CIRCL/vulnerability-scores huggingface dataset:
CVE-2018-6437 
A Vulnerability in the help command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 7.2
CVE-2007-5348 
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite 2006, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2, Report Viewer 2005 SP1 and 2008, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via an image file with crafted gradient sizes in gradient fill input, which triggers a heap-based buffer overflow related to GdiPlus.dll and VGX.DLL, aka "GDI+ VML Buffer Overrun Vulnerability."
CVSS v2.0 score: 9.3
GHSA-4wvg-r3cj-2gc3 
Unspecified vulnerability in HP Virtual Connect Enterprise Manager (VCEM) 6.0 and 6.1 allows remote attackers to read arbitrary files via unknown vectors.
GHSA-cjcj-g2w6-gp9q 
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
CVSS v3.1 score: 6.1
GHSA-fjxr-28c8-xp4f 
The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to read arbitrary files via a crafted TCP packet to an unspecified port.
GHSA-6wp4-cpxh-5846 
The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password.
CVSS v3.1 score: 6.5
GHSA-h762-rhv3-h25v OpenEXR: integer overflow to OOB write in uncompress_b44_impl()
SummaryThe B44/B44A decoder in OpenEXR reconstructs row pointers into a scratch buffer using int. When the channel width (nx) is large enough, the product y * nx overflows int, causing the row pointer to wrap before the start of the scratch buffer. Subsequent memcpy() calls then write decoded pixel blocks to an invalid address, producing an active out-of-bounds write.Root causeVariable declarations (internal_b44.c:535)`nx` and `ny` are declared as plain int. They are assigned from `curc->width` and `curc->height` which are int32_t.Scratch buffer allocation (internal_b44:543)The allocation path correctly promotes to uint64_t before multiplying.
The scratch buffer is always large enough to hold the full channel.Row pointer reconstruction (internal_b44:560)`y` and `nx` are both int. The product `y * nx` is computed in int. If this product exceeds INT_MAX (2,147,483,647), the result is signed integer overflowOut of Band write (internal_b44:592)These four writes copy decoded B44 pixel blocks into row0–row3, which now point to memory before the scratch buffer. 
The same pattern is present in the encoder path (ht_apply_impl), lines 431–432, where row0–row3 are read rather than written, producing an out-of-bounds read.PoCThe PoC generates a valid B44 scanline EXR file (268435456 × 9, single HALF channel) and immediately decodes it. During decompression, uncompress_b44_impl() computes `row0 += y * nx`, with y=8 and nx=268435456, the product exceeds INT_MAX, triggering a signed integer overflow that displaces row0 before the scratch buffer. The subsequent memcpy() writes to this invalid address, causing the crash. The generated file /tmp/poc_b44.exr can be replayed independently on any OpenEXR installation.ASAN TraceImpactA crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). 
Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent).
CVSS v4.0 score: 8.4
GHSA-2xj9-f7p4-9r93 
A Use After Free condition can occur in the IPA driver whenever the IPA IOCTLs IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_ADD/IPA_IOC_NOTIFY_WAN_UPSTREAM_ROUTE_DEL/IPA_IOC_NOTIFY_WAN_EMBMS_CONNECTED are called in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.
CVSS v3.0 score: 7.8
CVE-2024-29720 
An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter video rendering function.
CVSS v3.1 score: 6.2
GHSA-fqx2-5ff7-q7wj 
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
CVSS v3.0 score: 5.4
GHSA-cp55-fffx-8r57 
Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-m2vm-mcmh-jrc7 
A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 4.3
CVE-2016-3261 
Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS v3.0 score: 5.3
CVSS v2.0 score: 2.6
CVE-2017-18701 
Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34.
CVSS v3.0 score: 5.2
CVE-2018-8988 
In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xf1002008.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.1
GHSA-jjfc-8563-3h89 
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode.
CVSS v3.1 score: 7.2
CVE-2017-14503 
libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4.3
GHSA-vxx9-4mc9-6rmp 
An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.
RHSA-2024:3431 Red Hat Security Advisory: pcs security update
rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing rubygem-rack: Possible DoS Vulnerability with Range Header in Rack rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing
CVSS v3.1 score: 5.3
GHSA-6pj7-c745-c2mx 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boombox Boombox Shortcode allows DOM-Based XSS.This issue affects Boombox Shortcode: from n/a through 1.0.0.
