Instruction: Please provide detailed information about CVE-2025-0685

CVE:CVE-2025-0685
Description:A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_jfs_lookup_symlink() function will write past the internal buffer length during grub_jfs_read_file(). This issue can be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections.
published:2025-03-03T18:15:30.733


Instruction: Please provide detailed information about CVE-2025-0686

CVE:CVE-2025-0686
Description:A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections.
published:2025-03-03T18:15:30.930


Instruction: Please provide detailed information about CVE-2025-27370

CVE:CVE-2025-27370
Description:OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.
published:2025-03-03T18:15:40.650


Instruction: Please provide detailed information about CVE-2025-27371

CVE:CVE-2025-27371
Description:In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
published:2025-03-03T18:15:40.850


Instruction: Please provide detailed information about CVE-2025-1877

CVE:CVE-2025-1877
Description:A vulnerability, which was classified as critical, was found in D-Link DAP-1562 1.10. This affects the function pure_auth_check of the component HTTP POST Request Handler. The manipulation of the argument a1 leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
published:2025-03-03T19:15:34.180


Instruction: Please provide detailed information about CVE-2025-1878

CVE:CVE-2025-1878
Description:A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component WiFi. The manipulation leads to use of default password. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitation appears to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
published:2025-03-03T19:15:34.387


Instruction: Please provide detailed information about CVE-2025-1889

CVE:CVE-2025-1889
Description:picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic.
published:2025-03-03T19:15:34.560


Instruction: Please provide detailed information about CVE-2025-25939

CVE:CVE-2025-25939
Description:Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter.
published:2025-03-03T19:15:35.290


Instruction: Please provide detailed information about CVE-2025-25967

CVE:CVE-2025-25967
Description:Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.
published:2025-03-03T19:15:35.400


Instruction: Please provide detailed information about CVE-2025-26206

CVE:CVE-2025-26206
Description:Cross Site Request Forgery vulnerability in sell done storefront v.1.0 allows a remote attacker to escalate privileges via the index.html component
published:2025-03-03T19:15:35.507


Instruction: Please provide detailed information about CVE-2025-27499

CVE:CVE-2025-27499
Description:WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the processa_edicao_socio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio_nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.10.
published:2025-03-03T19:15:36.027


Instruction: Please provide detailed information about CVE-2025-27500

CVE:CVE-2025-27500
Description:OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel can be accessed without any form of authentication. This endpoint accepts an HTTP POST to upload a file which is then stored on the node and is available via URL. This can lead to a stored cross site scripting attack if the file uploaded contains malicious code and is then accessed and executed within the context of the user's browser. This function is no longer necessary as the ziti-console moves from a node server application to a single page application, and has been disabled. The vulnerability is fixed in 3.7.1.
published:2025-03-03T19:15:36.157


Instruction: Please provide detailed information about CVE-2025-27501

CVE:CVE-2025-27501
Description:OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller and performs a server-side request, resulting in a potential Server-Side Request Forgery (SSRF) vulnerability. The fixed version has moved the request to the external controller from the server side to the client side, thereby eliminating the identity of the node from being used to gain any additional permissions. This vulnerability is fixed in 3.7.1.
published:2025-03-03T19:15:36.300


Instruction: Please provide detailed information about CVE-2025-1879

CVE:CVE-2025-1879
Description:A vulnerability was found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This issue affects some unknown processing of the component APK. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the physical device. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
published:2025-03-03T20:15:45.510


Instruction: Please provide detailed information about CVE-2025-1880

CVE:CVE-2025-1880
Description:A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device Pairing. The manipulation leads to authentication bypass by primary weakness. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitability is told to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
published:2025-03-03T20:15:45.717


Instruction: Please provide detailed information about CVE-2025-1881

CVE:CVE-2025-1881
Description:A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Video Footage/Live Video Stream. The manipulation leads to improper access controls. The attack can be launched remotely. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
published:2025-03-03T21:15:18.097


Instruction: Please provide detailed information about CVE-2025-1882

CVE:CVE-2025-1882
Description:A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the component Device Setting Handler. The manipulation leads to improper access control for register interface. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.
published:2025-03-03T21:15:18.267


Instruction: Please provide detailed information about CVE-2025-1890

CVE:CVE-2025-1890
Description:A vulnerability has been found in shishuocms 1.1 and classified as critical. This vulnerability affects the function handleRequest of the file src/main/java/com/shishuo/cms/action/manage/ManageUpLoadAction.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T00:15:31.190


Instruction: Please provide detailed information about CVE-2025-1891

CVE:CVE-2025-1891
Description:A vulnerability was found in shishuocms 1.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T00:15:31.377


Instruction: Please provide detailed information about CVE-2025-27219

CVE:CVE-2025-27219
Description:In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability. The method does not impose any limit on the length of the raw cookie value it processes. This oversight can lead to excessive resource consumption when parsing extremely large cookies.
published:2025-03-04T00:15:31.550


Instruction: Please provide detailed information about CVE-2025-27220

CVE:CVE-2025-27220
Description:In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
published:2025-03-04T00:15:31.693


Instruction: Please provide detailed information about CVE-2025-27221

CVE:CVE-2025-27221
Description:In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host.
published:2025-03-04T00:15:31.847


Instruction: Please provide detailed information about CVE-2025-1695

CVE:CVE-2025-1695
Description:In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization.  This vulnerability allows a remote attacker to cause a degradation that can lead to a limited denial-of-service (DoS).  There is no control plane exposure; this is a data plane issue only.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
published:2025-03-04T01:15:10.063


