:CVE-2025-2200
Description:SQL injection vulnerability in the IcProgreso Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain, update and delete data from the database by injecting an SQL query on the parameters user, id, idGroup, start_date and end_date in the endpoint /report/icprogreso/generar_blocks.php.
published:2025-03-17T10:15:16.400


Instruction: Please provide detailed information about CVE-2025-2201

CVE:CVE-2025-2201
Description:Broken access control vulnerability in the IcProgress Innovación y Cualificación plugin. This vulnerability allows an attacker to obtain sensitive information about other users such as public IP addresses, messages with other users and more.
published:2025-03-17T10:15:16.543


Instruction: Please provide detailed information about CVE-2025-2371

CVE:CVE-2025-2371
Description:A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /registered-user-testing.php of the component Registered Mobile Number Search. The manipulation of the argument regmobilenumber leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T10:15:16.687


Instruction: Please provide detailed information about CVE-2025-2372

CVE:CVE-2025-2372
Description:A vulnerability classified as critical has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This affects an unknown part of the file /password-recovery.php of the component Password Recovery Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T10:15:16.917


Instruction: Please provide detailed information about CVE-2025-2202

CVE:CVE-2025-2202
Description:Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.
published:2025-03-17T11:15:37.970


Instruction: Please provide detailed information about CVE-2025-2373

CVE:CVE-2025-2373
Description:A vulnerability classified as critical was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This vulnerability affects unknown code of the file /check_availability.php. The manipulation of the argument mobnumber/employeeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T11:15:38.113


Instruction: Please provide detailed information about CVE-2025-2374

CVE:CVE-2025-2374
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument aid/adminname/mobilenumber/email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T11:15:38.330


Instruction: Please provide detailed information about CVE-2025-2375

CVE:CVE-2025-2375
Description:A vulnerability, which was classified as problematic, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /profile.php of the component Admin Profile Page. The manipulation of the argument email leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T12:15:13.733


Instruction: Please provide detailed information about CVE-2025-2376

CVE:CVE-2025-2376
Description:A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The manipulation of the argument cookieName leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T12:15:13.983


Instruction: Please provide detailed information about CVE-2025-2377

CVE:CVE-2025-2377
Description:A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /confirmbooking.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting product names.
published:2025-03-17T13:15:38.937


Instruction: Please provide detailed information about CVE-2025-2378

CVE:CVE-2025-2378
Description:A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been classified as critical. This affects an unknown part of the file /download-medical-cards.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T13:15:39.513


Instruction: Please provide detailed information about CVE-2025-2401

CVE:CVE-2025-2401
Description:Buffer overflow vulnerability in Immunity Debugger affecting version 1.85, its exploitation could allow a local attacker to execute arbitrary code, due to the lack of proper boundary checking.
published:2025-03-17T13:15:39.803


Instruction: Please provide detailed information about CVE-2025-0595

CVE:CVE-2025-0595
Description:A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.000


Instruction: Please provide detailed information about CVE-2025-0596

CVE:CVE-2025-0596
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.143


Instruction: Please provide detailed information about CVE-2025-0598

CVE:CVE-2025-0598
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.270


Instruction: Please provide detailed information about CVE-2025-0599

CVE:CVE-2025-0599
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.403


Instruction: Please provide detailed information about CVE-2025-0600

CVE:CVE-2025-0600
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.527


Instruction: Please provide detailed information about CVE-2025-0601

CVE:CVE-2025-0601
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.650


Instruction: Please provide detailed information about CVE-2025-0826

CVE:CVE-2025-0826
Description:A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.780


Instruction: Please provide detailed information about CVE-2025-0827

CVE:CVE-2025-0827
Description:A stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:20.913


Instruction: Please provide detailed information about CVE-2025-0828

CVE:CVE-2025-0828
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:21.037


Instruction: Please provide detailed information about CVE-2025-0829

CVE:CVE-2025-0829
Description:A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:21.170


Instruction: Please provide detailed information about CVE-2025-0830

CVE:CVE-2025-0830
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:21.317


Instruction: Please provide detailed information about CVE-2025-0832

CVE:CVE-2025-0832
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:21.500


Instruction: Please provide detailed information about CVE-2025-0833

CVE:CVE-2025-0833
Description:A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
published:2025-03-17T14:15:21.693


