An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability.
A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.
A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service and weaken credentials resulting in default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.
SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the EPUB file processing component, specifically in the functionality responsible for extracting and handling EPUB archive contents.
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.
Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated remote attackers to access or manipulate files in the /storage/ directory. The attack complexity is high and a publicly available exploit exists, though no active exploitation is confirmed and EPSS indicates very low likelihood of exploitation.
A security vulnerability in A vulnerability (CVSS 7.3). High severity vulnerability requiring prompt remediation.
Deserialization in nutzam NutzBoot's LiteRpc-Serializer component allows remote attackers to potentially read sensitive data from affected systems. An exploit is publicly available; no active exploitation has been confirmed. The vulnerability carries an extremely low CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact, though real-world impact may be greater if deserialization gadget chains permit arbitrary code execution.
Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX are unaffected. This would mainly affect someone directly using werkzeug/gunicorn. In those cases, either an upgrade or changing the setup to use a reverse proxy is recommended. This vulnerability is fixed in 15.86.0 and 14.99.2.
Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device.
A privilege escalation vulnerability (CVSS 6.6) that allows a local user. Remediation should follow standard vulnerability management procedures.
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.
Unbounded memory allocation in CPython's http.client module allows any HTTP server the client connects to-whether malicious, compromised, or MITM-intercepted-to exhaust the client process's memory by advertising an arbitrarily large Content-Length header, triggering MemoryError exceptions, OOM-killed processes or containers, swap exhaustion, or system crashes. All active CPython 3.x branches are affected: 3.10 through 3.14.x and pre-release 3.15 builds. When a Python application calls response.read() without specifying a byte limit, the legacy _safe_read() implementation issued a single read() call sized to the full server-declared Content-Length, causing catastrophic single-shot allocation. No public exploit has been identified and EPSS is 0.15%.
Command injection in ADSLR NBR1005GPEV2 firmware version 250814-r037c allows remote authenticated attackers with low privileges to execute arbitrary commands via the mac parameter in the ap_macfilter_add function of /send_order.cgi. Exploit code is publicly available, though the EPSS exploitation probability is low (0.56%) and the vulnerability has not been cataloged in CISA KEV. The vendor has not responded, leaving no official patch.
Command injection in ADSLR B-QE2W401 firmware version 250814-r037c allows remote attackers to execute arbitrary commands via the `del_swifimac` parameter in the `/send_order.cgi` endpoint. Exploit code is publicly available; no active exploitation (CISA KEV) is reported, though the EPSS likelihood of exploitation is at the 68th percentile (0.56%). The vendor has not responded to disclosure.
Authenticated command injection in ADSLR NBR1005GPEV2 router firmware 250814-r037c allows remote attackers with low privileges to execute arbitrary OS commands via the mac parameter in /send_order.cgi. Exploit code is publicly available, though no active exploitation has been reported. The vulnerability scores only 2.1 in CVSS 4.0 due to limited impact.
Command injection in the ADSLR NBR1005GPEV2 router (firmware 250814-r037c) via the `mac` parameter in the `ap_macfilter_del` function of `/send_order.cgi` allows authenticated remote attackers to execute arbitrary OS commands on the device. A public exploit has been disclosed and the vendor was unresponsive to responsible disclosure, leaving the vulnerability unpatched. EPSS sits at 0.41% (61st percentile), suggesting limited mass exploitation activity despite POC availability.
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories via the /networkDisk/unzipFile endpoint. The vulnerability exists in the FileOperation.unzip function processing the fileUrl argument without proper sanitization, enabling ZIP slip-style extraction. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV; the EPSS probability is low (0.15%).
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitrary files via the /file/pictures endpoint by manipulating the filedatas argument. A public proof-of-concept exploit is available, but no active exploitation has been confirmed by CISA KEV. The EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation.
Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external websites via a crafted parameter, facilitating phishing or social engineering attacks.
Server-side request forgery in orion-ops allows authenticated remote attackers to manipulate SSH connection parameters (host, port, credentials) to trigger outbound requests from the server, potentially reaching internal services. The vulnerability affects all versions up to commit 5925824 and has a publicly available proof-of-concept exploit. Exploitation requires low-privilege access and may impact confidentiality, integrity, and availability of internal assets.