Instruction: Please provide detailed information about CVE-2025-1892

CVE:CVE-2025-1892
Description:A vulnerability was found in shishuocms 1.1. It has been classified as problematic. Affected is an unknown function of the file /manage/folder/add.json of the component Directory Deletion Page. The manipulation of the argument folderName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T01:15:11.147


Instruction: Please provide detailed information about CVE-2025-1893

CVE:CVE-2025-1893
Description:A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. The patch is named e31e9965f00d9c744a7f728497cb4f3e97744ee8. It is recommended to apply a patch to fix this issue.
published:2025-03-04T01:15:11.327


Instruction: Please provide detailed information about CVE-2025-1894

CVE:CVE-2025-1894
Description:A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search-result.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T02:15:35.380


Instruction: Please provide detailed information about CVE-2025-1895

CVE:CVE-2025-1895
Description:A vulnerability classified as critical has been found in Tenda TX3 16.03.13.11_multi. This affects an unknown part of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T02:15:36.163


Instruction: Please provide detailed information about CVE-2025-1896

CVE:CVE-2025-1896
Description:A vulnerability classified as critical was found in Tenda TX3 16.03.13.11_multi. This vulnerability affects unknown code of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T02:15:36.340


Instruction: Please provide detailed information about CVE-2025-1897

CVE:CVE-2025-1897
Description:A vulnerability, which was classified as critical, has been found in Tenda TX3 16.03.13.11_multi. This issue affects some unknown processing of the file /goform/SetNetControlList. The manipulation of the argument list leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T02:15:36.513


Instruction: Please provide detailed information about CVE-2025-1898

CVE:CVE-2025-1898
Description:A vulnerability, which was classified as critical, was found in Tenda TX3 16.03.13.11_multi. Affected is an unknown function of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T02:15:36.680


Instruction: Please provide detailed information about CVE-2025-1899

CVE:CVE-2025-1899
Description:A vulnerability has been found in Tenda TX3 16.03.13.11_multi and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T03:15:08.970


Instruction: Please provide detailed information about CVE-2025-0587

CVE:CVE-2025-0587
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:11.240


Instruction: Please provide detailed information about CVE-2025-0912

CVE:CVE-2025-0912
Description:The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
published:2025-03-04T04:15:11.390


Instruction: Please provide detailed information about CVE-2025-1321

CVE:CVE-2025-1321
Description:The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-04T04:15:11.547


Instruction: Please provide detailed information about CVE-2025-1639

CVE:CVE-2025-1639
Description:The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_elementor_plugin_handler() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins which can be leveraged to further infect a victim when Elementor is not activated on a vulnerable site.
published:2025-03-04T04:15:11.697


Instruction: Please provide detailed information about CVE-2025-1900

CVE:CVE-2025-1900
Description:A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /add-table.php. The manipulation of the argument tableno leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T04:15:11.853


Instruction: Please provide detailed information about CVE-2025-1901

CVE:CVE-2025-1901
Description:A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/check_availability.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T04:15:12.030


Instruction: Please provide detailed information about CVE-2025-1902

CVE:CVE-2025-1902
Description:A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /password-recovery.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T04:15:12.210


Instruction: Please provide detailed information about CVE-2025-1903

CVE:CVE-2025-1903
Description:A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_add.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T04:15:12.383


Instruction: Please provide detailed information about CVE-2025-20011

CVE:CVE-2025-20011
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.
published:2025-03-04T04:15:12.563


Instruction: Please provide detailed information about CVE-2025-20021

CVE:CVE-2025-20021
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-03-04T04:15:12.703


Instruction: Please provide detailed information about CVE-2025-20024

CVE:CVE-2025-20024
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:12.840


Instruction: Please provide detailed information about CVE-2025-20042

CVE:CVE-2025-20042
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read.
published:2025-03-04T04:15:12.970


Instruction: Please provide detailed information about CVE-2025-20081

CVE:CVE-2025-20081
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:13.120


Instruction: Please provide detailed information about CVE-2025-20091

CVE:CVE-2025-20091
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:13.253


Instruction: Please provide detailed information about CVE-2025-20626

CVE:CVE-2025-20626
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:13.393


Instruction: Please provide detailed information about CVE-2025-21084

CVE:CVE-2025-21084
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:13.537


Instruction: Please provide detailed information about CVE-2025-21089

CVE:CVE-2025-21089
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-03-04T04:15:13.680


Instruction: Please provide detailed information about CVE-2025-21097

CVE:CVE-2025-21097
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
published:2025-03-04T04:15:13.813


Instruction: Please provide detailed information about CVE-2025-21098

CVE:CVE-2025-21098
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check.
published:2025-03-04T04:15:13.953


Instruction: Please provide detailed information about CVE-2025-22443

CVE:CVE-2025-22443
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-03-04T04:15:14.097


Instruction: Please provide detailed information about CVE-2025-22835

CVE:CVE-2025-22835
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:14.250


Instruction: Please provide detailed information about CVE-2025-22837

CVE:CVE-2025-22837
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.
published:2025-03-04T04:15:14.387


Instruction: Please provide detailed information about CVE-2025-22841

CVE:CVE-2025-22841
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
published:2025-03-04T04:15:14.530


Instruction: Please provide detailed information about CVE-2025-22847

CVE:CVE-2025-22847
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-03-04T04:15:14.663


Instruction: Please provide detailed information about CVE-2025-22897

CVE:CVE-2025-22897
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
published:2025-03-04T04:15:14.807


