CIRCL/vulnerability-scores huggingface dataset:
GHSA-jvgc-m9mp-hwqr 
Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.
CVSS v4.0 score: 4.6
CVSS v3.1 score: 5.5
cisco-sa-20191106-idn-xss Cisco Industrial Network Director Reflected Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected application.

The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected application. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-idn-xss ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-idn-xss"]
CVSS v3.0 score: 6.1
GHSA-7547-5vg4-cmwj 
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS v3.1 score: 5.4
CVE-2025-14584 itsourcecode COVID Tracking System Admin Login login.php sql injection
A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
GHSA-w265-826q-pq4h 
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVSS v3.1 score: 7.5
RHSA-2009:1148 Red Hat Security Advisory: httpd security update
httpd: mod_proxy reverse proxy DoS (infinite loop) httpd: possible temporary DoS (CPU consumption) in mod_deflate
GHSA-5rw2-5rm8-2p2v 
Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVSS v3.1 score: 6.5
GHSA-q7pp-wcgr-pffx Crash when processing crafted TIFF files
Disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence
GHSA-95p2-c4r2-2mqg 
Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0).
CVE-2020-36865 Nagios XI < 5.7.2 XSS via BPI Config Management
Nagios XI versions prior to 5.7.2 are vulnerable to cross-site scripting (XSS) via the BPI (Business Process Intelligence) component’s Config Management and Edit Config page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0 score: 5.1
GHSA-gmr9-4rwq-564r 
The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.
GHSA-mvpx-5vgf-mj2q 
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVSS v3.1 score: 5.3
GHSA-pv9w-276j-8fgj 
Unspecified vulnerability in Oracle Database Server 9.2.0.6 has unknown impact and attack vectors in the Advanced Replication component, aka Vuln# DB02.
CVE-2026-33994 Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker can pollute `Object.prototype` by overriding `RegExp.prototype.test` and then passing a crafted query string to `parse_str`, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the `String.prototype.includes()`-based guard with a `RegExp.prototype.test()`-based guard. However, `RegExp.prototype.test` is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.
CVSS v4.0 score: 6.3
CVE-2011-2263 
Unspecified vulnerability in Sun Integrated Lights Out Manager in Oracle SysFW 8.0.3.b or earlier for various Oracle SPARC T3, SPARC Netra T3, Sun Blade, and Sun Fire servers allows local users to affect confidentiality via unknown vectors.
CVSS v2.0 score: 2.1
CVE-2010-1315 
Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1.x before 1.06.02 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 5
GHSA-p36v-jrhm-cwg2 
Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Customize Login Page: from n/a through 1.6.5.
CVSS v3.1 score: 5.3
CVE-2020-11694 
In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.
CVSS v3.1 score: 7.5
CVSS v2.0 score: 5
CVE-2005-3322 
Unspecified vulnerability in Squid on SUSE Linux 9.0 allows remote attackers to cause a denial of service (crash) via HTTPs (SSL).
CVSS v2.0 score: 5
GHSA-mwxf-44gv-v67p 
Missing Authorization vulnerability in Stylemix MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.5.23.
CVSS v3.1 score: 4.3
GHSA-4hhm-hpr8-q62r 
Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).
CVSS v3.1 score: 5.4
CVE-2009-1432 
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and the Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) before 11.0 MR2, allows remote attackers to inject arbitrary text into the login screen, and possibly conduct phishing attacks, via vectors involving a URL that is not properly handled.
CVSS v2.0 score: 5
GHSA-mc7c-82xm-pvm6 
Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartFix: from n/a through < 1.2.4.
CVSS v3.1 score: 5.4
CVE-2024-4894 ITPison OMICARD EDM - Server-Side Request Forgery
ITPison OMICARD EDM  fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information.
CVSS v3.1 score: 5.3
CVE-2019-19034 
Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 6.5
CVE-2022-3424 
A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS v3.1 score: 7.8
CVE-2026-27838 wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up to and including 2.4, ache keys are scoped only by `pk` — no user ID is included. When a victim has previously accessed their routine via the API, an attacker can retrieve the cached response for the same PK without any ownership check. Commit e964328784e2ee2830a1991d69fadbce86ac9fbf contains a patch for the issue.
CVSS v3.1 score: 3.1
CVE-2019-9791 
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
CVE-2024-32511 WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability
Improper Privilege Management vulnerability in Astoundify Simple Registration for WooCommerce allows Privilege Escalation.This issue affects Simple Registration for WooCommerce: from n/a through 1.5.6.
CVSS v3.1 score: 9.8
GHSA-6wh7-hrcm-fv9m 
The registry in Windows NT can be accessed remotely by users who are not administrators.
GHSA-543f-vhg4-r8rx 
Rejected reason: Not used
GHSA-xm92-6hxv-37gp 
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21930, CVE-2022-21931.
CVSS v3.1 score: 2.5
GHSA-jvfv-hrrc-6q72 Improper Restriction of XML External Entity Reference in Liquibase
The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.
CVSS v3.1 score: 9.8
GHSA-x436-8x9q-6f6r 
The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.
GHSA-c5vp-96m5-r7fj 
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
GHSA-jh4r-88h5-574v 
The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.
CVSS v3.1 score: 6.5
GHSA-258w-mj9h-7ph9 
Cross-site scripting (XSS) vulnerability in fom.cgi in Faq-O-Matic 2.711 allows remote attackers to inject arbitrary web script or HTML via the (1) _duration, (2) file, and (3) cmd parameters.
GHSA-78v6-g7vr-73hg 
SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.
CVSS v3.1 score: 4.3
CVE-2005-0521 
SendLink 1.5 stores sensitive information, possibly including passwords, in plaintext in the data.eat file, which allows local users to gain privileges.
CVSS v2.0 score: 2.1
GHSA-mrfr-p4j4-54cw 
A Remote Gain Privileged Access vulnerability in HPE Vertica Analytics Platform version v4.1 and later was found.
CVSS v3.0 score: 9.8
CVE-2021-46967 vhost-vdpa: fix vm_flags for virtqueue doorbell mapping
In the Linux kernel, the following vulnerability has been resolved:

