ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2023-1435: Ajax Search Lite Pro < 4.26.2 - Multiple Reflected Cross-Site Scripting
The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 6.1
CVE-2022-45912: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution.
CVSS v3.1: 7.2
CVE-2026-35408: Directus is Missing Cross-Origin Opener Policy
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.
CVSS v3.1: 8.7
GHSA-pfj9-3m3h-4w6g: PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
CVSS v3.0: 8.8
GHSA-8rm2-mc4g-pm72: A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC, aka 'Windows Task Scheduler Security Feature Bypass Vulnerability'.
CVSS v3.1: 7.5
CVE-2019-20379: ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-837r-f284-r2j7: Windows LDAP Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22012, CVE-2022-22013, CVE-2022-22014, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29131, CVE-2022-29137, CVE-2022-29139.
CVSS v3.1: 8.8
GHSA-p6xh-5j4q-m59x: In the Linux kernel, the following vulnerability has been resolved:wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exitAlways purge mcu skb queues in mt7915_mcu_exit routine even if
mt7915_firmware_state fails.
CVSS v3.1: 5.5
CVE-2019-17051: Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
RHSA-2021:3771: Red Hat Security Advisory: grafana security update
grafana: Snapshot authentication bypass
CVSS v3.1: 7.3
GHSA-9r44-5846-qwc7: A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of the contact forms for the webpages of the CMS after an authenticated admin visits a malicious third-party site.
GHSA-p9x3-w98f-7j3q: NocoDB Missing Ownership Validation in MCP Token Operations
SummaryThe MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.Details`McpTokenService.get()`, `regenerateToken()`, and `delete()` did not filter by `fk_user_id`. The analogous `ApiTokensService` correctly enforced ownership.ImpactLimited — requires Creator role and knowledge of target token ID. Primary risk is denial of service (invalidating tokens) and scoped token disclosure.CreditThis issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).
CVSS v4.0: 4.9
GHSA-wxc7-jc57-c2hc: The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
CVSS v3.1: 5.4
GHSA-63fq-95f6-4xfm: Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.
CVSS v3.1: 7.5
RHSA-2009:0421: Red Hat Security Advisory: ghostscript security update
ghostscript: DoS (crash) in CCITTFax decoding filter ghostscript: Buffer overflow in BaseFont writer module for pdfwrite device ghostscript: Missing boundary check in Ghostscript's jbig2dec library argyllcms: Incomplete fix for CVE-2009-0583
CVE-2012-0388: Memory leak in the H.323 inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed transit H.323 traffic, aka Bug ID CSCtq45553.
CVSS v2.0: 7.8
GHSA-9ppf-2r5r-2chh: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
CVSS v3.1: 6.5
CVE-2024-9405: An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the module, but not from recursive directories.
CVSS v3.1: 5.3
GHSA-j5xp-7m2f-49jv: Docling Core: Insufficient validation of image reference URIs
ImpactIn versions `>= 2.5.0, < 2.74.1`, `docling-core`  could allow local `file://` image references and accepted inline `data:` content without a decoded-size limit.In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads.PatchesPatched in `docling-core` `2.74.1`.
The fix blocks local file URIs by default and adds a size limit for decoded inline image data.Users should upgrade to:`docling-core` `>= 2.74.1`WorkaroundsIf upgrading is not immediately possible:reject `file:` and `data:` image references from untrusted inputallow only approved local or remote image sourcesapply input size and memory limits to processing workersReferencesFix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)
CVSS v3.1: 8.1
GHSA-rc7f-grwh-gqv6: Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.
CVSS v3.0: 5.5
CVE-2026-40849: Authenticated SQLi in user_alarmprofile view
An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
GHSA-4q3h-v92p-gchj: In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist, causing a denial of service.The remedy is: upgrade to the patched 1.9.10 version.A workaround is to restrict the maximum number of queries on incoming TCP connections to a safe value, like 50, via the setMaxTCPQueriesPerConnection setting.We would like to thank Renaud Allard for bringing this issue to our attention.
CVSS v3.1: 7.5
cisco-sa-fxos-buffer-cSdmfWUt: Cisco FXOS Software Buffer Overflow Vulnerability
A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition.

The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that, when it is processed, may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1: 6
GHSA-gr58-76rp-mmg4: wger vulnerable to brute force attempts
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
CVSS v3.1: 9.8
ICSA-20-189-02: Mitsubishi Electric GOT2000 Series
The vulnerability could allow a malicious attacker to crash the device, which could lead to remote code execution.CVE-2020-5595 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability could allow a malicious attacker to cause a denial-of-service of TCP connection.CVE-2020-5596 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The vulnerability could allow a malicious attacker to cause a denial-of-service condition and crash the device.CVE-2020-5597 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The vulnerability could allow a malicious attacker authentication to access sensitive resources, cause a denial-of-service condition, and crash the device.CVE-2020-5598 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability could allow an attacker to cause a denial-of-service condition.CVE-2020-5599 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). The vulnerability could allow an attacker to obtain sensitive information.CVE-2020-5600 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS v3.0: 5.3
GHSA-pr4f-4pcx-2r3h: Pimcore Cross-site Scripting (XSS)
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
CVSS v3.0: 6.7
CVE-2010-3169: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS v2.0: 9.3
CVE-2024-13252: TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.