Instruction: Please provide detailed information about CVE-2025-23234

CVE:CVE-2025-23234
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow.
published:2025-03-04T04:15:14.953


Instruction: Please provide detailed information about CVE-2025-23240

CVE:CVE-2025-23240
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:15.097


Instruction: Please provide detailed information about CVE-2025-23409

CVE:CVE-2025-23409
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:15.240


Instruction: Please provide detailed information about CVE-2025-23414

CVE:CVE-2025-23414
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:15.377


Instruction: Please provide detailed information about CVE-2025-23418

CVE:CVE-2025-23418
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
published:2025-03-04T04:15:15.523


Instruction: Please provide detailed information about CVE-2025-23420

CVE:CVE-2025-23420
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:15.657


Instruction: Please provide detailed information about CVE-2025-24301

CVE:CVE-2025-24301
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:15.803


Instruction: Please provide detailed information about CVE-2025-24309

CVE:CVE-2025-24309
Description:in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.
published:2025-03-04T04:15:15.940


Instruction: Please provide detailed information about CVE-2025-1306

CVE:CVE-2025-1306
Description:The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunch_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-04T05:15:13.590


Instruction: Please provide detailed information about CVE-2025-1307

CVE:CVE-2025-1307
Description:The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
published:2025-03-04T05:15:14.233


Instruction: Please provide detailed information about CVE-2025-1904

CVE:CVE-2025-1904
Description:A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionality of the file /Blood/A+.php. The manipulation of the argument Availibility leads to cross site scripting. The attack may be launched remotely.
published:2025-03-04T05:15:14.440


Instruction: Please provide detailed information about CVE-2025-1905

CVE:CVE-2025-1905
Description:A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file employee.php. The manipulation of the argument Full Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-04T05:15:14.680


Instruction: Please provide detailed information about CVE-2025-1906

CVE:CVE-2025-1906
Description:A vulnerability has been found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-04T05:15:14.903


Instruction: Please provide detailed information about CVE-2025-0359

CVE:CVE-2025-0359
Description:During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applications to access restricted D-Bus methods within the framework.  Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
published:2025-03-04T06:15:30.023


Instruction: Please provide detailed information about CVE-2025-0360

CVE:CVE-2025-0360
Description:During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could lead to an incorrect user privilege level in the VAPIX service account D-Bus API.
published:2025-03-04T06:15:30.180


Instruction: Please provide detailed information about CVE-2025-27521

CVE:CVE-2025-27521
Description:Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
published:2025-03-04T08:15:36.203


Instruction: Please provide detailed information about CVE-2025-0433

CVE:CVE-2025-0433
Description:The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-04T09:15:10.613


Instruction: Please provide detailed information about CVE-2025-0512

CVE:CVE-2025-0512
Description:The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 6.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-04T09:15:10.763


Instruction: Please provide detailed information about CVE-2025-26849

CVE:CVE-2025-26849
Description:There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules.
published:2025-03-04T09:15:10.917


Instruction: Please provide detailed information about CVE-2025-0370

CVE:CVE-2025-0370
Description:The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-04T10:15:10.437


Instruction: Please provide detailed information about CVE-2025-0958

CVE:CVE-2025-0958
Description:The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pages and allows them to execute other actions related to auction handling.
published:2025-03-04T10:15:10.817


Instruction: Please provide detailed information about CVE-2025-22224

CVE:CVE-2025-22224
Description:VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
published:2025-03-04T12:15:33.687


Instruction: Please provide detailed information about CVE-2025-22225

CVE:CVE-2025-22225
Description:VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
published:2025-03-04T12:15:33.840


Instruction: Please provide detailed information about CVE-2025-22226

CVE:CVE-2025-22226
Description:VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
published:2025-03-04T12:15:33.973


Instruction: Please provide detailed information about CVE-2025-1925

CVE:CVE-2025-1925
Description:A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm_context of the file src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be launched remotely. This vulnerability allows a single UE to crash the AMF, resulting in the complete loss of mobility and session management services and causing a network-wide outage. All registered UEs will lose connectivity, and new registrations will be blocked until the AMF is restarted, leading to a high availability impact. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
published:2025-03-04T14:15:36.717


Instruction: Please provide detailed information about CVE-2025-1930

CVE:CVE-2025-1930
Description:On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:37.850


Instruction: Please provide detailed information about CVE-2025-1931

CVE:CVE-2025-1931
Description:It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:37.963


Instruction: Please provide detailed information about CVE-2025-1932

CVE:CVE-2025-1932
Description:An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.053


Instruction: Please provide detailed information about CVE-2025-1933

CVE:CVE-2025-1933
Description:On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.170


Instruction: Please provide detailed information about CVE-2025-1934

CVE:CVE-2025-1934
Description:It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.273


Instruction: Please provide detailed information about CVE-2025-1935

CVE:CVE-2025-1935
Description:A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.390


Instruction: Please provide detailed information about CVE-2025-1936

CVE:CVE-2025-1936
Description:jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.500


Instruction: Please provide detailed information about CVE-2025-1937

CVE:CVE-2025-1937
Description:Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.610


Instruction: Please provide detailed information about CVE-2025-1938

CVE:CVE-2025-1938
Description:Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
published:2025-03-04T14:15:38.730


Instruction: Please provide detailed information about CVE-2025-1939

CVE:CVE-2025-1939
Description:Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. This vulnerability affects Firefox < 136.
published:2025-03-04T14:15:38.837


Instruction: Please provide detailed information about CVE-2025-1940

CVE:CVE-2025-1940
Description:A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly.  *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 136.
published:2025-03-04T14:15:38.950