A security vulnerability in orionsec orion-ops (CVSS 4.3). Risk factors: public PoC available.
We are tasked with analyzing CVE-2025-13811 and producing a JSON object with the specified fields. We must synthesize multiple intelligence sources. Here's the data we have: - CVE ID: CVE-2025-13811 - Description: Affects jsnjfz WebStack-Guns 1.0, file PageFactory.java, argument 'sort' leads to SQL injection. Remote attack possible, exploit publicly disclosed, vendor contacted but no response. - CVSS Score: 2.1 (but there is a CVSS v4.0 vector, note: CVSS v4.0 vector doesn't map to a 2.1 score; maybe it's a typo or they provided a vector with base score? CVSS v4.0 vector provided but with all base metrics set to X? Wait, the vector is: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That includes AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The base score for that would be: using CVSS 4.0 calculator, AV:N (network), AC:L (low attack complexity), AT:N (no attack requirements), PR:L (low privileges required), UI:N (no user interaction), VC:L (low impact on confidentiality), VI:L (low impact on integrity), VA:L (low impact on availability), SC:N, SI:N, SA:N. The base score would be 2.3? Actually, let's compute: Base Score = likelihood subscore + impact subscore. Likelihood subscore: [8.1 - (0.0+0.0+0.0+0.2+0.0)] = 7.9? I need to recall CVSS 4.0 formula. Simpler: use the fact that the given score is 2.1, but that might be the CVSS v2 or v3 score. Actually, they provided "CVSS Score: 2.1" but also a CVSS v4.0 vector. It might be that the CVSS v4.0 vector's base score is 2.3, but they approximated as 2.1? Either way, the vector indicates network attack vector with low privileges, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit maturity: P (proof-of-concept). So we'll use this for our assessment. - EPSS Score: 0.04% (percentile 12%) very low probability of exploitation. - POC/Exploit: Publicly available. Tags: SQLi, Java. - KEV: Not mentioned, so NO. - Patch: Not available, vendor unresponsive. - CPE: cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:* - References include GitHub POC, VulDB entries. We need to construct a JSON with the required fields. Each field is a string (paragraph). Let's go through each field: 1. "product_name": "1-3 words ONLY. The specific product or service name affected. Pick primary one: 'WebStack-Guns'" (since jsnjfz is the organization). "WebStack-Guns" is the product name. So product_name: "WebStack-Guns" 2. "summary": 2-3 sentence plain-language summary. Must not copy description. Start with impact verb and product. Exploitation conditions: it's an SQL injection in PageFactory.java 'sort' argument. The vector indicates low privileges required, network exploitation. Exploit available publicly. Vendor unresponsive. EPSS low. So summary: "SQL injection in WebStack-Guns 1.0 allows remote authenticated attackers to manipulate database queries via the 'sort' parameter in PageFactory.java. Exploit code is publicly available, but the vulnerability has low EPSS score and limited real-world impact due to low privilege requirements and low C/I/A impacts. Vendor has not responded to disclosure." 3. "technical_context": Explain technology/library/protocol involved. CWE-74 is improper neutralization of special elements in output used by a downstream component ('Injection'). Since it's Java and SQL injection, likely uses mybatis or JDBC where user input is not parameterized. File: PageFactory.java, constant factory. So we'll mention Java-based web application, likely uses MyBatis or JDBC, argument 'sort' inadvertently concatenated into SQL. Use CPE to identify exact affected product. State that the vulnerability is an SQL injection in the sort parameter of a page factory class. 4. "risk_assessment": CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base score about 2.3. EPSS 0.04% (12%), low probability. POC available, but not in KEV. Low impact on confidentiality, integrity, availability. So real risk is low. Also note that the attack requires low privileges, which limits exploitation to authenticated users. So the risk is low. Mention that the PR:L indicates that an attacker needs some authenticated access, so it's not remote unauthenticated. The vendor hasn't responded, so no patch. Contrast the CVSS severity (Low) with the low EPSS; all signals point to low priority. Include that. 5. "affected_products": List affected products: jsnjfz WebStack-Guns version 1.0. Use CPE string. There is a vendor advisory? VulDB links may serve as advisory. So write: "jsnjfz WebStack-Guns version 1.0 is affected (cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*). The vulnerability is documented in VulDB entry 333821 and a GitHub proof-of-concept report. No official vendor advisory is available." 