Instruction: Please provide detailed information about CVE-2025-27102

CVE:CVE-2025-27102
Description:Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends this email and appears trustworthy, making this a significant risk for phishing attacks. Administrative users are impacted, as they can be targeted by unauthenticated users. Version 3.3.0 fixes the issue.
published:2025-03-17T14:15:21.867


Instruction: Please provide detailed information about CVE-2025-29786

CVE:CVE-2025-29786
Description:Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each part of the expression. In scenarios where input size isn’t limited, a malicious or inadvertent extremely large expression can consume excessive memory as the parser builds a huge AST. This can ultimately lead to*excessive memory usage and an Out-Of-Memory (OOM) crash of the process. This issue is relatively uncommon and will only manifest when there are no restrictions on the input size, i.e. the expression length is allowed to grow arbitrarily large. In typical use cases where inputs are bounded or validated, this problem would not occur. The problem has been patched in the latest versions of the Expr library. The fix introduces compile-time limits on the number of AST nodes and memory usage during parsing, preventing any single expression from exhausting resources. Users should upgrade to Expr version 1.17.0 or later, as this release includes the new node budget and memory limit safeguards. Upgrading to v1.17.0 ensures that extremely deep or large expressions are detected and safely aborted during compilation, avoiding the OOM condition. For users who cannot immediately upgrade, the recommended workaround is to impose an input size restriction before parsing. In practice, this means validating or limiting the length of expression strings that your application will accept. For example, set a maximum allowable number of characters (or nodes) for any expression and reject or truncate inputs that exceed this limit. By ensuring no unbounded-length expression is ever fed into the parser, one can prevent the parser from constructing a pathologically large AST and avoid potential memory exhaustion. In short, pre-validate and cap input size as a safeguard in the absence of the patch.
published:2025-03-17T14:15:22.237


Instruction: Please provide detailed information about CVE-2025-29787

CVE:CVE-2025-29787
Description:`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file system when extracted. Users who extract untrusted archive files using the following high-level API method may be affected and critical files on the system may be overwritten with arbitrary file permissions, which can potentially lead to code execution. Version 2.3.0 fixes the issue.
published:2025-03-17T14:15:22.447


Instruction: Please provide detailed information about CVE-2025-29788

CVE:CVE-2025-29788
Description:The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.1, and 2.0.1 allows users to manipulate the final payment amount processed by PayPal. If a user modifies the item quantity in their shopping cart after initiating the PayPal Express Checkout process, PayPal will not receive the updated total amount. As a result, PayPal captures only the initially transmitted amount, while Sylius incorrectly considers the order fully paid based on the modified total. This flaw can be exploited both accidentally and intentionally, potentially enabling fraud by allowing customers to pay less than the actual order value. Attackers can intentionally pay less than the actual total order amount, business owners may suffer financial losses due to underpaid orders, and integrity of payment processing is compromised. The issue is fixed in versions 1.6.1, 1.7.1, 2.0.1, and above. To resolve the problem in the end application without updating to the newest patches, there is a need to overwrite `ProcessPayPalOrderAction`, `CompletePayPalOrderFromPaymentPageAction`, and `CaptureAction` with modified logic.
published:2025-03-17T14:15:22.653


Instruction: Please provide detailed information about CVE-2025-2379

CVE:CVE-2025-2379
Description:A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /create-pass.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T14:15:23.907


Instruction: Please provide detailed information about CVE-2025-2380

CVE:CVE-2025-2380
Description:A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T14:15:24.117


Instruction: Please provide detailed information about CVE-2025-1398

CVE:CVE-2025-1398
Description:Mattermost Desktop App versions <=5.10.0 explicitly declared unnecessary macOS entitlements which allows an attacker with remote access to bypass Transparency, Consent, and Control (TCC) via code injection.
published:2025-03-17T15:15:43.243


Instruction: Please provide detailed information about CVE-2025-1774

CVE:CVE-2025-1774
Description:Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fields of the generated event. A field with additional field separator characters or values can be included in the "extraData" field.This issue affects BotSense in versions before 2.8.0.
published:2025-03-17T15:15:43.523


Instruction: Please provide detailed information about CVE-2025-25612

CVE:CVE-2025-25612
Description:FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.
published:2025-03-17T15:15:43.907


Instruction: Please provide detailed information about CVE-2025-25618

CVE:CVE-2025-25618
Description:Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.
published:2025-03-17T15:15:44.040


