CIRCL/vulnerability-scores huggingface dataset:
ICSA-17-089-01 Schneider Electric Wonderware InTouch Access Anywhere
The client request may be forged from a different site. This will allow an external site to access internal RDP systems on behalf of the currently logged in user.CVE-2017-5156 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified.CVE-2017-5158 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated by Schneider Electric; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The software will connect via Transport Layer Security without verifying the peer 's SSL certificate properly.CVE-2017-5160 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.0 score: 5.3
GHSA-4p2f-67g5-7xhf 
An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defined scripts are permitted, OpenVPN may allow the execution of arbitrary shell commands enabling the attacker to run arbitrary commands on the device.
CVSS v3.1 score: 7.2
CVE-2023-5006 WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRF
The WP Discord Invite WordPress plugin before 2.5.1 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request.
CVSS v3.1 score: 6.5
GHSA-5hqr-x5p5-7g25 
In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.
CVSS v3.1 score: 5.5
CVE-2007-1725 
SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges.
CVSS v2.0 score: 9.3
GHSA-ff6v-wx52-q8j8 
Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted POST requests with malicious SQL payloads in the elemid parameter to extract sensitive database information using error-based or time-based blind SQL injection techniques.
CVSS v4.0 score: 8.8
CVSS v3.1 score: 8.2
CVE-2014-2099 
The msrle_decode_frame function in libavcodec/msrle.c in FFmpeg before 2.1.4 does not properly calculate line sizes, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Microsoft RLE video data.
CVSS v2.0 score: 6.8
CVE-2015-2424 
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v3.1 score: 8.8
CVSS v2.0 score: 9.3
GHSA-95pf-8jf5-pxvg 
Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
GHSA-q55p-r853-6qcm 
A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code.
CVSS v3.1 score: 9.8
GHSA-fxrj-3fj6-972h 
Rejected reason: Not used
CVE-2020-14344 
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
CVSS v3.1 score: 6.7
GHSA-hpj2-q4fg-98gf 
In the Linux kernel, the following vulnerability has been resolved:ice: Avoid crash from unnecessary IDA freeIn the remove path, there is an attempt to free the aux_idx IDA whether
it was allocated or not.  This can potentially cause a crash when
unloading the driver on systems that do not initialize support for RDMA.
But, this free cannot be gated by the status bit for RDMA, since it is
allocated if the driver detects support for RDMA at probe time, but the
driver can enter into a state where RDMA is not supported after the IDA
has been allocated at probe time and this would lead to a memory leak.Initialize aux_idx to an invalid value and check for a valid value when
unloading to determine if an IDA free is necessary.
CVSS v3.1 score: 5.5
GHSA-7r6r-545m-fqv3 
In the Linux kernel, the following vulnerability has been resolved:HID: core: Mitigate potential OOB by removing bogus memset()The memset() in hid_report_raw_event() has the good intention of
clearing out bogus data by zeroing the area from the end of the incoming
data string to the assumed end of the buffer.  However, as we have
previously seen, doing so can easily result in OOB reads and writes in
the subsequent thread of execution.The current suggestion from one of the HID maintainers is to remove the
memset() and simply return if the incoming event buffer size is not
large enough to fill the associated report.Suggested-by Benjamin Tissoires <bentiss@kernel.org>[bentiss: changed the return value]
CVSS v3.1 score: 8.8
PYSEC-2020-16 
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
CVE-2023-6491 Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.
CVSS v3.1 score: 4.3
CVE-2014-0852 
IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an SSL/TLS side-channel timing attack.
CVSS v2.0 score: 4.3
CVE-2011-2858 
Google Chrome before 14.0.835.163 does not properly handle triangle arrays, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS v2.0 score: 5
CVE-2024-5926 Path Traversal in stitionai/devika
A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and cause a Denial of Service (DoS). This issue is present in all versions of the application. The vulnerability arises due to insufficient path sanitization for the 'project-name' parameter, enabling attackers to specify paths that traverse the filesystem. By setting 'project-name' to the root directory, an attacker can cause the application to attempt to read the entire filesystem, leading to a DoS condition.