Instruction: Please provide detailed information about CVE-2025-1941

CVE:CVE-2025-1941
Description:Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability affects Firefox < 136.
published:2025-03-04T14:15:39.063


Instruction: Please provide detailed information about CVE-2025-1942

CVE:CVE-2025-1942
Description:When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string This vulnerability affects Firefox < 136 and Thunderbird < 136.
published:2025-03-04T14:15:39.167


Instruction: Please provide detailed information about CVE-2025-1943

CVE:CVE-2025-1943
Description:Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 136 and Thunderbird < 136.
published:2025-03-04T14:15:39.260


Instruction: Please provide detailed information about CVE-2025-27424

CVE:CVE-2025-27424
Description:Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for iOS < 136.
published:2025-03-04T14:15:39.397


Instruction: Please provide detailed information about CVE-2025-27425

CVE:CVE-2025-27425
Description:Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first This vulnerability affects Firefox for iOS < 136.
published:2025-03-04T14:15:39.493


Instruction: Please provide detailed information about CVE-2025-27426

CVE:CVE-2025-27426
Description:Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL This vulnerability affects Firefox for iOS < 136.
published:2025-03-04T14:15:39.593


Instruction: Please provide detailed information about CVE-2025-1424

CVE:CVE-2025-1424
Description:A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. This issue affects InkPad Color 3 in version U743k3.6.8.3671.
published:2025-03-04T16:15:36.663


Instruction: Please provide detailed information about CVE-2025-1425

CVE:CVE-2025-1425
Description:A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affects InkPad Color 3: U743k3.6.8.3671.
published:2025-03-04T16:15:36.803


Instruction: Please provide detailed information about CVE-2025-23368

CVE:CVE-2025-23368
Description:A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
published:2025-03-04T16:15:39.270


Instruction: Please provide detailed information about CVE-2025-26320

CVE:CVE-2025-26320
Description:t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping.
published:2025-03-04T16:15:40.240


Instruction: Please provide detailed information about CVE-2025-27111

CVE:CVE-2025-27111
Description:Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
published:2025-03-04T16:15:40.487


Instruction: Please provide detailed information about CVE-2025-26091

CVE:CVE-2025-26091
Description:A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'name' parameter when creating a new password in the "My Passwords" page.
published:2025-03-04T17:15:18.243


Instruction: Please provide detailed information about CVE-2025-26182

CVE:CVE-2025-26182
Description:An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file
published:2025-03-04T17:15:18.363


Instruction: Please provide detailed information about CVE-2025-27150

CVE:CVE-2025-27150
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
published:2025-03-04T17:15:18.663


Instruction: Please provide detailed information about CVE-2025-27155

CVE:CVE-2025-27155
Description:Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.
published:2025-03-04T17:15:18.833


Instruction: Please provide detailed information about CVE-2025-27156

CVE:CVE-2025-27156
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the HTML emails. A malicious user could use this issue to facilitate a phishing attempt or to indirectly exploit issues in the recipients mail clients. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740567344 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
published:2025-03-04T17:15:18.997


Instruction: Please provide detailed information about CVE-2025-27401

CVE:CVE-2025-27401
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
published:2025-03-04T17:15:19.547


Instruction: Please provide detailed information about CVE-2025-27402

CVE:CVE-2025-27402
Description:Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
published:2025-03-04T17:15:19.703


Instruction: Please provide detailed information about CVE-2025-27507

CVE:CVE-2025-27507
Description:The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated users, without specific IAM roles, to modify sensitive settings. While several endpoints are affected, the most critical vulnerability lies in the ability to manipulate LDAP configurations. Customers who do not utilize LDAP for authentication are not at risk from the most severe aspects of this vulnerability. However, upgrading to the patched version to address all identified issues is strongly recommended. This vulnerability is fixed in 2.71.0, 2.70.1, ,2.69.4, 2.68.4, 2.67.8, 2.66.11, 2.65.6, 2.64.5, and 2.63.8.
published:2025-03-04T17:15:20.360


Instruction: Please provide detailed information about CVE-2025-1946

CVE:CVE-2025-1946
Description:A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T19:15:37.583


Instruction: Please provide detailed information about CVE-2025-1947

CVE:CVE-2025-1947
Description:A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageController.java. The manipulation of the argument param leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T19:15:37.760


Instruction: Please provide detailed information about CVE-2025-1949

CVE:CVE-2025-1949
Description:A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/register_nodb.php of the component URL Handler. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T19:15:37.943


Instruction: Please provide detailed information about CVE-2025-1952

CVE:CVE-2025-1952
Description:A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/password-recovery.php. The manipulation of the argument username/mobileno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T19:15:38.117


Instruction: Please provide detailed information about CVE-2025-1969

CVE:CVE-2025-1969
Description:Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof an approval in TEAM.  Upgrade TEAM to the latest release v.1.2.2. Follow instructions in updating TEAM documentation for updating process
published:2025-03-04T19:15:38.290


Instruction: Please provide detailed information about CVE-2025-26202

CVE:CVE-2025-26202
Description:Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an administrator views the passphrase via the "Click here to display" option on the Status page
published:2025-03-04T19:15:38.640


Instruction: Please provide detailed information about CVE-2025-1080

CVE:CVE-2025-1080
Description:LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.
published:2025-03-04T20:15:36.867


Instruction: Please provide detailed information about CVE-2025-1259

CVE:CVE-2025-1259
Description:On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available
published:2025-03-04T20:15:37.003