Instruction: Please provide detailed information about CVE-2025-25621

CVE:CVE-2025-25621
Description:Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses/teacher/index?teacher_id=2&semester_id=1.
published:2025-03-17T15:15:44.173


Instruction: Please provide detailed information about CVE-2025-25650

CVE:CVE-2025-25650
Description:An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentication.
published:2025-03-17T15:15:44.293


Instruction: Please provide detailed information about CVE-2025-26127

CVE:CVE-2025-26127
Description:A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
published:2025-03-17T15:15:44.427


Instruction: Please provide detailed information about CVE-2025-27512

CVE:CVE-2025-27512
Description:Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-deployment` to reboot the system into the deployed update. Since Zincati v0.0.24, this polkit rule contains a logic error which broadens access of those polkit actions to any unprivileged user rather than just the `zincati` system user. In practice, this means that any unprivileged user with access to the system D-Bus socket is able to deploy older Fedora CoreOS versions (which may have other known vulnerabilities). Note that rpm-ostree enforces that the selected version must be from the same branch the system is currently on so this cannot directly be used to deploy an attacker-controlled update payload. This primarily impacts users running untrusted workloads with access to the system D-Bus socket. Note that in general, untrusted workloads should not be given this access, whether containerized or not. By default, containers do not have access to the system D-Bus socket. The logic error is fixed in Zincati v0.0.30. A workaround is to manually add a following polkit rule, instructions for which are available in the GitHub Security Advisory.
published:2025-03-17T15:15:44.557


Instruction: Please provide detailed information about CVE-2025-2381

CVE:CVE-2025-2381
Description:A vulnerability classified as critical has been found in PHPGurukul Curfew e-Pass Management System 1.0. Affected is an unknown function of the file /admin/search-pass.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T15:15:46.390


Instruction: Please provide detailed information about CVE-2025-2382

CVE:CVE-2025-2382
Description:A vulnerability classified as critical was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T15:15:46.590


Instruction: Please provide detailed information about CVE-2025-2383

CVE:CVE-2025-2383
Description:A vulnerability, which was classified as critical, has been found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this issue is some unknown functionality of the file /doctor/search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T16:15:27.600


Instruction: Please provide detailed information about CVE-2025-2384

CVE:CVE-2025-2384
Description:A vulnerability, which was classified as critical, was found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /InsertCustomer.php of the component Parameter Handler. The manipulation of the argument txtName/txtAddress/cmbCity/txtEmail/cmbGender/txtBirthDate/txtUserName2/txtPassword2 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T16:15:27.807


Instruction: Please provide detailed information about CVE-2025-30143

CVE:CVE-2025-30143
Description:Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to built-in functions and properties.
published:2025-03-17T16:15:28.643


Instruction: Please provide detailed information about CVE-2025-22474

CVE:CVE-2025-22474
Description:Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
published:2025-03-17T17:15:39.170


Instruction: Please provide detailed information about CVE-2025-25684

CVE:CVE-2025-25684
Description:A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request.
published:2025-03-17T17:15:39.463


Instruction: Please provide detailed information about CVE-2025-25685

CVE:CVE-2025-25685
Description:An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share.
published:2025-03-17T17:15:39.597


Instruction: Please provide detailed information about CVE-2025-29431

CVE:CVE-2025-29431
Description:Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, code, and name parameters.
published:2025-03-17T17:15:40.177


Instruction: Please provide detailed information about CVE-2025-2241

CVE:CVE-2025-2241
Description:A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
published:2025-03-17T17:15:40.393


Instruction: Please provide detailed information about CVE-2025-2385

CVE:CVE-2025-2385
Description:A vulnerability has been found in code-projects Modern Bag 1.0 and classified as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument userEmail/userPassword leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T17:15:41.287


Instruction: Please provide detailed information about CVE-2025-2386

CVE:CVE-2025-2386
Description:A vulnerability was found in PHPGurukul Local Services Search Engine Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /serviceman-search.php. The manipulation of the argument location leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T17:15:41.577


Instruction: Please provide detailed information about CVE-2025-22472

CVE:CVE-2025-22472
Description:Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to execution of commands with elevated privileges.
published:2025-03-17T18:15:20.930


Instruction: Please provide detailed information about CVE-2025-22473

CVE:CVE-2025-22473
Description:Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
published:2025-03-17T18:15:21.077


Instruction: Please provide detailed information about CVE-2025-26125

CVE:CVE-2025-26125
Description:An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges.
published:2025-03-17T18:15:21.763