CVSS v3.0 score: 9.1
CVE-2018-9591 
In bta_hh_ctrl_dat_act of bta_hh_act.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116108738.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2006-3168 
SQL injection vulnerability in CS-Forum before 0.82 allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) debut parameters in (a) read.php, and the (3) search and (4) debut parameters in (b) index.php.
CVSS v2.0 score: 7.5
CVE-2004-1659 
Cross-site scripting (XSS) vulnerability in index.php in CuteNews 1.3.6 and earlier allows remote attackers with Administrator, Editor, Journalist or Commenter privileges to inject arbitrary web script or HTML via the mod parameter.
CVSS v2.0 score: 4.3
GHSA-5gj7-3j23-w2h2 
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.
CVSS v3.1 score: 8.5
GHSA-h65h-28xw-w79q 
A weakness has been identified in huangjunsen0406 xiaozhi-mcphub up to 1.0.3. This vulnerability affects unknown code of the file src/controllers/dxtController.ts. This manipulation of the argument manifest.name causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2004-2769 
Cerberus FTP Server before 4.0.3.0 allows remote authenticated users to list hidden files, even when the "Display hidden files" option is enabled, via the (1) MLSD or (2) MLST commands.
CVSS v2.0 score: 4
CVE-2022-3270 Incomplete Documentation of remote functions in FESTO products.
In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented  protocol which could lead to a complete loss of confidentiality, integrity and availability.

CVSS v3.1 score: 9.8
GHSA-v6m2-7m86-x8p4 
** DISPUTED **  Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum (SMF) 1.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) settings[default_theme_dir] parameter to Sources/Subs-Graphics.php and (2) settings[default_theme_dir] parameter to Sources/Themes.php.  NOTE: CVE and multiple third parties dispute this issue because the files contain a protection mechanism against direct request.
GHSA-cqqj-4p63-rrmm HTTP Request Smuggling in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVSS v3.1 score: 9.1
GHSA-xffq-h277-r59h 
In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
CVSS v3.1 score: 5.5
RHSA-2015:0846 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.0 update
CLI: Insecure default permissions on history file mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487) wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property PicketLink: SP does not take Audience condition of a SAML assertion into account mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion
CVSS v3.1 score: 6.3
CVE-2024-21049 
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 4.9
GHSA-cpw5-f693-2r28 
The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection.
CVSS v3.1 score: 8.8
CVE-2012-2853 
The webRequest API in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not properly interact with the Chrome Web Store, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site.
CVSS v2.0 score: 6.8
GHSA-r436-q6wh-rcxr 
Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.
CVSS v3.1 score: 6.1
GHSA-wcvw-rr7p-mw54 
A vulnerability was identified in SourceCodester Student Result Management System 1.0. This affects an unknown function of the file /admin/core/drop_user.php. Such manipulation of the argument ID leads to denial of service. The attack can be executed remotely. The exploit is publicly available and might be used.
CVSS v4.0 score: 5.5
CVSS v3.1 score: 6.5
CVE-2024-5895 SourceCodester Employee and Visitor Gate Pass Logging System delete_users sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects the function delete_users of the file /classes/Users.php?f=delete. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268139.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2025-41275 
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
CVSS v4.0 score: 9.3
CVE-2025-1310 Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read
The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS v3.1 score: 6.5
GHSA-44v2-wc8p-86rr 
In usb, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628508; Issue ID: ALPS07628508.
CVSS v3.1 score: 6.7
GHSA-5hvj-jff7-79vj 
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase.This issue affects Simple Testimonials Showcase: from n/a through 1.1.6.
CVSS v3.1 score: 5.9
cisco-sa-fdm-rce-Rx6vVurq Cisco Firepower Device Manager On-Box Software Remote Code Execution Vulnerability
A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device.