vhost-vdpa: fix vm_flags for virtqueue doorbell mapping

The virtqueue doorbell is usually implemented via registeres but we
don't provide the necessary vma->flags like VM_PFNMAP. This may cause
several issues e.g when userspace tries to map the doorbell via vhost
IOTLB, kernel may panic due to the page is not backed by page
structure. This patch fixes this by setting the necessary
vm_flags. With this patch, try to map doorbell via IOTLB will fail
with bad address.
CVSS v3.1 score: 7.8
GHSA-95g3-wxff-cpfp 
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.
CVSS v3.1 score: 7.5
CVE-2021-45558 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6.
CVSS v3.1 score: 8.4
CVE-2013-0202 
Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
CVE-2024-20789 ZDI-CAN-24030: Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability
Dimension versions 3.4.11 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
GHSA-f4f5-m8x5-6hhq 
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
CVSS v3.0 score: 9.8
GHSA-8824-wwwh-pg6h 
IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim's path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.
CVSS v3.0 score: 7.3
GHSA-hwv7-wjc3-wjwc 
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
CVE-2018-16491 
A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2025-8684 Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
CVE-2008-5803 
SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka username field).  NOTE: some of these details are obtained from third party information.
CVSS v2.0 score: 7.5
GHSA-7v4p-3v84-r8mc 
Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command.
CVE-2020-7036 XXE in Avaya Callback Assist Administration
An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7.
CVSS v3.1 score: 8.1
GHSA-6hw4-fq3j-72w9 
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
CVSS v4.0 score: 8.6
CVSS v3.1 score: 7.2
GHSA-r5rp-h6qf-2vgf 
In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 8.8
CVE-2021-45822 
A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the "n" (POST) parameter. Through this vulnerability, an attacker is capable to execute malicious JavaScript code.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-hx28-58mx-whmj 
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.
GHSA-wjww-59jc-83xc 
Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.
CVE-2018-14934 
The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and subsequently record audio from the device microphone.
CVSS v3.0 score: 6.5
CVSS v2.0 score: 3.3
GHSA-87cr-9pc7-7jg5 
Exiv2 0.26 contains a heap buffer overflow in tiff parser
CVSS v3.0 score: 5.5
CVE-2012-5180 
The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.
CVSS v2.0 score: 4.3
GHSA-c38j-ccr2-v3jw 
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing a maliciously crafted AppleScript binary may result in unexpected termination or disclosure of process memory.
CVSS v3.1 score: 7.1
CVE-2025-67036 
An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The Log Info page allows users to see log files by specifying their names. Due to a missing sanitization in the file name parameter, an authenticated attacker can inject arbitrary OS commands that are executed with root privileges.
CVSS v3.1 score: 8.8
CVE-2019-10776 
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
CVSS v3.1 score: 9.8
CVSS v2.0 score: 7.5
GHSA-cxm5-3w8h-5vwh 
In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05844434; Issue ID: ALPS05844434.
CVE-2018-3012 
Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Trade Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Trade Management accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.0 score: 8.2
CVSS v2.0 score: 5.8
CVE-2024-21089 
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.1 score: 6.5
GHSA-vhq7-m758-h4xj 
QNAP VioCard 300 has hardcoded RSA private keys.
GHSA-m55f-jfq4-f6r4 
An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory, aka 'Windows Code Integrity Module Information Disclosure Vulnerability'.
CVSS v3.1 score: 5.5
GHSA-prg7-cj54-c2q4 
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 8.8
CVE-2017-16672 
An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.
CVSS v3.0 score: 5.9
CVSS v2.0 score: 4.3
CVE-2024-22083 
An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further access to the device, including reconfiguration tasks.
CVSS v3.1 score: 6.5
CVE-2023-27450 WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.
CVSS v3.1 score: 7.1
CVE-2023-52838 fbdev: imsttfb: fix a resource leak in probe
In the Linux kernel, the following vulnerability has been resolved:

fbdev: imsttfb: fix a resource leak in probe

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).
CVSS v3.1 score: 6.2
CVE-2006-6220 
Multiple SQL injection vulnerabilities in Recipes Website (Recipes Complete Website) 1.1.14 allow remote attackers to execute arbitrary SQL commands via the (1) recipeid parameter to recipe.php or the (2) categoryid parameter to list.php.
CVSS v2.0 score: 6.8
GHSA-jwmm-45mc-783p 
The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
GHSA-g5vr-rgqm-vf78 Spring Framework Path Traversal vulnerability
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
CVSS v3.1 score: 7.5
CVE-2022-45088 Local File Inclusion in Smartpower Web
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion.

This issue affects Smartpower Web: before 23.01.01.
CVSS v3.1 score: 9.8
CVE-2022-25013 
Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.
CVSS v3.1 score: 6.1
CVSS v2.0 score: 4.3
GHSA-wj6w-34v5-pr7h 
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26222.
CVSS v3.0 score: 7.8
CVE-2023-26386 ZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability
Adobe Substance 3D Stager version 2.0.1 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 5.5
GHSA-h46f-mmx9-64wg 
Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is a function to prevent unauthorized use of apps on smartphones, an attacker could directly change the lock password after a series of operations. Successful exploit could allow the attacker to use the application which is locked.
CVSS v3.0 score: 4.6
PYSEC-2026-2393 
The `postman_download` module uses the workspace `name` field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
CVSS v3.1 score: 6.5
CVE-2025-26563 WordPress Rocket Mobile Plugin  <= 0.4.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This issue affects Mobile: from n/a through <= 1.3.3.
CVSS v3.1 score: 7.1
GHSA-6v4q-wvc6-gxgx 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp allows Stored XSS. This issue affects WP-reCAPTCHA-bp: from n/a through 4.1.
CVSS v3.1 score: 5.9
GHSA-h7vr-cg25-jf8c StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
SummaryThe POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account. The handler verifies that the caller is an admin but does not enforce role hierarchy, nor does it validate that the target userId matches the caller's identity. Combined with the POST /studiocms_api/dashboard/reset-password endpoint, this allows a complete account takeover of the highest-privileged account in the system.DetailsVulnerable Code**File:** packages/studiocms/frontend/pages/studiocms_api/dashboard/create-reset-link.ts
**Version:** studiocms@0.3.0AnalysisUnlike the API token endpoints (which only require isEditor), this handler correctly gates access at the isAdmin level [1]. However, two critical authorization checks are still missing:**No caller identity validation [2][3]:** The userId from the JSON payload is never compared against the authenticated caller's session identity. An admin can specify any user's UUID, including the owner's.**No role hierarchy enforcement [4]:** The handler does not verify whether the target user has a higher privilege level than the caller. An admin can target the owner account, which is the only account that should be immune to administrative actions from lower-ranked admins.**Reset token returned in response [5]:** The generated reset token (a signed JWT) is returned directly in the HTTP response body. This token can then be used with the reset-password endpoint to set an arbitrary password for the target account, completing the account takeover chain.The core issue is that password reset generation is treated as a generic admin operation rather than a self-service operation with explicit scope restrictions.PoC**Environment**
*User ID | Role*