Instruction: Please provide detailed information about CVE-2025-29429

CVE:CVE-2025-29429
Description:Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/program.php via the id, code, and name parameters.
published:2025-03-17T18:15:22.013


Instruction: Please provide detailed information about CVE-2025-29430

CVE:CVE-2025-29430
Description:Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/room.php via the id and rome parameters.
published:2025-03-17T18:15:22.113


Instruction: Please provide detailed information about CVE-2025-2387

CVE:CVE-2025-2387
Description:A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /admin/ajax.php?action=add_to_cart. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T18:15:22.637


Instruction: Please provide detailed information about CVE-2025-2388

CVE:CVE-2025-2388
Description:A vulnerability was found in Keytop 路内停车收费系统 2.7.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /saas/commonApi/park/getParks of the component API. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T18:15:22.870


Instruction: Please provide detailed information about CVE-2025-26042

CVE:CVE-2025-26042
Description:Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack.
published:2025-03-17T19:15:26.587


Instruction: Please provide detailed information about CVE-2025-29425

CVE:CVE-2025-29425
Description:Code-projects Online Class and Exam Scheduling System 1.0 is vulnerable to SQL Injection in exam_save.php via the parameters member and first.
published:2025-03-17T19:15:26.957


Instruction: Please provide detailed information about CVE-2025-29427

CVE:CVE-2025-29427
Description:Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in profile.php via the member_first and member_last parameters.
published:2025-03-17T19:15:27.067


Instruction: Please provide detailed information about CVE-2025-2389

CVE:CVE-2025-2389
Description:A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_city.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T19:15:27.803


Instruction: Please provide detailed information about CVE-2025-2390

CVE:CVE-2025-2390
Description:A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /user_dashboard/add_donor.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T19:15:28.043


Instruction: Please provide detailed information about CVE-2025-0495

CVE:CVE-2025-0495
Description:Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.  Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.   This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.
published:2025-03-17T20:15:13.737


Instruction: Please provide detailed information about CVE-2025-24185

CVE:CVE-2025-24185
Description:An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.3, macOS Ventura 13.7.3, macOS Sonoma 14.7.3. Parsing a maliciously crafted file may lead to an unexpected app termination.
published:2025-03-17T20:15:13.907


Instruction: Please provide detailed information about CVE-2025-25914

CVE:CVE-2025-25914
Description:SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter
published:2025-03-17T20:15:14.013


Instruction: Please provide detailed information about CVE-2025-26393

CVE:CVE-2025-26393
Description:SolarWinds Service Desk is affected by a broken access control vulnerability. The issue allows authenticated users to escalate privileges, leading to unauthorized data manipulation.
published:2025-03-17T20:15:14.140


Instruction: Please provide detailed information about CVE-2025-2391

CVE:CVE-2025-2391
Description:A vulnerability classified as critical was found in code-projects Blood Bank Management System 1.0. This vulnerability affects unknown code of the file /admin/admin_login.php of the component Admin Login Page. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T20:15:14.443


Instruction: Please provide detailed information about CVE-2025-2392

CVE:CVE-2025-2392
Description:A vulnerability, which was classified as critical, has been found in code-projects Online Class and Exam Scheduling System 1.0. This issue affects some unknown processing of the file /pages/activate.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T20:15:14.643


Instruction: Please provide detailed information about CVE-2025-29426

CVE:CVE-2025-29426
Description:Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters.
published:2025-03-17T21:15:14.190


Instruction: Please provide detailed information about CVE-2025-2393

CVE:CVE-2025-2393
Description:A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of the file /pages/salut_del.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T21:15:14.330


Instruction: Please provide detailed information about CVE-2025-2397

CVE:CVE-2025-2397
Description:A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been declared as problematic. This vulnerability affects unknown code of the component Telnet Service. The manipulation leads to improper authorization. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T21:15:14.533