CVSS v3.1 score: 6.5
CVE-2022-28879 Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aepack.dll component can crash the scanning engine.
CVSS v3.1 score: 4.3
GHSA-ccrq-w269-c7pj 
An attacker can use an undocumented UART port on the PCB as a side-channel    to get root access e.g. with the credentials obtained from CVE-2025-41692.
CVSS v3.1 score: 6.8
GHSA-8h3v-2qpx-685j 
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
CVSS v3.1 score: 5.4
RHSA-2022:7594 Red Hat Security Advisory: poppler security and bug fix update
poppler: A logic error in the Hints::Hints function can cause denial of service
CVSS v3.1 score: 6.5
CVE-2025-8837 JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free
A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
CVSS v3.0 score: 5.3
CVSS v2.0 score: 4.3
CVE-2020-7641 Prototype Pollution
This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVSS v3.1 score: 4
GHSA-h5qw-42jq-7cmh 
A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possibility to extract credential information. The vulnerability is due to a weakness in the design and insufficient credential protection in operating system.Other related CVE's are CVE-2025-14095 & CVE-2025-14097.Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency.Required Configuration for Exposure:Attacker requires physical access to the analyzer.Temporary work Around:
Only authorized people can physically access the analyzer.Permanent solution:
Local Radiometer representatives will contact all affected customers to discuss a permanent solution.Exploit Status:Researchers have provided a working proof-of-concept (PoC). Radiometer is not aware of any public exploit code at the time of this publication.
CVSS v3.1 score: 8.4
CVE-2014-7835 
webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scripting (XSS) attacks, by specifying the profile-picture area.
CVSS v2.0 score: 2.1
CVE-2014-0591 
The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.
CVSS v2.0 score: 2.6
CVE-2023-3444 Incorrect Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to merge arbitrary code into protected branches.
CVSS v3.1 score: 5.7
GHSA-xc2c-p2fc-pq4v 
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
CVSS v3.1 score: 6.1
CVE-2026-40795 WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Amelia <= 2.2 versions.
CVSS v3.1 score: 6.5
CVE-2007-6291 
SQL injection vulnerability in abm.aspx in Xigla Absolute Banner Manager .NET 4.0 allows remote attackers to execute arbitrary SQL commands via the z parameter.
CVSS v2.0 score: 7.5
CVE-2021-2134 
Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The supported version that is affected is 12.2.1.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager for Fusion Middleware. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager for Fusion Middleware. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1 score: 6.5
CVE-2024-45198 
insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution.
CVSS v3.1 score: 8.8
GHSA-692p-7x7m-5hxg 
Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.
CVE-2019-17611 
HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-h4jv-xw7f-wjrg 
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links 
to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would 
load the contents of those files without prompting the user for 
permission to do so.This issue affects Apache OpenOffice: through 4.1.15.Users are recommended to upgrade to version 4.1.16, which fixes the issue.
CVSS v3.1 score: 7.5
GHSA-2xqf-m93c-8p52 
A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to have write access and upload arbitrary data to the filesystem. The vulnerability is due to a failure to delete temporarily uploaded files. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the affected device. An exploit could allow the attacker to fill up the filesystem or upload malicious scripts.
CVSS v3.0 score: 5.3
GHSA-pm9j-xgg7-2gh3 
202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send crafted requests with malicious SQL statements in the log_user field to extract sensitive database information or modify database contents.
CVSS v4.0 score: 8.8
CVSS v3.1 score: 8.2
CVE-2006-2893 
index.php in GANTTy 1.0.3 allows remote attackers to obtain the full path of the web server via an invalid lang parameter in an authenticate action.
CVSS v2.0 score: 5
ICSA-26-076-02 Schneider Electric SCADAPack and RemoteConnect
Schneider Electric is aware of a vulnerability in its SCADAPack™ x70 RTU products.
The SCADAPack™ 47xi, SCADAPack™ 47x and SCADAPack™ 57x product are Remote Terminal Units that 
provide communication capabilities for remote monitoring and control.