2450bf33-0135-4142-80be-9854f9a5e9f1 | owner
eacee42e-ae7e-4e9e-945b-68e26696ece4 | admin**Step 1 — Verify Attacker's Session (Admin)**
Confirm the attacker is authenticated as admin (user dummy03):Response:**Step 2 — Generate Password Reset Token for the Owner**
The admin sends a request to create a reset link targeting the owner's UUID:Response:The server generated a valid password reset JWT for the owner account and returned it to the admin caller.**Step 3 — Reset the Owner's Password**
Using all three values from the previous response (id, userId, token), the attacker sets a new password for the owner:Response:The owner's password has been changed. The admin can now log in as the owner with the new credentials, gaining full control of the StudioCMS instance.Impact**Owner Account Takeover:** Any admin can change the owner's password and assume full control of the StudioCMS instance, including all content, user management, and system configuration.
CVSS v3.1 score: 6.8
GHSA-5x55-xcjp-hqwx 
Adobe Premiere Rush versions 1.5.16 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-49128 Windows Remote Desktop Services Remote Code Execution Vulnerability
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS v3.1 score: 8.1
CVE-2020-9109 
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).
CVSS v3.1 score: 4.6
CVSS v2.0 score: 1.9
CVE-2015-1001 
Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request.
CVSS v2.0 score: 10
GHSA-6fq9-84g8-2vc6 
In the Linux kernel, the following vulnerability has been resolved:spi: fix resource leaks on device setup failureMake sure to call controller cleanup() if spi_setup() fails while
registering a device to avoid leaking any resources allocated by
setup().
CVSS v3.1 score: 5.5
CVE-2020-9617 
Adobe Premiere Rush versions 1.5.8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS v3.1 score: 5.5
CVSS v2.0 score: 4.3
GHSA-jwrv-4xvm-wq5g 
The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL.  In this way, an attacker could insert his own server for the client to send HTTP requests, provided he succeeds in exploiting it.
CVSS v4.0 score: 5.1
CVSS v3.1 score: 6.1
GHSA-hhcx-x49f-jr9v 
Insertion of Sensitive Information Into Sent Data vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Retrieve Embedded Sensitive Data.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.
CVSS v3.1 score: 5.8
CVE-2025-3352 PHPGurukul Old Age Home Management System edit-scdetails.php sql injection
A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-scdetails.php. The manipulation of the argument contnum leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0 score: 6.9
CVSS v3.1 score: 7.3
CVSS v3.0 score: 7.3
CVSS v2.0 score: 7.5
RHSA-2022:7826 Red Hat Security Advisory: dotnet7.0 security, bug fix, and enhancement update
dotnet: Nuget cache poisoning on Linux via world-writable cache directory
CVSS v3.1 score: 7.8
CVE-2026-10282 Bottelet DaybydayCRM DocumentsController.php view improper authorization
A security vulnerability has been detected in Bottelet DaybydayCRM up to 2.2.1. This impacts the function view of the file app/Http/Controllers/DocumentsController.php. Such manipulation leads to improper authorization. The attack may be launched remotely. It is best practice to apply a patch to resolve this issue.
CVSS v4.0 score: 5.3
CVSS v3.1 score: 4.3
CVSS v3.0 score: 4.3
CVSS v2.0 score: 4
GHSA-6c8m-46xr-g4qv 
Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.
CVE-2023-54187 f2fs: fix potential corruption when moving a directory
In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix potential corruption when moving a directory

F2FS has the same issue in ext4_rename causing crash revealed by
xfstests/generic/707.