Instruction: Please provide detailed information about CVE-2025-1260

CVE:CVE-2025-1260
Description:On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.
published:2025-03-04T20:15:37.133


Instruction: Please provide detailed information about CVE-2025-1953

CVE:CVE-2025-1953
Description:A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/plugins/gateway/prefixcacheindexer/hash.go of the component Prefix Caching. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.3.0 is able to address this issue. It is recommended to upgrade the affected component.
published:2025-03-04T20:15:37.657


Instruction: Please provide detailed information about CVE-2025-1954

CVE:CVE-2025-1954
Description:A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T21:15:12.750


Instruction: Please provide detailed information about CVE-2025-1955

CVE:CVE-2025-1955
Description:A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Scheduling/scheduling/pages/profile.php. The manipulation of the argument username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T21:15:12.940


Instruction: Please provide detailed information about CVE-2025-26136

CVE:CVE-2025-26136
Description:A SQL injection vulnerability exists in mysiteforme versions prior to 2025.01.1.
published:2025-03-04T21:15:13.770


Instruction: Please provide detailed information about CVE-2025-26318

CVE:CVE-2025-26318
Description:hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.
published:2025-03-04T21:15:13.897


Instruction: Please provide detailed information about CVE-2025-1956

CVE:CVE-2025-1956
Description:A vulnerability classified as critical has been found in code-projects Shopping Portal 1.0. This affects an unknown part of the file /Shopping/Admin/index.php of the component Login. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T22:15:39.867


Instruction: Please provide detailed information about CVE-2025-1957

CVE:CVE-2025-1957
Description:A vulnerability classified as problematic was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file /BBfile/Blood/o+.php. The manipulation of the argument Bloodname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T22:15:40.040


Instruction: Please provide detailed information about CVE-2025-1958

CVE:CVE-2025-1958
Description:A vulnerability, which was classified as critical, has been found in aaluoxiang oa_system 1.0. This issue affects some unknown processing of the file src/main/resources/mappers/address-mapper.xml. The manipulation of the argument outtype leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T22:15:40.210


Instruction: Please provide detailed information about CVE-2025-25426

CVE:CVE-2025-25426
Description:yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.
published:2025-03-04T22:15:40.633


Instruction: Please provide detailed information about CVE-2025-26319

CVE:CVE-2025-26319
Description:FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
published:2025-03-04T22:15:40.993


Instruction: Please provide detailed information about CVE-2025-27510

CVE:CVE-2025-27510
Description:conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was neither present on the PyPi repository nor registered by any entity. If conda-oci-mirror is taken over by a threat actor, it can result in remote code execution.
published:2025-03-04T22:15:41.147


Instruction: Please provide detailed information about CVE-2025-1959

CVE:CVE-2025-1959
Description:A vulnerability, which was classified as critical, was found in Codezips Gym Management System 1.0. Affected is an unknown function of the file /change_s_pwd.php. The manipulation of the argument login_id/login_key leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-04T23:15:10.507


Instruction: Please provide detailed information about CVE-2025-1961

CVE:CVE-2025-1961
Description:A vulnerability has been found in SourceCodester Best Church Management Software 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/web_crud.php. The manipulation of the argument encryption leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-04T23:15:10.717


Instruction: Please provide detailed information about CVE-2025-1316

CVE:CVE-2025-1316
Description:Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device
published:2025-03-05T00:15:35.057


Instruction: Please provide detailed information about CVE-2025-1962

CVE:CVE-2025-1962
Description:A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been classified as critical. This affects an unknown part of the file /admin/addroom.php. The manipulation of the argument roomname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-05T00:15:37.540


Instruction: Please provide detailed information about CVE-2025-1963

CVE:CVE-2025-1963
Description:A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /reservation.php. The manipulation of the argument checkin leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-05T00:15:37.723


Instruction: Please provide detailed information about CVE-2025-20002

CVE:CVE-2025-20002
Description:After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure
published:2025-03-05T00:15:37.910


Instruction: Please provide detailed information about CVE-2025-21092

CVE:CVE-2025-21092
Description:GMOD Apollo does not have sufficient logical or access checks when updating a user's information. This could result in an attacker being able to escalate privileges for themselves or others.
published:2025-03-05T00:15:38.080


Instruction: Please provide detailed information about CVE-2025-23410

CVE:CVE-2025-23410
Description:When uploading organism or sequence data via the web interface,   GMOD Apollo   will unzip and inspect the files and will not check for path  traversal in supported archive types.
published:2025-03-05T00:15:38.250


Instruction: Please provide detailed information about CVE-2025-24924

CVE:CVE-2025-24924
Description:Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username
published:2025-03-05T00:15:38.423


Instruction: Please provide detailed information about CVE-2025-1964

CVE:CVE-2025-1964
Description:A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been rated as critical. This issue affects some unknown processing of the file /booknow.php?roomname=Duplex. The manipulation of the argument checkin leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
published:2025-03-05T01:15:10.020


Instruction: Please provide detailed information about CVE-2025-1965

CVE:CVE-2025-1965
Description:A vulnerability classified as critical has been found in projectworlds Online Hotel Booking 1.0. Affected is an unknown function of the file /admin/login.php. The manipulation of the argument emailusername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-05T01:15:11.600


Instruction: Please provide detailed information about CVE-2025-1966

CVE:CVE-2025-1966
Description:A vulnerability classified as critical was found in PHPGurukul Pre-School Enrollment System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-05T02:15:36.157


Instruction: Please provide detailed information about CVE-2025-1967

CVE:CVE-2025-1967
Description:A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /user_dashboard/donor.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
published:2025-03-05T02:15:36.320