This vulnerability is due to insufficient sanitization of user input on specific REST API commands. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API subsystem of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system. To exploit this vulnerability, an attacker would need valid low-privileged user credentials.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1 score: 6.3
GHSA-2qpq-mrrj-2hc9 
The Connectables feature in Adobe PhotoDeluxe 3.1 prepends the Adobe directory to the CLASSPATH environment variable, which allows applets to run with higher privileges and remote attackers to gain privileges via an HTML e-mail message or a web page.
GHSA-33pq-4v9h-pchm 
After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normally allowed to access. IBM X-Force ID: 165948.
CVSS v3.1 score: 8.8
GHSA-9gcj-95cr-frx9 
Stack-based buffer overflow in the client for Citrix Program Neighborhood Agent for Win32 8.00.24737 and earlier and Citrix MetaFrame Presentation Server client for WinCE before 8.33 allows remote attackers to execute arbitrary code via a long cached icon filename in the InName XML element.
GHSA-85v6-77qr-hmv2 
WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.
CVSS v3.1 score: 7.8
GHSA-vm8w-qq4m-5rfv 
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/itemlist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS v3.1 score: 7.1
CVE-2021-22036 
VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
GHSA-f955-6xjg-749h 
gzexe in the gzip package on Red Hat Linux 5.0 and earlier allows local users to overwrite files of other users via a symlink attack on a temporary file.
CVE-2025-12036 
Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
CVE-2018-5747 
In Long Range Zip (aka lrzip) 0.631, there is a use-after-free in the ucompthread function (stream.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted lrz file.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
CVE-2024-34506 
An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.
CVSS v3.1 score: 7.5
GHSA-pcr3-grpm-hh36 
In the Linux kernel, the following vulnerability has been resolved:af_unix: read UNIX_DIAG_VFS data under unix_state_lockExact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path under
unix_state_lock() and drops the path reference after unlocking.Read the inode and device numbers for UNIX_DIAG_VFS while holding
unix_state_lock(), then emit the netlink attribute after dropping the
lock.This keeps the VFS data stable while the reply is being built.
CVSS v3.1 score: 7.8
CVE-2022-35271 
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_cert_file/` API.
CVSS v3.0 score: 4.9
CVE-2016-9599 
puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could use these open ports to gain access to unauthorized resources.
CVSS v3.0 score: 7.1
GHSA-37px-x6g4-3pm2 
The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.
GHSA-f96h-7c9x-735r 
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected installations.Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.This vulnerability is similar to, but not identical to, CVE-2023-47194.
CVSS v3.1 score: 7.8
CVE-2021-37027 
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2026-72219 lockd: Plug nlm_file leak when nlm_do_fopen() fails
In the Linux kernel, the following vulnerability has been resolved:

lockd: Plug nlm_file leak when nlm_do_fopen() fails

A client can repeatedly drive nlm_do_fopen() failures by presenting
file handles that the underlying export rejects. After kzalloc_obj()
succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not
yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps
to out_unlock, which releases nlm_file_mutex and returns without
freeing the allocation, so each failure leaks one nlm_file.

Route the failure through out_free so kfree() runs before the
function returns.
CVE-2016-6025 
The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to obtain access by leveraging an unattended workstation to conduct a post-logoff session-reuse attack involving a modified URL.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.6
GHSA-jxhw-mg8m-2pj8 Devise does not properly perform type conversion when performing database queries
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
GHSA-f39w-3rjp-955j 
Unspecified vulnerability in the Oracle iProcurement component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS v3.0 score: 7.6
CVE-2019-8271 
UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1212.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-m9fg-3q8v-gm74 
minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can send crafted HTTP requests with excessive data to overwhelm the server and cause service interruption.
CVSS v4.0 score: 8.7
GHSA-c49j-87c4-mmr5 
An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.
CVSS v3.1 score: 7.2
GHSA-c7pj-f83g-rh3v 
IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system. IBM Reference #: 1999293.
CVSS v3.0 score: 8.1
GHSA-h9mr-9vh5-65gw 
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.