Instruction: Please provide detailed information about CVE-2025-29781

CVE:CVE-2025-29781
Description:The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource `BMCEventSubscription`. Prior to versions 0.8.1 and 0.9.1, an adversary Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create a `BMCEventSubscription` in his authorized namespace and then load Secrets from his unauthorized namespaces to his authorized namespace via the Baremetal Operator, causing Secret Leakage. The patch makes BMO refuse to read Secrets from other namespace than where the corresponding BMH resource is. The patch does not change the `BMCEventSubscription` API in BMO, but stricter validation will fail the request at admission time. It will also prevent the controller reading such Secrets, in case the BMCES CR has already been deployed. The issue exists for all versions of BMO, and is patched in BMO releases v0.9.1 and v0.8.1. Prior upgrading to patched BMO version, duplicate any existing Secret pointed to by `BMCEventSubscription`'s `httpHeadersRef` to the same namespace where the corresponding BMH exists. After upgrade, remove the old Secrets. As a workaround, the operator can configure BMO RBAC to be namespace scoped, instead of cluster scoped, to prevent BMO from accessing Secrets from other namespaces, and/or use `WATCH_NAMESPACE` configuration option to limit BMO to single namespace.
published:2025-03-17T22:15:14.493


Instruction: Please provide detailed information about CVE-2025-29909

CVE:CVE-2025-29909
Description:CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, a heap buffer overflow vulnerability in CryptoLib's `Crypto_TC_ApplySecurity()` allows an attacker to craft a malicious TC frame that causes out-of-bounds memory writes. This can result in denial of service (DoS) or, under certain conditions, remote code execution (RCE). Any application or system that relies on CryptoLib for Telecommand (TC) processing and does not strictly validate incoming TC frames is at risk. This includes satellite ground stations or mission control software where attackers can inject malformed frames. A patch is available at commit c7e8a8745ff4b5e9bd7e500e91358e86d5abedcc.
published:2025-03-17T22:15:14.657


Instruction: Please provide detailed information about CVE-2025-29910

CVE:CVE-2025-29910
Description:CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A memory leak vulnerability was identified in the `crypto_handle_incrementing_nontransmitted_counter` function of CryptoLib versions 1.3.3 and prior. This vulnerability can lead to resource exhaustion and degraded system performance over time, particularly in long-running processes or systems processing large volumes of data. The vulnerability is present in the `crypto_handle_incrementing_nontransmitted_counter` function within `crypto_tc.c`. The function allocates memory using `malloc` without ensuring the allocated memory is always freed. This issue can lead to resource exhaustion, reduced system performance, and potentially a Denial of Service (DoS) in environments where CryptoLib is used in long-running processes or with large volumes of data. Any system using CryptoLib, especially those handling high-throughput or continuous data streams, could be impacted. As of time of publication, no known patched versions are available.
published:2025-03-17T22:15:14.810


Instruction: Please provide detailed information about CVE-2025-2398

CVE:CVE-2025-2398
Description:A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical. This issue affects some unknown processing of the component CLI su Command Handler. The manipulation leads to use of default credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
published:2025-03-17T22:15:15.257


Instruction: Please provide detailed information about CVE-2025-2419

CVE:CVE-2025-2419
Description:A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /InsertFeedback.php. The manipulation of the argument txtName/txtEmail/txtMobile/txtFeedback leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-17T22:15:15.450


Instruction: Please provide detailed information about CVE-2025-27760

CVE:CVE-2025-27760
Description:Rejected reason: Not used
published:2025-03-17T23:15:17.740


Instruction: Please provide detailed information about CVE-2025-27761

CVE:CVE-2025-27761
Description:Rejected reason: Not used
published:2025-03-17T23:15:17.807


Instruction: Please provide detailed information about CVE-2025-27762

CVE:CVE-2025-27762
Description:Rejected reason: Not used
published:2025-03-17T23:15:17.863


Instruction: Please provide detailed information about CVE-2025-27763

CVE:CVE-2025-27763
Description:Rejected reason: Not used
published:2025-03-17T23:15:17.927


Instruction: Please provide detailed information about CVE-2025-27764

CVE:CVE-2025-27764
Description:Rejected reason: Not used
published:2025-03-17T23:15:17.990


Instruction: Please provide detailed information about CVE-2025-27765

CVE:CVE-2025-27765
Description:Rejected reason: Not used
published:2025-03-17T23:15:18.050


Instruction: Please provide detailed information about CVE-2025-27766

CVE:CVE-2025-27766
Description:Rejected reason: Not used
published:2025-03-17T23:15:18.107


Instruction: Please provide detailed information about CVE-2025-27767

CVE:CVE-2025-27767
Description:Rejected reason: Not used
published:2025-03-17T23:15:18.173


Instruction: Please provide detailed information about CVE-2025-27768

CVE:CVE-2025-27768
Description:Rejected reason: Not used
published:2025-03-17T23:15:18.237