Instruction: Please provide detailed information about CVE-2025-1914

CVE:CVE-2025-1914
Description:Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
published:2025-03-05T04:15:10.233


Instruction: Please provide detailed information about CVE-2025-1915

CVE:CVE-2025-1915
Description:Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)
published:2025-03-05T04:15:11.147


Instruction: Please provide detailed information about CVE-2025-1916

CVE:CVE-2025-1916
Description:Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
published:2025-03-05T04:15:11.267


Instruction: Please provide detailed information about CVE-2025-1917

CVE:CVE-2025-1917
Description:Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
published:2025-03-05T04:15:11.393


Instruction: Please provide detailed information about CVE-2025-1918

CVE:CVE-2025-1918
Description:Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. (Chromium security severity: Medium)
published:2025-03-05T04:15:11.520


Instruction: Please provide detailed information about CVE-2025-1919

CVE:CVE-2025-1919
Description:Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
published:2025-03-05T04:15:11.647


Instruction: Please provide detailed information about CVE-2025-1921

CVE:CVE-2025-1921
Description:Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about a peripheral via a crafted HTML page. (Chromium security severity: Medium)
published:2025-03-05T04:15:11.763


Instruction: Please provide detailed information about CVE-2025-1922

CVE:CVE-2025-1922
Description:Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
published:2025-03-05T04:15:11.887


Instruction: Please provide detailed information about CVE-2025-1923

CVE:CVE-2025-1923
Description:Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
published:2025-03-05T04:15:12.010


Instruction: Please provide detailed information about CVE-2025-27637

CVE:CVE-2025-27637
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Cross-Site Scripting V-2024-016.
published:2025-03-05T06:15:34.977


Instruction: Please provide detailed information about CVE-2025-27638

CVE:CVE-2025-27638
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.
published:2025-03-05T06:15:35.157


Instruction: Please provide detailed information about CVE-2025-27639

CVE:CVE-2025-27639
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015.
published:2025-03-05T06:15:35.297


Instruction: Please provide detailed information about CVE-2025-27640

CVE:CVE-2025-27640
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows SQL Injection V-2024-012.
published:2025-03-05T06:15:35.423


Instruction: Please provide detailed information about CVE-2025-27641

CVE:CVE-2025-27641
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009.
published:2025-03-05T06:15:35.583


Instruction: Please provide detailed information about CVE-2025-27642

CVE:CVE-2025-27642
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Editing V-2024-008.
published:2025-03-05T06:15:35.720


Instruction: Please provide detailed information about CVE-2025-27643

CVE:CVE-2025-27643
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.
published:2025-03-05T06:15:35.847


Instruction: Please provide detailed information about CVE-2025-27644

CVE:CVE-2025-27644
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privilege Escalation V-2024-007.
published:2025-03-05T06:15:35.990


Instruction: Please provide detailed information about CVE-2025-27645

CVE:CVE-2025-27645
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by Trusting HTTP Permission Methods on the Server Side V-2024-005.
published:2025-03-05T06:15:36.117


Instruction: Please provide detailed information about CVE-2025-27646

CVE:CVE-2025-27646
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001.
published:2025-03-05T06:15:36.257


Instruction: Please provide detailed information about CVE-2025-27647

CVE:CVE-2025-27647
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication V-2024-002.
published:2025-03-05T06:15:36.387


Instruction: Please provide detailed information about CVE-2025-27648

CVE:CVE-2025-27648
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003.
published:2025-03-05T06:15:36.523


Instruction: Please provide detailed information about CVE-2025-27649

CVE:CVE-2025-27649
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-2023-016.
published:2025-03-05T06:15:36.667


Instruction: Please provide detailed information about CVE-2025-27650

CVE:CVE-2025-27650
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013.
published:2025-03-05T06:15:36.817


Instruction: Please provide detailed information about CVE-2025-27651

CVE:CVE-2025-27651
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec V-2023-014.
published:2025-03-05T06:15:36.950


Instruction: Please provide detailed information about CVE-2025-27652

CVE:CVE-2025-27652
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEAS V-2023-015.
published:2025-03-05T06:15:37.077


Instruction: Please provide detailed information about CVE-2025-27653

CVE:CVE-2025-27653
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticated Cross Site Scripting (XSS): Badge Registration V-2023-012.
published:2025-03-05T06:15:37.203


Instruction: Please provide detailed information about CVE-2025-27654

CVE:CVE-2025-27654
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scripting (XSS) V-2023-017.
published:2025-03-05T06:15:37.340


Instruction: Please provide detailed information about CVE-2025-27655

CVE:CVE-2025-27655
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 V-2023-009.
published:2025-03-05T06:15:37.480


Instruction: Please provide detailed information about CVE-2025-27656

CVE:CVE-2025-27656
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.
published:2025-03-05T06:15:37.613


Instruction: Please provide detailed information about CVE-2025-27657

CVE:CVE-2025-27657
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Code Execution V-2023-008.
published:2025-03-05T06:15:37.740


Instruction: Please provide detailed information about CVE-2025-27658

CVE:CVE-2025-27658
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20230524-0001.
published:2025-03-05T06:15:37.860


Instruction: Please provide detailed information about CVE-2025-27659

CVE:CVE-2025-27659
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002.
published:2025-03-05T06:15:37.987


Instruction: Please provide detailed information about CVE-2025-27660

CVE:CVE-2025-27660
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scripting OVE-20230524-0003.
published:2025-03-05T06:15:38.190