CVSS v3.1 score: 7.5
ICSA-18-275-02 GE Communicator
A malicious HTML file that loads the ActiveX controls trigger the vulnerability via unchecked function calls.CVE-2017-7908 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).
CVSS v3.0 score: 7.6
CVE-2014-3984 
Multiple unspecified vulnerabilities in Libav before 0.8.12 allow remote attackers to have unknown impact and vectors.
CVSS v2.0 score: 10
CVE-2005-1121 
Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a URL.
CVSS v2.0 score: 5
CVE-2017-14042 
A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
ICSA-25-240-03 Schneider Electric Saitel DR & Saitel DP Remote Terminal Unit
Schneider Electric is aware of a vulnerability in its Saitel DR & Saitel DP RTU (Remote Terminal Unit)
products.
The Saitel DR RTU is a field device, offering a solid and powerful platform for data acquisition, communication,
automation and IED integration for distribution and transmission networks, generation sector and railway.
The Saitel DP RTU is a modular platform for medium voltage and low voltage public distribution and
transmission network management.
Failure to apply the remediations provided below may risk arbitrary code execution & privilege escalation which
could result in denial of service, loss of confidentiality, and integrity of the device.
CVSS v3.1 score: 6.7
CVE-2023-48507 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1 score: 5.4
RHSA-2022:7411 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9
jackson-databind: denial of service via a large depth of nested objects h2: Remote Code Execution in Console owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution netty: control chars in header names may lead to HTTP request smuggling xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr keycloak: Stored XSS in groups dropdown jboss-client: memory leakage in remote client transaction wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled undertow: Double AJP response for 400 from EAP 7 results in CPING failures keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console artemis-commons: Apache ActiveMQ Artemis DoS
CVSS v3.1 score: 7.5
GHSA-rpmc-m7xh-8763 
In the Linux kernel, the following vulnerability has been resolved:gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()On error handling paths, lineinfo_changed_notify() doesn't free the
allocated resources which results leaks.  Fix it.
CVSS v3.1 score: 5.5
GHSA-mc5w-4wgh-3vm5 
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
CVSS v3.1 score: 9.8
CVE-2024-31025 
SQL Injection vulnerability in ECshop 4.x allows an attacker to obtain sensitive information via the file/article.php component.
CVSS v3.1 score: 7.5
GHSA-gxqg-7fh5-vvwm 
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the 'handle_file' function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users.
CVSS v3.1 score: 5.3
GHSA-5x67-mpx5-h47q 
Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.
CVSS v3.0 score: 8.1
GHSA-c32q-h87c-6h2h 
The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the reset_plugin function. This makes it possible for unauthenticated attackers to reset the plugin's optimization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1 score: 4.3
CVE-2021-33488 
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 5.8
GHSA-g5p6-83fw-2xvf 
lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registration_hubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature.
CVE-2008-5750 
Argument injection vulnerability in Microsoft Internet Explorer 8 beta 2 on Windows XP SP3 allows remote attackers to execute arbitrary commands via the --renderer-path option in a chromehtml: URI.
CVSS v2.0 score: 6.8
GHSA-ww27-qpc9-x958 
Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request.
CVSS v3.1 score: 8.1
CVE-2006-4583 
Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) inc/cmses/aedatingCMS.php, (2) inc/cmses/aedatingCMS2.php, or (3) inc/cmses/aedating4CMS.php.
CVSS v2.0 score: 7.5
GHSA-667j-rh34-gp4p 
Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.
CVSS v3.0 score: 9.8
CVE-2009-2099 
SQL injection vulnerability in the iJoomla RSS Feeder (com_ijoomla_rss) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cat parameter in an xml action to index.php.
CVSS v2.0 score: 7.5
CVE-2018-20144 
GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control.
CVSS v3.0 score: 7.5
CVSS v2.0 score: 5
CVE-2025-1230 Cross-Site Scripting (XSS) vulnerability in Prestashop
Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘/<admin_directory>/index.php’, affecting the ‘link’ parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CVSS v3.1 score: 4.8
GHSA-9h9p-24mg-7v88 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.