Failure to apply the remediations provided below may risk unauthorized access to your RTU, which could 
result in the possibility of denial of service and loss of confidentiality, integrity of the controller.
CVSS v3.1 score: 9.8
GHSA-r927-6qm6-5qc7 
Intuit Lacerte 2017 has Incorrect Access Control.
CVSS v3.0 score: 5.9
RHSA-2022:5070 Red Hat Security Advisory: OpenShift Container Platform 4.11.0 extras and security update
golang: out-of-bounds read in golang.org/x/text/language leads to DoS prometheus/client_golang: Denial of service using InstrumentHandlerCounter imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path
CVSS v3.1 score: 7.4
GHSA-gf6m-w8fj-44h4 
Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1 score: 6.7
GHSA-c962-fwrv-mc74 
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.
CVE-2006-0870 
SQL injection vulnerability in pages.asp in Mini-Nuke CMS System 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: version 2.3 was later reported to be vulnerable as well.
CVSS v2.0 score: 7.5
CVE-2022-41672 Session still functional after user is deactivated
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
CVSS v3.1 score: 8.1
CVE-2023-25886 ZDI-CAN-19452: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Adobe Dimension versions 3.4.7 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-4phw-6824-6cfp OpenStack Keystone: Restricted application credentials can create EC2 credentials
An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
CVSS v3.1 score: 3.5
CVE-2019-2872 
Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Point of Sale). Supported versions that are affected are 17.0.3, 18.0.1 and 19.0.0. Difficult to exploit vulnerability allows physical access to compromise Oracle Retail Xstore Point of Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.0 Base Score 2.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).
CVSS v3.1 score: 2.7
CVSS v2.0 score: 2.6
GHSA-f8m6-gv3p-32v4 
The WinCollect agent in IBM Security QRadar SIEM before 7.1.1.569824 allows remote attackers to bypass intended access restrictions by injecting a (1) DLL or (2) configuration file.
GHSA-q7gc-mpfg-847w 
In RasterIntraUpdate of motion_est.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-176084648
CVE-2026-46899 
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are V15 and  V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework.  While the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Command Center Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVSS v3.1 score: 9.6
CVE-2012-6135 
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 6.4
CVE-2024-5040 LCDS LAquis SCADA Path Traversal
There are multiple ways in 
LCDS LAquis SCADA for an attacker to access locations outside of their own directory.
CVSS v4.0 score: 8.5
CVSS v3.1 score: 7.8
CVE-2004-2709 
Buffer overflow in the strip_html_tags method for Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown vectors involving HTML tags.
CVSS v2.0 score: 7.5
GHSA-gr2p-cxvm-95cc 
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
CVSS v3.1 score: 6.1
GHSA-6p9f-6933-82rq 
A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/ta_regtest/ta_test_func/test_minmax.c of the component ta_regtest. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5879180e9070ec35d52948f2f57519713256a0f1. It is recommended to apply a patch to fix this issue.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
GHSA-r9pp-r4xf-597r pyload-ng vulnerable to RCE with js2py sandbox escape
SummaryAny pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately.Detailsjs2py has a vulnerability of sandbox escape assigned as [CVE-2024-28397](https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape), which is used by the `/flash/addcrypted2` API endpoint of pyload-ng. Although this endpoint is designed to only accept localhost connection, we can bypass this restriction using HTTP Header, thus accessing this API and achieve RCE.PoCThe PoC is provided as `poc.py` below, you can modify the shell command it execute:ImpactAnyone who runs the latest version (<=0.5.0b3.dev85) of  pyload-ng under python3.11 or below. pyload-ng doesn't use js2py for python3.12 or above.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
GHSA-5c77-mfvp-hp63 
u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55
GHSA-mp4r-c6w2-6jrx 
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-258188673
CVSS v3.1 score: 7.8
GHSA-39c9-283p-pj5f 
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 12.0.1 allows local users to affect confidentiality via vectors related to BASE.
GHSA-3wcg-3hq8-89r6 
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.
CVSS v3.1 score: 5.4
GHSA-g3wx-h3f8-c23p 
Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands.
CVSS v4.0 score: 10
CVSS v3.1 score: 9.8
CVE-2021-39473 
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.