Instruction: Please provide detailed information about CVE-2025-29911

CVE:CVE-2025-29911
Description:CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_AOS_ProcessSecurity` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted AOS frame with an insufficient length. The vulnerability lies in the function `Crypto_AOS_ProcessSecurity`, specifically during the processing of the Frame Error Control Field (FECF). The affected code attempts to read from the `p_ingest` buffer at indices `current_managed_parameters_struct.max_frame_size - 2` and `current_managed_parameters_struct.max_frame_size - 1` without verifying if `len_ingest` is sufficiently large. This leads to a heap buffer overflow when `len_ingest` is smaller than `max_frame_size`. As of time of publication, no known patched versions exist.
published:2025-03-17T23:15:18.293


Instruction: Please provide detailed information about CVE-2025-29912

CVE:CVE-2025-29912
Description:CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, an unsigned integer underflow in the `Crypto_TC_ProcessSecurity` function of CryptoLib leads to a heap buffer overflow. The vulnerability is triggered when the `fl` (frame length) field in a Telecommand (TC) packet is set to 0. This underflow causes the frame length to be interpreted as 65535, resulting in out-of-bounds memory access. This critical vulnerability can be exploited to cause a denial of service (DoS) or potentially achieve remote code execution. Users of CryptoLib are advised to apply the recommended patch or avoid processing untrusted TC packets until a fix is available.
published:2025-03-17T23:15:18.450


Instruction: Please provide detailed information about CVE-2025-29913

CVE:CVE-2025-29913
Description:CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_TC_Prep_AAD` function of CryptoLib versions 1.3.3 and prior. This vulnerability allows an attacker to trigger a Denial of Service (DoS) or potentially execute arbitrary code (RCE) by providing a maliciously crafted telecommand (TC) frame that causes an unsigned integer underflow. The vulnerability lies in the function `Crypto_TC_Prep_AAD`, specifically during the computation of `tc_mac_start_index`. The affected code incorrectly calculates the MAC start index without ensuring it remains within the bounds of the `ingest` buffer. When `tc_mac_start_index` underflows due to an incorrect length calculation, the function attempts to access an out-of-bounds memory location, leading to a segmentation fault. The vulnerability is still present in the repository as of commit `d3cc420ace96d02a5b7e83d88cbd2e48010d5723`.
published:2025-03-17T23:15:18.590


Instruction: Please provide detailed information about CVE-2025-2420

CVE:CVE-2025-2420
Description:A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
published:2025-03-17T23:15:18.723


Instruction: Please provide detailed information about CVE-2025-2471

CVE:CVE-2025-2471
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unknown function of the file /boat-details.php. The manipulation of the argument bid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-18T00:15:13.030


Instruction: Please provide detailed information about CVE-2025-2472

CVE:CVE-2025-2472
Description:A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-18T00:15:13.220


Instruction: Please provide detailed information about CVE-2025-2473

CVE:CVE-2025-2473
Description:A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-18T00:15:13.393


Instruction: Please provide detailed information about CVE-2025-2262

CVE:CVE-2025-2262
Description:The The Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.7.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
published:2025-03-18T07:15:33.907


Instruction: Please provide detailed information about CVE-2025-0755

CVE:CVE-2025-0755
Description:The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
published:2025-03-18T09:15:11.487


Instruction: Please provide detailed information about CVE-2025-24306

CVE:CVE-2025-24306
Description:Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.0_1101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker with an administrative privilege.
published:2025-03-18T09:15:13.570


Instruction: Please provide detailed information about CVE-2025-25220

CVE:CVE-2025-25220
Description:Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.1_1101. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.
published:2025-03-18T09:15:13.750


Instruction: Please provide detailed information about CVE-2025-0694

CVE:CVE-2025-0694
Description:Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
published:2025-03-18T11:15:39.400


Instruction: Please provide detailed information about CVE-2025-1468

CVE:CVE-2025-1468
Description:An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-default Basic128Rsa15 security policy.
published:2025-03-18T11:15:39.553


Instruction: Please provide detailed information about CVE-2025-2489

CVE:CVE-2025-2489
Description:Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application password, stored in /Users/user/Library/Application Support/ntfs-tool/config.json.
published:2025-03-18T12:15:15.770