Instruction: Please provide detailed information about CVE-2025-27661

CVE:CVE-2025-27661
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.
published:2025-03-05T06:15:38.337


Instruction: Please provide detailed information about CVE-2025-27662

CVE:CVE-2025-27662
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
published:2025-03-05T06:15:38.467


Instruction: Please provide detailed information about CVE-2025-27663

CVE:CVE-2025-27663
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20230524-0007.
published:2025-03-05T06:15:38.587


Instruction: Please provide detailed information about CVE-2025-27664

CVE:CVE-2025-27664
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20230524-0008.
published:2025-03-05T06:15:38.717


Instruction: Please provide detailed information about CVE-2025-27665

CVE:CVE-2025-27665
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection and thus drivers can have known malicious code OVE-20230524-0009.
published:2025-03-05T06:15:38.840


Instruction: Please provide detailed information about CVE-2025-27666

CVE:CVE-2025-27666
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20230524-0010.
published:2025-03-05T06:15:38.970


Instruction: Please provide detailed information about CVE-2025-27667

CVE:CVE-2025-27667
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-0011.
published:2025-03-05T06:15:39.100


Instruction: Please provide detailed information about CVE-2025-27668

CVE:CVE-2025-27668
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Iframe OVE-20230524-0012.
published:2025-03-05T06:15:39.237


Instruction: Please provide detailed information about CVE-2025-27669

CVE:CVE-2025-27669
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS OVE-20230524-0013.
published:2025-03-05T06:15:39.373


Instruction: Please provide detailed information about CVE-2025-27670

CVE:CVE-2025-27670
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OVE-20230524-0014.
published:2025-03-05T06:15:39.537


Instruction: Please provide detailed information about CVE-2025-27671

CVE:CVE-2025-27671
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0015.
published:2025-03-05T06:15:39.903


Instruction: Please provide detailed information about CVE-2025-27672

CVE:CVE-2025-27672
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-0016.
published:2025-03-05T06:15:40.043


Instruction: Please provide detailed information about CVE-2025-27673

CVE:CVE-2025-27673
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20230524-0017.
published:2025-03-05T06:15:40.167


Instruction: Please provide detailed information about CVE-2025-27674

CVE:CVE-2025-27674
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.
published:2025-03-05T06:15:40.293


Instruction: Please provide detailed information about CVE-2025-27675

CVE:CVE-2025-27675
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
published:2025-03-05T06:15:40.420


Instruction: Please provide detailed information about CVE-2025-27676

CVE:CVE-2025-27676
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2023-002.
published:2025-03-05T06:15:40.553


Instruction: Please provide detailed information about CVE-2025-27677

CVE:CVE-2025-27677
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022-002.
published:2025-03-05T06:15:40.683


Instruction: Please provide detailed information about CVE-2025-27678

CVE:CVE-2025-27678
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023-001.
published:2025-03-05T06:15:40.817


Instruction: Please provide detailed information about CVE-2025-27679

CVE:CVE-2025-27679
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge Registration V-2023-005.
published:2025-03-05T06:15:40.933


Instruction: Please provide detailed information about CVE-2025-27680

CVE:CVE-2025-27680
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.
published:2025-03-05T06:15:41.047


Instruction: Please provide detailed information about CVE-2025-27681

CVE:CVE-2025-27681
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004.
published:2025-03-05T06:15:41.177


Instruction: Please provide detailed information about CVE-2025-27682

CVE:CVE-2025-27682
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
published:2025-03-05T06:15:41.297


Instruction: Please provide detailed information about CVE-2025-27683

CVE:CVE-2025-27683
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File with Dangerous Type V-2022-006.
published:2025-03-05T06:15:41.427


Instruction: Please provide detailed information about CVE-2025-27684

CVE:CVE-2025-27684
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.
published:2025-03-05T06:15:41.540


Instruction: Please provide detailed information about CVE-2025-27685

CVE:CVE-2025-27685
Description:Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001.
published:2025-03-05T06:15:41.663


Instruction: Please provide detailed information about CVE-2025-1393

CVE:CVE-2025-1393
Description:An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.
published:2025-03-05T08:15:35.107


Instruction: Please provide detailed information about CVE-2025-0990

CVE:CVE-2025-0990
Description:The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the iamgloria23_gloria_settings_page function. This makes it possible for unauthenticated attackers to reset the tenant ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-05T09:15:09.947


Instruction: Please provide detailed information about CVE-2025-1008

CVE:CVE-2025-1008
Description:The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
published:2025-03-05T09:15:10.110


Instruction: Please provide detailed information about CVE-2025-1435

CVE:CVE-2025-1435
Description:The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbp_user_add_role_on_register() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Rather than implementing a nonce check to provide protection against this vulnerability, which would break functionality, the plugin no longer makes it possible to select a role during registration.
published:2025-03-05T09:15:10.267


Instruction: Please provide detailed information about CVE-2025-22493

CVE:CVE-2025-22493
Description:Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100.
published:2025-03-05T09:15:10.443


Instruction: Please provide detailed information about CVE-2025-0954

CVE:CVE-2025-0954
Description:The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's settings.
published:2025-03-05T10:15:19.130


Instruction: Please provide detailed information about CVE-2025-0956

CVE:CVE-2025-0956
Description:The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
published:2025-03-05T10:15:19.480


Instruction: Please provide detailed information about CVE-2025-1515

CVE:CVE-2025-1515
Description:The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
published:2025-03-05T10:15:19.850


Instruction: Please provide detailed information about CVE-2025-25015

CVE:CVE-2025-25015
Description:Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
published:2025-03-05T10:15:20.160