6. "remediation": No patch available. Suggest compensating controls: Since SQL injection in sort parameter, input validation, use parameterized queries, or deploy a Web Application Firewall to block malicious sort inputs. Also consider restricting access to the affected endpoint if possible. As no fix version, say "No vendor-released patch is available. Mitigations include validating and sanitizing the 'sort' parameter to allow only expected values, using prepared statements, or deploying a WAF rule to block SQL injection attempts. Restrict access to the affected functionality to trusted users only." 7. "exploit_scenario": Attack scenario: Given PR:L, attacker needs authenticated access with low privileges. They send a crafted request to the endpoint that processes the sort parameter, injecting SQL, potentially reading or modifying database contents. Since VC/VI/VA are low, impact is minor. Mention POC available. So: "An authenticated attacker with low privileges sends a malicious HTTP request containing a crafted sort parameter. The injected SQL is executed, leading to potential low-level data leakage or modification." 8. "exploitation_conditions": From description, the unknown code in PageFactory.java and argument sort. The CVSS vector indicates PR:L, so exploitation requires low-level authentication. So conditions: attacker must be authenticated with low privileges and the application must use the unsanitized sort argument in SQL. No other special configuration noted. So: "Exploitation requires authentication as a low-privileged user on WebStack-Guns 1.0. The vulnerable 'sort' parameter must be processed by the PageFactory class without input sanitization." 9. "attack_chain": We need steps separated by arrows. Based on description: network access -> send crafted sort param -> SQL injection -> data manipulation/disclosure. Since PR:L, need to authenticate first. So: "Authenticate to application as low-privileged user → Identify vulnerable PageFactory endpoint → Send HTTP request with malicious sort parameter → SQL injection executes → Read or modify database records (low impact)." 10. "confidence_notes": Data completeness: exploit confirmed by public POC on GitHub, vendor contacted but no response, so no official patch. CVSS vector provided by VulDB, so confidence in the vector is high? But note the CVSS v4.0 vector is from VulDB, and NVD might not have analyzed it yet. The EPSS is from FIRST. So: "Exploit publicly available via GitHub POC. CVSS v4.0 base metrics and impact confirmed by VulDB. No vendor advisory or fix. The low impact ratings (VC:L, VI:L, VA:L) suggest limited severity despite the SQL injection nature." 11. "prevalence": One word. WebStack-Guns is a niche web stack management tool. Not widely known. Likely low adoption. So "low". 12. "prevalence_basis": Short justification: "Niche web management framework, limited adoption." So: "Niche web framework with limited enterprise deployment." 13. "assessed_cvss_vector": Our own independent CVSS 3.1 vector based on description and conditions. Let's map: AV:N (network attack), AC:L (low complexity), PR:L (low privileges), UI:N (no user interaction), S:U? The description says it's a manipulation of argument sort leading to SQL injection, no mention of scope change. So S:U. C:L/I:L/A:L? The CVSS v4.0 gave VC:L/VI:L/VA:L, so low impact. In CVSS 3.1, low means partial. So C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would be base score 6.3 (medium). But the v4.0 score was low. Actually, in CVSS 4.0 low impact scores lead to low base score because impact is much lower. So in 3.1, the low impacts still give a medium score. But the description might actually allow full database access? The description doesn't specify magnitude, but the v4.0 vector gave low impacts. We'll stick with that. So the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we need to justify: It's a SQL injection with network vector, low complexity, low privileges, no user interaction, unchanged scope, low confidentiality, integrity, availability impact. So rationale: "Requires low privileges (PR:L) and network access; low impact assumed due to limited data exposure." 14. "assessed_cvss_rationale": one sentence. "Network-exploitable with low privileges; low impact assumed from description and similar CVSS scores." Or "SQL injection with low complexity, low privileges; limited to low data impact." So: "Low attack complexity and privileges; limited confidentiality, integrity, and availability impact based on vulnerability report." 15. "assessed_cvss40_vector": We'll use the provided v4.0 vector as base, but we must ensure it's consistent with our 3.1 assessment. The v4.0 vector provided actually has AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's the base vector. That's already the vector we'd use. So we can output that. But if we need to provide our own independent one, it's the same. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now, assemble the JSON. All fields strings, no arrays. Make sure not to copy description, original synthesis. Use the terms as per rules: exploitation conditions, confidence, etc. For prevalence, we said low, basis: "Niche web framework with limited enterprise deployment." Risk assessment: must contrast CVSS score (low base score in v4.0) with EPSS (low). The v4.0 score was 2.3, but v3.1 would be 6.3, but the provided score is 2.1 (likely they computed v4.0 base). So we'll mention that the CVSS v4.0 base score is low (2.3), indicating low severity, EPSS very low, no active exploitation, no KEV. So risk is low. Patch missing but impact limited. Remediation: note that vendor did not respond so no patch, suggest parameterized queries, WAF, restrict access. Also mention that since PR:L, only authenticated users can exploit, so limiting access further reduces risk. Attack chain: I'll structure as: "Authenticate as low-privileged user → Locate vulnerable endpoint → Send crafted HTTP request with malicious sort parameter → SQL injection modifies query logic
Information disclosure in NutzBoot 2.6.0-SNAPSHOT allows remote attackers with low privileges to access sensitive Ethereum wallet data via a manipulation of the EthModule.java endpoint. Public exploit code is available, but no active exploitation has been confirmed; EPSS estimates very low exploitation probability (0.04%).
An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runtime system on Linux and QNX to trigger an out-of-bounds read via crafted socket communication, potentially causing a denial of service.
A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.
CVE-2025-49642 is a security vulnerability (CVSS 5.8). Remediation should follow standard vulnerability management procedures.
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger reads of stale data that can lead to kernel exceptions and write use-after-free. The Use After Free common weakness enumeration was chosen as the stale data can include handles to resources in which the reference counts can become unbalanced. This can lead to the premature destruction of a resource while in use.
A security vulnerability in to forward the current HTTP request to another server. (CVSS 5.4). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Cross-Site Request Forgery (CSRF) vulnerability in Tekrom Technology Inc. T-Soft E-Commerce allows Cross Site Request Forgery.This issue affects T-Soft E-Commerce: through 28112025.
mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source by using character references. This could make rendered user supplied markdown code elements appear like the rest of the page. This vulnerability is fixed in 13.2.1.
CVE-2024-32388 is a security vulnerability (CVSS 5.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to expose sensitive data.This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.
An authenticated Zabbix Super Admin can exploit the oauth.authorize action to read arbitrary files from the webserver leading to potential confidentiality loss.
Reflected Cross-site Scripting (XSS) vulnerability in Sanoma's Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL in '/students/carpetes_varies.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
A remote code execution vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules being disabled, there exists an issue which allows authenticated users to use specially crafted requests to read documents from data streams without having the respective privileges.
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 through r54p1; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 through r54p1.
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-side request forgery in deco-cx apps 0.120.1 and earlier allows a low-privileged remote attacker to manipulate the `url` parameter in the AnalyticsScript loader, forcing the server to fetch arbitrary URLs. This can result in low-impact information disclosure, internal network reconnaissance, or interaction with internal services. A public exploit exists, but there is no evidence of active exploitation (EPSS 0.05%); upgrading to version 0.120.2 removes the vulnerable parameter.
Cross-site scripting in jairiidriss RestaurantWebsite allows remote attackers to inject arbitrary web scripts via the selected_date parameter in the Make a Reservation component. The vulnerability has a low CVSS 4.0 base score and an EPSS score of 0.04%, indicating low exploitation likelihood, but public exploit code exists. User interaction is required to trigger the script execution.
Uncontrolled memory allocation in Python's plistlib module allows a crafted binary plist file to cause out-of-memory (OOM) exhaustion in any Python process that parses it. The module reads data blocks sized according to values embedded in the plist file itself, with no cap or validation against actual available data; a malicious file can specify sizes up to 2^64 bytes, triggering allocations that exhaust process or system memory. Affected CPython versions span all major release lines prior to the fixed releases (3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1, 3.15.0a3); no public exploit or CISA KEV listing exists, and EPSS is extremely low at 0.03%.
Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.
Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.