CVSS v3.1 score: 5.4
CVE-2025-6346 SourceCodester Advance Charity Management System fundDetails.php sql injection
A vulnerability was found in SourceCodester Advance Charity Management System 1.0. It has been classified as critical. This affects an unknown part of the file /members/fundDetails.php. The manipulation of the argument m06 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 6.3
CVSS v3.0 score: 6.3
CVSS v2.0 score: 6.5
CVE-2007-6260 
The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener.  NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed.
CVSS v2.0 score: 6.8
GHSA-v9vw-ccqp-q298 
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.
CVSS v4.0 score: 9.3
CVSS v3.1 score: 9.8
GHSA-6g5m-366h-pfpv 
Buffer overflow in Intel system Configuration utilities selview.exe and syscfg.exe before version 14 build 11 allows a local user to crash these services potentially resulting in a denial of service.
CVSS v3.0 score: 5.5
GHSA-g37x-jpmr-w7p9 
An attacker with physical access to Moxa's bootloader versions of UC-8580 Series V1.1, UC-8540 Series V1.0 to V1.2, UC-8410A Series V2.2, UC-8200 Series V1.0 to V2.4, UC-8100A-ME-T Series V1.0 to V1.1, UC-8100 Series V1.2 to V1.3, UC-5100 Series V1.2, UC-3100 Series V1.2 to V2.0, UC-2100 Series V1.3 to V1.5, and UC-2100-W Series V1.3 to V1.5 can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.
CVSS v3.1 score: 7.6
GHSA-rh5h-m336-29fp 
The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-82fq-hq56-9xxg 
In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows local attackers to hijack bdcore.dll, which leads to privilege escalation when the AMRT service loads the DLL.
CVE-2026-7362 Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.
CVSS v3.1 score: 4.3
RHSA-2006:0015 Red Hat Security Advisory: initscripts security update
security flaw
CVE-2020-22334 
Cross Site Request Forgery (CSRF) vulnerability in beescms v4 allows attackers to delete the administrator account via crafted request to /admin/admin_admin.php.
CVSS v3.1 score: 6.5
CVE-2014-3624 
Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2023-22645 kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role
An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarden-controller This issue affects: SUSE kubewarden kubewarden-controller versions prior to 1.6.0.
CVSS v3.1 score: 8
GHSA-qq6h-h8q7-3pg5 
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /index.php?page=member. The manipulation of the argument columns[0][data] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237570 is the identifier assigned to this vulnerability.
CVSS v3.0 score: 6.3
GHSA-44c7-rp6q-gcrh 
In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.
GHSA-5r82-w6v9-cqgg 
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS v3.1 score: 7.8
CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)
The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds


CVSS v3.1 score: 7.6
CVE-2020-6217 
SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
CVSS v3.0 score: 6.1
GHSA-f3jx-hr96-xf98 
A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of the component webs. The manipulation of the argument ip/mask/gateway leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 2.1
CVSS v3.1 score: 6.3
CVE-2017-15369 
The build_filter_chain function in pdf/pdf-stream.c in Artifex MuPDF before 2017-09-25 mishandles a certain case where a variable may reside in a register, which allows remote attackers to cause a denial of service (Fitz fz_drop_imp use-after-free and application crash) or possibly have unspecified other impact via a crafted PDF document.
CVSS v3.0 score: 7.8
CVSS v2.0 score: 6.8
GHSA-fm4v-hxhr-prfx 
A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. This vulnerability affects unknown code of the file /protocol/log/listloginfo.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258430 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1 score: 6.3
RHSA-2026:20825 Red Hat Security Advisory: OpenShift Virtualization v4.12 Images
kubevirt: KubeVirt virt-handler: Privilege escalation and node compromise via symlink following vulnerability
CVSS v3.1 score: 9.9
GHSA-43pc-gr5c-56gh 
SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
CVE-2024-8809 Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability
Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cohesive Networks VNS3. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 8000 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24178.
CVSS v3.0 score: 8.8
GHSA-75jr-ff4h-qp4g 
SQL injection vulnerability in login.asp in ASPjar Guestbook allows remote attackers to execute arbitrary SQL commands via the password field.