CVSS v3.1 score: 9.3
CVE-2026-74789 Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations
Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} — or a memory-amplification expression such as {{ 'A' * 200000000 }} — can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service. Applications that render attacker-controlled templates and rely on LoopLimit for safe execution are affected.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5
CVE-2024-28326 
Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface.
CVSS v3.1 score: 6.8
cisco-sa-voip-phone-csrf-K56vXvVx Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based interface of an affected system.

This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform configuration changes on the affected device, resulting in a denial of service (DoS) condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1 score: 6.8
GHSA-r9q4-xcm5-g5ww 
The Appointment Hour Booking  WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
CVSS v3.1 score: 5.3
GHSA-wp2c-jcp9-h9m9 
In the Linux kernel, the following vulnerability has been resolved:rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe()With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed.msc313_rtc_probe() was passing clk_disable_unprepare() directly, which
did not have matching prototypes for devm_add_action_or_reset()'s
callback argument. Refactor to use devm_clk_get_enabled() instead.This was found as a result of Clang's new -Wcast-function-type-strict
flag, which is more sensitive than the simpler -Wcast-function-type,
which only checks for type width mismatches.
CVSS v3.1 score: 5.5
CVE-2026-12049 pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter
Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter without confirming the target pointed back inside pgAdmin, so an authenticated victim who clicked /mfa/validate?next=<external> -- a link typically delivered by phishing -- would be sent to an attacker-controlled host directly out of the trusted auth flow.

The defect is a trusted-domain redirect, not a privilege bypass: the attacker gains no read/write access to pgAdmin or the victim's database, but the redirect launders the attacker's destination through pgAdmin's URL, which raises the success rate of credential-phishing follow-on against the victim.

Fix introduces a same-origin _is_safe_redirect_url helper and gates every MFA redirect that consumes user-supplied 'next' values through it. The helper allows only relative paths and absolute URLs whose scheme is http(s) and whose host matches the current request host; it rejects external hosts in absolute and protocol-relative form, non-http schemes (javascript:, data:, mailto:), userinfo tricks (http://localhost@attacker/), and backslash variants that some browsers normalize to forward slashes. Unsafe targets fall back to the internal browser index. A dedicated regression test exercises each accept/reject category and the original reporter PoC.

This issue affects pgAdmin 4: from 6.0 before 9.16.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVE-2022-29166 Improper handling of multiline messages in matrix-appservice-irc
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. Refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms. There are no known workarounds for this issue.
CVSS v3.1 score: 8
CVE-2018-9584 
In nfc_ncif_set_config_status of nfc_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-114047681.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 4.6
GHSA-jmgj-8q9j-9228 
NVIDIA GPU Display Driver contains a vulnerability in kernel mode layer handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges.
CVSS v3.0 score: 8.8
CVE-2024-48259 
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
CVSS v3.1 score: 7.3
CVE-2013-5882 
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Stored Procedures.
CVSS v2.0 score: 6.8
GHSA-g29v-3m9r-f46w 
** UNSUPPORTED WHEN ASSIGNED ** dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers. This allows low-privileged local users to inject arbitrary printer names via the $HOME/.printers file. This injection allows those users to manipulate the control flow and disclose memory contents on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v3.1 score: 7.1
GHSA-wjg2-c55h-phf5 
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent photos without authentication in Assistive Access.
CVSS v3.1 score: 7.5
CVE-2012-2560 
Directory traversal vulnerability in WellinTech KingView 6.53 allows remote attackers to read arbitrary files via a crafted HTTP request to port 8001.
CVSS v2.0 score: 5
CVE-2005-4830 
CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the content-type parameter.
CVSS v2.0 score: 7.6
RHSA-2026:13285 Red Hat Security Advisory: libcap security update
libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()
CVSS v3.1 score: 6.7
GHSA-423j-x6cf-vmrf 
Cross-site scripting (XSS) vulnerability in the contact update page (ss/bwgkoemr.P_UpdateEmrgContacts) in SunGard Banner Student 7.3 allows remote attackers to inject arbitrary web script or HTML via the addr1 parameter.  NOTE: this might be resultant from a CSRF vulnerability, but there are insufficient details to be sure.