See also commit 0813299c586b ("ext4: Fix possible corruption when moving a directory")
CVSS v3.1 score: 7.8
CVE-2008-3440 
Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS v2.0 score: 7.5
GHSA-88gp-9664-52xh 
The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is only exploitable by unauthenticated attackers in default configurations where the the default password is left as 1:1, or where the attacker gains access to the credentials.
CVSS v3.1 score: 9.1
CVE-2026-12020 
Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1 score: 8.8
CVE-2023-38231 ZDI-CAN-21334: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1 score: 7.8
CVE-2024-32993 
Out-of-bounds access vulnerability in the memory module
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS v3.1 score: 5.6
GHSA-vwxm-8m4v-97wg 
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
CVE-2010-0686 
WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability."
CVSS v2.0 score: 7.5
CVE-1999-0590 
A system does not present an appropriate legal message or warning to a user who is accessing it.
CVSS v2.0 score: 10
CVE-2019-15106 
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is admin@opm.
CVSS v3.0 score: 9.8
CVSS v2.0 score: 7.5
CVE-2010-3394 
The (1) texmacs and (2) tm_mupad_help scripts in TeXmacs 1.0.7.4 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS v2.0 score: 6.9
CVE-2017-18193 
fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application with multiple threads.
CVSS v3.0 score: 5.5
CVSS v2.0 score: 4.9
GHSA-9hg3-m3p7-mjm6 
A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_ops.go of the component File Tools. Performing a manipulation results in link following. The attack needs to be approached locally. The reported GitHub issue was closed with the label "not planned".
CVSS v4.0 score: 4.8
CVSS v3.1 score: 5.3
GHSA-8rmh-55h4-93h5 DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import
ImpactItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server.  However, this path traversal vulnerability is only possible by a user with special privileges (either Administrators or someone with command-line access to the server).  This vulnerability impacts the XMLUI, JSPUI and command-line._This vulnerability does NOT impact 7.x._Patches_DSpace 6.x:_Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/7af52a0883a9dbc475cf3001f04ed11b24c8a4c06.x patch file: https://github.com/DSpace/DSpace/commit/7af52a0883a9dbc475cf3001f04ed11b24c8a4c0.patch (may be applied manually if an immediate upgrade to 6.4 or 7.x is not possible)_DSpace 5.x:_Fixed in 5.11 via commit: https://github.com/DSpace/DSpace/commit/56e76049185bbd87c994128a9d77735ad7af01995.x patch file: https://github.com/DSpace/DSpace/commit/56e76049185bbd87c994128a9d77735ad7af0199.patch (may be applied manually if an immediate upgrade to 5.11 or 6.4 or 7.x is not possible)Apply the patch to your DSpaceIf at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:Download the appropriate patch file to the machine where DSpace is runningFrom the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.Restart TomcatWorkaroundsAs a basic workaround, you may block all access to the following URL paths:If you are using the XMLUI, block all access to `/admin/batchimport` path (this is the URL of the Admin Batch Import tool). Keep in mind, if your site uses the path "/xmlui", then you'd need to block access to `/xmlui/admin/batchimport`.If you are using the JSPUI, block all access to `/dspace-admin/batchimport` path (this is the URL of the Admin Batch Import tool).  Keep in mind, if your site uses the path "/jspui", then you'd need to block access to `/jspui/dspace-admin/batchimport`.Keep in mind, only an Administrative user or a user with command-line access to the server is able to import/upload SAF packages. Therefore, assuming those users do not blindly upload untrusted SAF packages, then it is unlikely your site could be impacted by this vulnerability.For more informationIf you have any questions or comments about this advisory:Email us at security@dspace.org
CVSS v3.1 score: 7.2
GHSA-mr84-jvj9-87g5 
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH v2.0.0 to v2.4.2 allows attackers to escalate privileges and access sensitive information via manipulation of the Nginx configuration file.
CVSS v3.1 score: 6.5
CVE-2024-21828 
Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v3.1 score: 6.7
GHSA-v7j2-8w44-rqgj 
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
CVSS v3.1 score: 5.5
CVE-2025-2207 aitangbao springboot-manager dept cross site scripting
A vulnerability classified as problematic was found in aitangbao springboot-manager 3.0. This vulnerability affects unknown code of the file /sys/dept. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0 score: 4.8
CVSS v3.1 score: 2.4
CVSS v3.0 score: 2.4
CVSS v2.0 score: 3.3
GHSA-cc2p-6hmp-4729 
A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.
CVSS v3.1 score: 10
GHSA-fwgc-8fqm-g5r7 
The Rank Math SEO with AI Best SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textAlign’ parameter in versions up to, and including, 1.0.217 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1 score: 6.4
RHSA-2010:0475 Red Hat Security Advisory: sudo security update
sudo: insufficient environment sanitization issue
GHSA-9pjx-74fm-xgg8 
In libFDK, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112891546
CVE-2026-22995 ublk: fix use-after-free in ublk_partition_scan_work
In the Linux kernel, the following vulnerability has been resolved:

ublk: fix use-after-free in ublk_partition_scan_work

A race condition exists between the async partition scan work and device
teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
   - del_gendisk(ub->ub_disk)
   - ublk_detach_disk() sets ub->ub_disk = NULL
   - put_disk() which may free the disk
3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
   leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold
a reference to the disk during the partition scan. The spinlock in
ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker
either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the
partition scan work unnecessarily when the disk is already detached.
CVSS v3.1 score: 7.8
CVE-2009-3298 
Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors.
CVSS v2.0 score: 6.5
CVE-2018-12590 
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.
CVSS v3.1 score: 7.2
CVSS v2.0 score: 9
GHSA-r22m-pfh4-7q39 
Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.