GHSA-7cwg-427v-p4xm 
A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerability affects the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument mac_address results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
CVSS v4.0 score: 7.4
CVSS v3.1 score: 8.8
CVE-2019-0023 Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu
A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
CVSS v3.0 score: 5.4
CVE-2018-2715 
Vulnerability in the Oracle Business Intelligence Enterprise Edition component of Oracle Fusion Middleware (subcomponent: BI Platform Security). Supported versions that are affected are 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.0 score: 6.5
CVSS v2.0 score: 4
CVE-2019-20015 
An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec.
CVSS v3.1 score: 6.5
CVSS v2.0 score: 4.3
RHSA-2002:041 Red Hat Security Advisory: : Updated mod_ssl packages available
security flaw
CVE-2020-21057 
Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/folderdelete.php.
CVSS v3.1 score: 8.1
CVSS v2.0 score: 5.5
GHSA-vcgf-4q4f-3267 
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS v3.1 score: 6.5
GHSA-r959-mqqr-2qrv 
Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web connections by default, and devices can receive configuration and firmware updates by unsecure FTP.
CVSS v3.0 score: 9.8
RHSA-2026:2627 Red Hat Security Advisory: gcc-toolset-14-binutils security update
binutils: GNU Binutils Linker heap-based overflow
CVSS v3.1 score: 5.3
CVE-2018-19877 
login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.
CVSS v3.0 score: 6.1
CVSS v2.0 score: 4.3
GHSA-c93m-w54c-8g9x 
In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could see alert search query responses using Splunk Secure Gateway App Key Value Store (KVstore) collections endpoints due to improper access control.
CVSS v3.1 score: 4.3
GHSA-r52c-78hj-q877 
Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Receivables.  Successful attacks of this vulnerability can result in takeover of Oracle Receivables. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.1 score: 7.2
GHSA-g9c9-v54c-gj4f 
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command.
CVSS v3.1 score: 9.8
CVE-2013-5750 
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.
CVSS v2.0 score: 5
CVE-2016-7176 
epan/dissectors/packet-h225.c in the H.225 dissector in Wireshark 2.x before 2.0.6 calls snprintf with one of its input buffers as the output buffer, which allows remote attackers to cause a denial of service (copy overlap and application crash) via a crafted packet.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
CVE-2025-46568 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references to several files inside, allow the attachment of content from any webpage or local file to a PDF. This allows the attacker to read any file on the server, including sensitive files and configuration files. All users utilizing this feature will be affected. This issue has been patched in version 0.45.0.
CVSS v4.0 score: 7.7
GHSA-5cj2-9wjg-2695 
Directory traversal vulnerability in TYPSoft FTP Server 0.85 allows remote attackers to read arbitrary files via (1) a .. (dot dot) in a GET command, or (2) a ... in a CWD command.
CVE-2021-20619 
Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2000-0152 
Remote attackers can cause a denial of service in Novell BorderManager 3.5 by pressing the enter key in a telnet connection to port 2000.
CVSS v2.0 score: 5
GHSA-w3gh-4v3q-r24h 
Cross-site scripting (XSS) vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-xc2p-88hh-m8f9 
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.
CVSS v3.1 score: 8.2
GHSA-c794-94g7-5hfq 
Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and 2.0 before RC2, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter to setup/index.php.
CVE-2023-32878 
In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308070; Issue ID: ALPS08307992.
CVSS v3.1 score: 4.4
CVE-2017-17588 
FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2010-3404 
Multiple SQL injection vulnerabilities in eshtery CMS (aka eshtery.com) allow remote attackers to execute arbitrary SQL commands via the (1) Criteria field in an unspecified form related to catlgsearch.aspx or (2) user name to an unspecified form related to adminlogin.aspx.
CVSS v2.0 score: 7.5
GHSA-3phw-rjrc-v4hm 
AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier is vulnerable to a Session Fixation attack.
CVSS v3.0 score: 8.8
CVE-2019-20532 
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can access the Developer options without authentication. The Samsung ID is SVE-2019-15800 (December 2019).
CVSS v3.1 score: 5.3
CVSS v2.0 score: 5
GHSA-7gf4-whwv-4j38 
Multiple SQL injection vulnerabilities in index.php in the Rapid Recipe (com_rapidrecipe) 1.6.5 component for Joomla! allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a showuser action or (2) the category_id parameter in a viewcategorysrecipes action.
