Krm1/CVE-2025 huggingface dataset:
CVE-2025-0055 (CWE-497)
CVSS 3.1 score: 6.0 (MEDIUM)
SAP GUI for Windows stores user input on the client PC to improve usability. Under very specific circumstances an attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
CVE-2025-0056 (CWE-497)
CVSS 3.1 score: 6.0 (MEDIUM)
SAP GUI for Java saves user input on the client PC to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
CVE-2025-0057 (CWE-434)
CVSS 3.1 score: 4.8 (MEDIUM)
SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.
CVE-2025-0058 (CWE-639)
CVSS 3.1 score: 6.5 (MEDIUM)
In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the information unavailable.
CVE-2025-0059 (CWE-497)
CVSS 3.1 score: 6.0 (MEDIUM)
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local browser storage to improve usability. An attacker with administrative privileges or access to the victim�s user directory on the Operating System level would be able to read this data. Depending on the user input provided in transactions, the disclosed data could range from non-critical data to highly sensitive data, causing high impact on confidentiality of the application.
CVE-2025-0060 (CWE-94)
CVSS 3.1 score: 6.5 (MEDIUM)
SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.
CVE-2025-0061 (CWE-497)
CVSS 3.1 score: 8.7 (HIGH)
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
CVE-2025-0063 (CWE-89)
CVSS 3.1 score: 8.8 (HIGH)
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
CVE-2025-0066 (CWE-732)
CVSS 3.1 score: 9.9 (CRITICAL)
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application
CVE-2025-0067 (CWE-862)
CVSS 3.1 score: 6.3 (MEDIUM)
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
CVE-2025-0068 (CWE-862)
CVSS 3.1 score: 4.3 (MEDIUM)
An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
CVE-2025-0069 (CWE-427)
CVSS 3.1 score: 7.8 (HIGH)
Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a company. This leads to high impact on confidentiality, integrity and availability of the Windows server.
CVE-2025-0070 (CWE-287)
CVSS 3.1 score: 9.9 (CRITICAL)
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
CVE-2025-23030 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23031 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_alergia.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_alergia.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23032 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_escala.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `escala` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_escala.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23033 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_situacao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `situacao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_situacao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23034 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `tags.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23035 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_quadro_horario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_tipo_quadro_horario.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23036 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `pre_cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23037 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `control.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `control.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23038 (CWE-79)
CVSS 4.0 score: 6.4 (MEDIUM)
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `remuneracao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `remuneracao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-23082 (CWE-918)
CVSS 3.0 score: 7.2 (HIGH)
Veeam Backup for Microsoft Azure is vulnerable to Server-Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2024-13348 (N/A)
CVSS N/A score: N/A (N/A)
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-22506 Reason: This candidate is a reservation duplicate of CVE-2025-22506. Notes: All CVE users should reference CVE-2025-22506 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2025-0393 (CWE-352)
CVSS 3.1 score: 6.1 (MEDIUM)
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-0394 (CWE-434)
CVSS 3.1 score: 8.8 (HIGH)
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-20016 (CWE-78)
CVSS 3.1 score: 7.2 (HIGH)
OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.
CVE-2025-20055 (CWE-78)
CVSS 3.1 score: 9.8 (CRITICAL)
OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command.
CVE-2025-20620 (CWE-89)
CVSS 3.1 score: 7.5 (HIGH)
SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may obtain the administrative password of the web management page.