Instruction: Please provide detailed information about CVE-2025-2493

CVE:CVE-2025-2493
Description:Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/scheduler/load.php’ endpoint to navigate beyond the intended directory. This can allow unauthorised access to sensitive files outside the expected scope, posing a security risk.
published:2025-03-18T12:15:15.950


Instruction: Please provide detailed information about CVE-2025-2494

CVE:CVE-2025-2494
Description:Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/phpconsole/upload.php’ endpoint, which is protected by basic HTTP authentication. The files are uploaded to a directory exposed by the web application, which could result in code execution, giving the attacker full control over the server.
published:2025-03-18T12:15:16.090


Instruction: Please provide detailed information about CVE-2025-2495

CVE:CVE-2025-2495
Description:Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScript code injected via the ‘/softdial/scheduler/save.php’ resource. The injected code will execute when the uploaded file is loaded via the ‘/softdial/scheduler/load.php’ resource and can redirect the victim to malicious sites or steal their login information to spoof their identity.
published:2025-03-18T12:15:16.227


Instruction: Please provide detailed information about CVE-2025-25500

CVE:CVE-2025-25500
Description:An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.
published:2025-03-18T14:15:43.493


Instruction: Please provide detailed information about CVE-2025-2449

CVE:CVE-2025-2449
Description:NI FlexLogger usiReg URI File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of NI FlexLogger. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the parsing of URI files by the usiReg component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21805.
published:2025-03-18T14:15:45.670


Instruction: Please provide detailed information about CVE-2025-2450

CVE:CVE-2025-2450
Description:NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI Vision Builder AI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.  The specific flaw exists within the processing of VBAI files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22833.
published:2025-03-18T14:15:45.850


Instruction: Please provide detailed information about CVE-2025-2490

CVE:CVE-2025-2490
Description:A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileUploadController.java of the component File Upload. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-18T14:15:46.250


Instruction: Please provide detailed information about CVE-2025-30106

CVE:CVE-2025-30106
Description:On IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attacker within Wi-Fi range to connect to the device's network to perform sniffing.
published:2025-03-18T14:15:46.480


Instruction: Please provide detailed information about CVE-2025-25580

CVE:CVE-2025-25580
Description:yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.
published:2025-03-18T15:16:00.123


Instruction: Please provide detailed information about CVE-2025-25585

CVE:CVE-2025-25585
Description:Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords.
published:2025-03-18T15:16:00.253


Instruction: Please provide detailed information about CVE-2025-25590

CVE:CVE-2025-25590
Description:yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.
published:2025-03-18T15:16:00.373


Instruction: Please provide detailed information about CVE-2025-2491

CVE:CVE-2025-2491
Description:A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component Edit Template File Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-18T15:16:01.707


Instruction: Please provide detailed information about CVE-2025-30107

CVE:CVE-2025-30107
Description:On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery protection, potentially causing physical damage to the vehicle.
published:2025-03-18T15:16:01.930


Instruction: Please provide detailed information about CVE-2025-30109

CVE:CVE-2025-30109
Description:In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for the dashcam contains hardcoded credentials that allow an attacker on the local Wi-Fi network to access API endpoints and retrieve sensitive device information, including live and recorded footage.
published:2025-03-18T15:16:02.063


Instruction: Please provide detailed information about CVE-2025-30110

CVE:CVE-2025-30110
Description:On IROAD X5 devices, a Bypass of Device Pairing can occur via MAC Address Spoofing. The dashcam's pairing mechanism relies solely on MAC address verification, allowing an attacker to bypass authentication by spoofing an already-paired MAC address that can be captured via an ARP scan.
published:2025-03-18T15:16:02.197


Instruction: Please provide detailed information about CVE-2025-30111

CVE:CVE-2025-30111
Description:On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication.
published:2025-03-18T15:16:02.323


Instruction: Please provide detailed information about CVE-2025-30113

CVE:CVE-2025-30113
Description:An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Android application contains hardcoded credentials that allow unauthorized access to device settings through ports 9091 and 9092. These credentials, stored in cleartext, can be exploited by an attacker who gains access to the dashcam's network.
published:2025-03-18T15:16:02.453


Instruction: Please provide detailed information about CVE-2025-30114

CVE:CVE-2025-30114
Description:An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the connecting device's MAC address. By obtaining the MAC address through network scanning and spoofing it, an attacker can bypass the authentication process and gain full access to the dashcam's features without proper authorization.
published:2025-03-18T15:16:02.583