GHSA-q6mq-c28m-5g2g 
D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.
CVSS v3.1 score: 9.8
CVE-2025-45835 
A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the environment variable value CONTENT_LENGTH, causing the program to crash and potentially leading to a denial-of-service (DoS) attack.
CVSS v3.1 score: 7.5
CVE-2019-7226 
The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser creates a session in an authenticated state and returns the session ID along with what may be the username and cleartext password of the user. An attacker can then supply an IDALToken value in a cookie, which will allow them to perform privileged operations such as restarting the service with /cgi/restart. A GET request to /cgi/loginDefaultUser may result in "1 #S_OK IDALToken=532c8632b86694f0232a68a0897a145c admin admin" or a similar response.
CVSS v3.1 score: 8.8
CVSS v2.0 score: 5.8
GHSA-pv9q-275h-rh7x PraisonAI Vulnerable Untrusted Remote Template Code Execution
PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through malicious templates.DescriptionWhen a user installs a template from a remote source (e.g., GitHub), PraisonAI downloads Python files (including `tools.py`) to a local cache without:Code signing verificationIntegrity checksum validationDangerous code pattern scanningUser confirmation before executionWhen the template is subsequently used, the cached `tools.py` is automatically loaded and executed via `exec_module()`, granting the template's code full access to the user's environment, filesystem, and network.Affected Code**Template download (no verification):****Automatic execution (no confirmation):**Trust Boundary ViolationPraisonAI breaks the expected security boundary between:**Data:** Template metadata, YAML configuration (should be safe to load)**Code:** Python files from remote sources (should require verification)By automatically executing downloaded Python code, the tool treats untrusted remote content as implicitly trusted, violating standard supply chain security practices.Proof of Concept**Attacker creates seemingly legitimate template:****Victim workflow:****What the user sees:****What actually happened:**API keys and tokens stolenNo error messages, no security warningsMalicious code ran with user's full privilegesAttack ScenariosScenario 1: Template Registry PoisoningAttacker publishes popular-looking template. Users searching for "productivity" or "research" tools find and install it. Each installation compromises the user's environment.Scenario 2: Compromised Maintainer AccountLegitimate template maintainer's GitHub account is compromised. Malicious code added to existing popular template affects all users on next update.Scenario 3: TyposquattingTemplate named `praisonai-tools-official` mimics official templates. Users mistype and install malicious version.ImpactThis vulnerability allows execution of untrusted code from remote templates, leading to potential compromise of the user’s environment.An attacker can:Access sensitive data (API keys, tokens, credentials)Execute arbitrary commands with user privilegesEstablish persistence or backdoors on the systemThis is particularly dangerous in:CI/CD pipelinesShared development environmentsSystems running untrusted or third-party templatesSuccessful exploitation can result in data theft, unauthorized access to external services, and full system compromise.RemediationImmediate**Verify template integrity**
Ensure downloaded templates are validated (e.g., checksum or signature) before use.**Require user confirmation**
Prompt users before executing code from remote templates.**Avoid automatic execution**
Do not execute `tools.py` unless explicitly enabled by the user.Short-term**Sandbox execution**
Run template code in an isolated environment with restricted access.**Trusted sources only**
Allow templates only from verified or trusted publishers.**Reporter:** Lakshmikanthan K (letchupkt)
CVSS v3.1 score: 9.3
GHSA-f85g-9q3j-pg6p 
epan/dissectors/packet-h225.c in the H.225 dissector in Wireshark 2.x before 2.0.6 calls snprintf with one of its input buffers as the output buffer, which allows remote attackers to cause a denial of service (copy overlap and application crash) via a crafted packet.
CVSS v3.0 score: 5.9
GHSA-vwcw-wgmf-vx7r 
Buffer overflow in pop3svr.exe for DMS POP3 1.5.3.27 and earlier allows remote attackers to cause a denial of service (service crash) via a long (1) username or (2) password.
GHSA-94fj-vh2p-xmpm 
CVE was unused by HPE.
CVE-2022-27494 CROSS-SITE SCRIPTING CWE-79
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS v3.1 score: 8.2
GHSA-2g38-6996-78pm 
A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.
CVSS v3.0 score: 5.4