CVE-2025-0458 (CWE-79)
CVSS 4.0 score: 6.9 (MEDIUM)
A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Panel. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0459 (CWE-426)
CVSS 4.0 score: 4.8 (MEDIUM)
A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0460 (CWE-284)
CVSS 4.0 score: 6.9 (MEDIUM)
A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0461 (CWE-22)
CVSS 4.0 score: 5.3 (MEDIUM)
A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument pathfile leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-22983 (CWE-922)
CVSS 3.1 score: 7.5 (HIGH)
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
CVE-2025-22984 (CWE-922)
CVSS 3.1 score: 7.5 (HIGH)
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
CVE-2025-0462 (CWE-74)
CVSS 4.0 score: 5.3 (MEDIUM)
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0463 (CWE-284)
CVSS 4.0 score: 5.3 (MEDIUM)
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown function of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of the argument name leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0464 (CWE-79, CWE-79)
CVSS 4.0 score: 5.1 (MEDIUM)
A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Maintenance Section. The manipulation of the argument System Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-23080 (CWE-79)
CVSS 3.1 score: 5.3 (MEDIUM)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - OpenBadges Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVE-2025-23081 (CWE-79)
CVSS N/A score: N/A (N/A)
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
CVE-2025-0465 (CWE-20)
CVSS 4.0 score: 6.9 (MEDIUM)
A vulnerability was found in AquilaCMS 1.412.13. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/v2/categories. The manipulation of the argument PostBody.populate leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-21171 (CWE-122, NVD-CWE-noinfo)
CVSS 3.1 score: 7.5 (HIGH)
.NET Remote Code Execution Vulnerability
CVE-2025-21172 (CWE-122, NVD-CWE-noinfo)
CVSS 3.1 score: 7.5 (HIGH)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21173 (CWE-379, NVD-CWE-noinfo)
CVSS 3.1 score: 7.3 (HIGH)
.NET Elevation of Privilege Vulnerability
CVE-2025-21176 (CWE-126, NVD-CWE-noinfo)
CVSS 3.1 score: 8.8 (HIGH)
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21178 (CWE-122, NVD-CWE-noinfo)
CVSS 3.1 score: 8.8 (HIGH)
Visual Studio Remote Code Execution Vulnerability
CVE-2025-21186 (CWE-122, NVD-CWE-noinfo)
CVSS 3.1 score: 7.8 (HIGH)
Microsoft Access Remote Code Execution Vulnerability
CVE-2025-21187 (CWE-94, NVD-CWE-noinfo)
CVSS 3.1 score: 7.8 (HIGH)
Microsoft Power Automate Remote Code Execution Vulnerability
CVE-2025-21189 (CWE-41, NVD-CWE-noinfo)
CVSS 3.1 score: 4.3 (MEDIUM)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-21193 (CWE-352, NVD-CWE-noinfo)
CVSS 3.1 score: 6.5 (MEDIUM)
Active Directory Federation Server Spoofing Vulnerability
CVE-2025-21202 (CWE-284, NVD-CWE-noinfo)
CVSS 3.1 score: 6.1 (MEDIUM)
Windows Recovery Environment Agent Elevation of Privilege Vulnerability
CVE-2025-21207 (CWE-400, NVD-CWE-noinfo)
CVSS 3.1 score: 7.5 (HIGH)
Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability
CVE-2025-21210 (CWE-636, NVD-CWE-noinfo)
CVSS 3.1 score: 4.2 (MEDIUM)
Windows BitLocker Information Disclosure Vulnerability
CVE-2025-21211 (CWE-693, NVD-CWE-noinfo)
CVSS 3.1 score: 6.8 (MEDIUM)
Secure Boot Security Feature Bypass Vulnerability
CVE-2025-21213 (CWE-284, NVD-CWE-noinfo)
CVSS 3.1 score: 4.6 (MEDIUM)
Secure Boot Security Feature Bypass Vulnerability
CVE-2025-21214 (CWE-200, NVD-CWE-noinfo)
CVSS 3.1 score: 4.2 (MEDIUM)
Windows BitLocker Information Disclosure Vulnerability
CVE-2025-21215 (CWE-125, NVD-CWE-noinfo)
CVSS 3.1 score: 4.6 (MEDIUM)
Secure Boot Security Feature Bypass Vulnerability
CVE-2025-21217 (CWE-693, NVD-CWE-noinfo)
CVSS 3.1 score: 6.5 (MEDIUM)
Windows NTLM Spoofing Vulnerability
CVE-2025-21218 (CWE-400, NVD-CWE-noinfo)
CVSS 3.1 score: 7.5 (HIGH)
Windows Kerberos Denial of Service Vulnerability
CVE-2025-21219 (CWE-41, NVD-CWE-noinfo)
CVSS 3.1 score: 4.3 (MEDIUM)
MapUrlToZone Security Feature Bypass Vulnerability
CVE-2025-21220 (CWE-908, NVD-CWE-noinfo)
CVSS 3.1 score: 7.5 (HIGH)
Microsoft Message Queuing Information Disclosure Vulnerability