CVSS v3.1: 5.4
CVE-2025-7835: iThoughts Advanced Code Editor <= 1.2.10 - Cross-Site Request Forgery to Settings Update
The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due to missing or incorrect nonce validation on the 'ithoughts_ace_update_options' AJAX action. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-ffqx-hmw2-p5jv: In the Linux kernel, the following vulnerability has been resolved:sysctl: Fix out of bounds access for empty sysctl registersWhen registering tables to the sysctl subsystem there is a check to see
if header is a permanently empty directory (used for mounts). This check
evaluates the first element of the ctl_table. This results in an out of
bounds evaluation when registering empty directories.The function register_sysctl_mount_point now passes a ctl_table of size
1 instead of size 0. It now relies solely on the type to identify
a permanently empty register.Make sure that the ctl_table has at least one element before testing for
permanent emptiness.
CVSS v3.1: 5.5
CVE-2019-16195: Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-wwrr-4jp4-58wg: CSRF vulnerability in Jenkins Mantis Plugin
A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.
CVSS v3.1: 4.3
GHSA-48r6-v3wx-gxm5: Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.
CVSS v3.0: 8.8
CVE-2009-3786: Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title.
CVSS v2.0: 4.3
GHSA-gp54-xcch-3m67: Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management System component of Oracle Hospitality Applications (subcomponent: Mobile Gangway and Mustering). The supported version that is affected is 7.3.874. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality Cruise Shipboard Property Management System accessible data as well as unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management System accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
CVSS v3.0: 8.2
GHSA-m3p7-jqjp-g7pp: Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.
GHSA-mp5g-mj9q-xwf4: Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
GHSA-v6rq-h4r4-8gmc: Windows Multipoint Management Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2020-6204: The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
CVSS v3.0: 4.3
GHSA-wc7f-vvj8-28m9: SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.
CVSS v4.0: 8.3
CVE-2025-54273: Substance3D - Viewer | Out-of-bounds Write (CWE-787)
Substance3D - Viewer versions 0.25.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-fwvf-42p7-96jh: Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username parameter.
CVSS v3.1: 9.8
GHSA-h5pc-f7x5-jjj2: LibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead function in hwpfilter/source/hwpfile.cxx.
CVSS v3.0: 9.8
CVE-2012-1900: Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a showcats action.
CVSS v2.0: 6.8
GHSA-jpf2-6cx5-3qxh: A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.
CVSS v3.0: 5.5
CVE-2023-27951: The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. An archive may be able to bypass Gatekeeper.
CVSS v3.1: 5.5
CVE-2026-0785: ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability
ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the API interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28294.
CVSS v3.0: 7.5
GHSA-cr3f-7r29-983w: A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown processing of the file /admin/edit-propertytype.php. The manipulation of the argument Property Type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-qwwr-fhfq-mfr4: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
CVSS v3.1: 4.6
CVE-2025-0052: FlashBlade DOS Vulnerability
Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.
CVSS v4.0: 8.3
GHSA-9pp9-78gm-f2c2: Microsoft Internet Explorer 6.0 SP2 allows remote attackers to spoof a legitimate URL in the status bar and conduct a phishing attack via a web page that contains a BASE element that points to the legitimate site, followed by an anchor (a) element with an empty "href" attribute, and a FORM whose action points to a malicious URL, and an INPUT submit element that is modified to look like a legitimate URL.
GHSA-mpgx-8ww8-7cf7: Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.
CVSS v3.0: 5.4
CVE-2024-32116: Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests.
CVSS v3.1: 4.8
GHSA-w7p2-f9vj-jjvv: A Remote Authentication bypass in Aruba ClearPass Policy Manager leads to complete cluster compromise. An authentication flaw in all versions of ClearPass could allow an attacker to compromise the entire cluster through a specially crafted API call. Network access to the administrative web interface is required to exploit this vulnerability. Resolution: Fixed in 6.7.6 and 6.6.10-hotfix.
CVSS v3.0: 7.2
CVE-2024-54130: Segmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)
The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BPv7 software version 4.1.3 when a bundle with a Destination Endpoint ID (EID) set to dtn:none is received. This causes the node to become unresponsive to incoming bundles, leading to a Denial of Service (DoS) condition. This vulnerability is fixed in 4.1.3s.
CVSS v4.0: 9.2
GHSA-4w5m-vg96-g85c: Cross-site scripting (CSS) vulnerability in Lotus Domino 5.0.6 allows remote attackers to execute script on other web clients via a URL that ends in Javascript, which generates an error message that does not quote the resulting script.
GHSA-h5qv-qjv4-pc5m: Unfurl's unbounded zlib decompression allows decompression bomb DoS
SummaryThe compressed data parser uses `zlib.decompress()` without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.Details`unfurl/parsers/parse_compressed.py` calls `zlib.decompress(decoded)` with no size limit.Inputs are accepted from URL components that match base64 patterns.Highly compressible payloads can expand orders of magnitude larger than their compressed size.PoCGenerate a payload with `security_poc/poc_decompression_bomb.py --generate-only`.The script creates a base64-encoded zlib payload embedded in a URL.Submitting the URL to `/json/visjs` can cause the server to allocate large amounts of memory.The script includes a `--test` mode but warns it can crash the service.PoC ScriptImpactA remote, unauthenticated attacker can cause high memory usage and potentially crash the service. The impact depends on deployment limits (process memory, URL length limits, and request size limits).
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2024-28941: Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2020-26912: Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS v3.1: 7.5
CVE-2020-25816: HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.
CVSS v3.1: 6.8
CVSS v2.0: 4.9