Instruction: Please provide detailed information about CVE-2025-1463

CVE:CVE-2025-1463
Description:The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary posts, including private, granted they can trick a site administrator into performing an action such as clicking on a link.
published:2025-03-05T12:15:35.270


Instruction: Please provide detailed information about CVE-2025-1702

CVE:CVE-2025-1702
Description:The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
published:2025-03-05T12:15:35.420


Instruction: Please provide detailed information about CVE-2025-1714

CVE:CVE-2025-1714
Description:Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and potentially DOS the server
published:2025-03-05T15:15:15.413


Instruction: Please provide detailed information about CVE-2025-21095

CVE:CVE-2025-21095
Description:Path traversal may lead to arbitrary file download. The score without  least privilege principle violation is as calculated below. In  combination with other issues it may facilitate further compromise of  the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
published:2025-03-05T16:15:37.487


Instruction: Please provide detailed information about CVE-2025-22212

CVE:CVE-2025-22212
Description:A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.
published:2025-03-05T16:15:37.643


Instruction: Please provide detailed information about CVE-2025-23416

CVE:CVE-2025-23416
Description:Path traversal may lead to arbitrary file deletion. The score without  least privilege principle violation is as calculated below. In  combination with other issues it may facilitate further compromise of  the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
published:2025-03-05T16:15:38.530


Instruction: Please provide detailed information about CVE-2025-24494

CVE:CVE-2025-24494
Description:Path traversal may allow remote code execution using privileged account  (requires device admin account, cannot be performed by a regular user).  In combination with the 'Upload' functionality this could be used to  execute an arbitrary script or possibly an uploaded binary. Remediation  in Version 6.7.0, release date: 20-Oct-24.
published:2025-03-05T16:15:38.937


Instruction: Please provide detailed information about CVE-2025-24521

CVE:CVE-2025-24521
Description:External XML entity injection allows arbitrary download of files. The  score without least privilege principle violation is as calculated  below. In combination with other issues it may facilitate further  compromise of the device. Remediation in Version 6.8.0, release date:  01-Mar-25.
published:2025-03-05T16:15:39.093


Instruction: Please provide detailed information about CVE-2025-27411

CVE:CVE-2025-27411
Description:REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.
published:2025-03-05T16:15:40.310


Instruction: Please provide detailed information about CVE-2025-27412

CVE:CVE-2025-27412
Description:REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.
published:2025-03-05T16:15:40.457


Instruction: Please provide detailed information about CVE-2025-27497

CVE:CVE-2025-27497
Description:OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.
published:2025-03-05T16:15:40.587


Instruction: Please provide detailed information about CVE-2025-20206

CVE:CVE-2025-20206
Description:A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the Secure Firewall Posture Engine, formerly HostScan, is installed on Cisco Secure Client.

 This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to a specific Cisco Secure Client process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker must have valid user credentials on the Windows system.
published:2025-03-05T17:15:14.450


Instruction: Please provide detailed information about CVE-2025-20208

CVE:CVE-2025-20208
Description:A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

 This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
published:2025-03-05T17:15:14.610


Instruction: Please provide detailed information about CVE-2025-27513

CVE:CVE-2025-27513
Description:OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.
published:2025-03-05T19:15:39.337


Instruction: Please provide detailed information about CVE-2025-27515

CVE:CVE-2025-27515
Description:Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request could potentially bypass the validation rules. This vulnerability is fixed in 11.44.1 and 12.1.1.
published:2025-03-05T19:15:39.483


Instruction: Please provide detailed information about CVE-2025-2003

CVE:CVE-2025-2003
Description:Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.
published:2025-03-05T19:15:39.630


Instruction: Please provide detailed information about CVE-2025-27517

CVE:CVE-2025-27517
Description:Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt components. This vulnerability is fixed in 1.7.0.
published:2025-03-05T20:16:05.960


Instruction: Please provide detailed information about CVE-2025-25362

CVE:CVE-2025-25362
Description:A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field.
published:2025-03-05T21:15:19.803


Instruction: Please provide detailed information about CVE-2025-25632

CVE:CVE-2025-25632
Description:Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.
published:2025-03-05T21:15:19.890


Instruction: Please provide detailed information about CVE-2025-25634

CVE:CVE-2025-25634
Description:A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src leads to stack-based buffer overflow.
published:2025-03-05T21:15:19.980


Instruction: Please provide detailed information about CVE-2025-27516

CVE:CVE-2025-27516
Description:Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup. This vulnerability is fixed in 3.1.6.
published:2025-03-05T21:15:20.073


Instruction: Please provide detailed information about CVE-2025-27508

CVE:CVE-2025-27508
Description:Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
published:2025-03-05T22:15:35.867


Instruction: Please provide detailed information about CVE-2025-27622

CVE:CVE-2025-27622
Description:Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allowing attackers with Agent/Extended Read permission to view encrypted values of secrets.
published:2025-03-05T23:15:13.990


Instruction: Please provide detailed information about CVE-2025-27623

CVE:CVE-2025-27623
Description:Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets.
published:2025-03-05T23:15:14.097


Instruction: Please provide detailed information about CVE-2025-27624

CVE:CVE-2025-27624
Description:A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of sidepanel widgets (e.g., Build Queue and Build Executor Status widgets).
published:2025-03-05T23:15:14.197


Instruction: Please provide detailed information about CVE-2025-27625

CVE:CVE-2025-27625
Description:In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as part of scheme-relative redirects.
published:2025-03-05T23:15:14.297