GHSA-r8wq-qrxc-hmcm ReDoS in LDAP schema parser
https://github.com/python-ldap/python-ldap/issues/424ImpactThe LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ``ldap.schema`` package to parse LDAP schema definitions from an untrusted source.PatchesThe upcoming release of python-ldap 3.4.0 will contain a workaround to prevent ReDoS attacks. The schema parser refuses schema definitions with an excessive amount of backslashes.WorkaroundsAs a workaround, users can check input for excessive amount of backslashes in schemas. More than a dozen backslashes per line are atypical.References[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html)For more informationIf you have any questions or comments about this advisory:Open an issue in [python-ldap](https://github.com/python-ldap/python-ldap) tracker
CVSS v3.1 score: 6.5
CVE-2024-8724 Waitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting
The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1 score: 6.1
CVE-2025-13783 taosir WTCMS CommentadminController CommentadminController.class.php delete sql injection
A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument ids results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
GHSA-8jmj-4p32-mc9p infusionsoft-php-sdk reflected Cross-site Scripting
novaksolutions/infusionsoft-php-sdk before v1.0 is vulnerable to a reflected XSS in the `leadscoring.php` via `ContactId` parameter.
CVSS v3.0 score: 6.1
GHSA-3jmh-hwrc-r94j 
Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
CVSS v3.0 score: 8.2
PYSEC-2026-2119 
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.
CVSS v3.1 score: 5.4
GHSA-5g3j-89fr-r2vp skilleton has improper input handling in repository/path processing
Summary`skilleton` versions prior to `0.3.1` include security-related weaknesses in repository normalization and path handling logic.  
Version `0.3.1` contains fixes and additional test coverage for these issues.Affected Versions`<0.3.1`Patched Versions`>=0.3.1`ImpactIn affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.  
`0.3.1` mitigates this by:replacing vulnerable parsing behavior with deterministic logic,validating subpaths earlier before allocating git worktree resources,adding stricter and broader regression tests around these flows.SeverityLow to Moderate (project-maintainer assessed)MitigationUpgrade to `0.3.1` or later.WorkaroundsNo complete workaround is recommended other than upgrading.ReferencesBranch: [`fix/security-code-scanning-alerts`](https://github.com/Fcmam5/skilleton/pull/9)Commits:[fix(security): harden git arg handling and path validation](https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172)[fix(security): use while loop in normalizeRepoUrl instead of regex](https://github.com/Fcmam5/skilleton/pull/9/changes/6613160803ec8655efee9a270eeaa767ad22da8b)Security Policy: [SECURITY.md](https://github.com/Fcmam5/skilleton/blob/master/SECURITY.md)CreditsDetected through automated code scanning and remediated by project maintainers.
CVSS v4.0 score: 6.9
CVE-2025-34215 Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (only VA deployments) expose an unauthenticated firmware-upload flow: a public page returns a signed token usable at va-api/v1/update, and every Docker image contains the appliance’s private GPG key and hard-coded passphrase. An attacker who extracts the key and obtains a token can decrypt, modify, re-sign, upload, and trigger malicious firmware, gaining remote code execution. This vulnerability has been identified by the vendor as: V-2024-020 — Remote Code Execution.
CVSS v4.0 score: 9.4
CVE-2025-61115 
ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an improper access control vulnerability in its login mechanism. The application does not properly validate user passwords during authentication, allowing attackers to bypass login checks and obtain valid session identifiers. Successful exploitation could result in unauthorized account access, privacy breaches, and misuse of the platform.
CVSS v3.1 score: 7.5
CVE-2022-23142 
ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can make the product management websites not accessible.
CVSS v3.1 score: 5.3
CVE-2022-28832 Adobe InDesign Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe InDesign versions 17.1 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-hwj3-4jmr-cwwc 
Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions.
CVSS v3.1 score: 8.8