ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2020-19880: DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-wv25-j2pr-3hfg: A vulnerability classified as critical has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is the function findAllHosByCondition of the file HospitalServiceImpl.java. The manipulation of the argument hospitalName leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2018-19879: An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not protected from automated tools used to make login attempts to the application. An anonymous attacker has the ability to make unlimited login attempts with an automated tool. This ability could lead to cracking a targeted user's password.
CVSS v3.0: 7.1
GHSA-r2c9-mw6q-ccc6: Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "ASLR Bypass."
GHSA-3ghj-wv9w-7vp9: Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.
CVSS v3.1: 9.8
GHSA-pv7p-2x54-xvc3: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default blank password for the guest account.
CVE-2020-13323: A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be read via Todos
CVSS v3.1: 7.7
GHSA-vvxr-29hr-8c7g: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Cache streams targeting link when performing LT automation[WHY]
Last LT automation update can cause crash by referencing current_state and
calling into dc_update_planes_and_stream which may clobber current_state.[HOW]
Cache relevant stream pointers and iterate through them instead of relying
on the current_state.
CVE-2026-44618: Apache CXF: XXE vulnerability in WS-Transfer functionality
Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
CVSS v3.1: 5.3
ICSA-18-137-02: PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series
An attacker with permission to transfer configuration files to or from the switch or permission to upgrade firmware is able to execute arbitrary OS shell commands.CVE-2018-10730 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Web interface CGI applications may copy the contents of the running configuration file to a commonly accessed file. Manipulation of a web login request can expose the contents of this file through to the web browser. A successful web interface login attempt is not required to read the configuration file contents.CVE-2018-10729 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). An attacker may insert a carefully crafted cookie into a GET request to cause a buffer overflow that can initiate a denial of service attack and execute arbitrary code.CVE-2018-10728 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker may exploit a long cookie related vulnerability to cause a buffer overflow that allows unauthorized access to the switches operating system files and the insertion of executable code into the OS.CVE-2018-10731 has been assigned to this vulnerability. A CVSS v3 base score of 9.0 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 9
CVE-2004-1716: Cross-site scripting (XSS) vulnerability in PForum before 1.26 allows remote attackers to inject arbitrary web script or HTML via the (1) IRC Server or (2) AIM ID fields in the user profile.
CVSS v2.0: 6.8
CVE-2016-1303: The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
CVE-2022-4399: TicklishHoneyBee nodau db.c sql injection
A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c. The manipulation of the argument value/name leads to sql injection. The name of the patch is 7a7d737a3929f335b9717ddbd31db91151b69ad2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215252.
CVSS v3.1: 5.5
GHSA-x542-jg8f-r599: In the Linux kernel, the following vulnerability has been resolved:tpm: st33zp24: Fix missing cleanup on get_burstcount() errorget_burstcount() can return -EBUSY on timeout. When this happens,
st33zp24_send() returns directly without releasing the locality
acquired earlier.Use goto out_err to ensure proper cleanup when get_burstcount() fails.
CVSS v3.1: 5.5
GHSA-78pq-6rh5-p9vx: SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin_delete.php, which could let a remote malicious user execute arbitrary code.
GHSA-648c-cv8r-86r5: Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability.
CVSS v3.1: 7.5
CVE-2020-10002: A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, tvOS 14.2, iTunes 12.11 for Windows. A local user may be able to read arbitrary files.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
cisco-sa-20181003-pi-id: Cisco Prime Infrastructure Information Disclosure Vulnerability
A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information.

The vulnerability is due to the transmission of sensitive information as part of a GET request. An attacker could exploit this vulnerability by sending a GET request to a vulnerable device. A successful exploit could allow the attacker to view sensitive information.


There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-id ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-id"]
CVSS v3.0: 4.3
CVE-2024-10263: Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1: 7.3
GHSA-2fhq-mmhr-8hcv: A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub_401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
CVSS v4.0: 7.3
CVSS v3.1: 7.2
CVE-2013-7102: Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.
CVSS v2.0: 6.8
GHSA-5wvv-q5fv-2388: hyper-staticfile's location header incorporates user input, allowing open redirect
When `hyper-staticfile` performs a redirect for a directory request (e.g. a request for `/dir` that redirects to `/dir/`), the `Location` header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead.An attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.
CVE-2024-5658: CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use
The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.
CVSS v3.1: 4.8
GHSA-mqmw-59rf-wv9g: SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.547.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.
CVSS v3.1: 6.1
CVE-2024-7860: Simple Headline Rotator <= 1.0 - Stored XSS via CSRF
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CVSS v3.1: 6.1
GHSA-p93x-8676-4q6g: Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use non-standard but frequently supported Content-Transfer-Encoding values such as (1) uuencode, (2) mac-binhex40, and (3) yenc, which may be interpreted differently by mail clients.
CVE-2011-2368: The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict write operations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS v2.0: 10
GHSA-jrq5-hg6x-j6g3: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Summarygoshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as `?delete` and `?mkdir` because goshs relies on HTTP basic auth alone and performs no CSRF, `Origin`, or `Referer` validation for those routes. I reproduced this on `v2.0.0-beta.5`.DetailsThe vulnerable request handling is reachable through normal GET requests:`httpserver/handler.go:118-123` dispatches `?mkdir` directly to `handleMkdir()``httpserver/handler.go:180-186` dispatches `?delete` directly to `deleteFile()`Authentication is enforced only by HTTP basic auth:`httpserver/middleware.go:20-87` accepts any request that presents valid cached or replayed basic-auth credentialsThe resulting state changes hit filesystem mutation sinks:`httpserver/handler.go:683-718` calls `os.RemoveAll()` in `deleteFile()``httpserver/handler.go:961-1000` calls `os.MkdirAll()` in `handleMkdir()`Because browsers can replay HTTP basic-auth credentials on subresource requests, an attacker-controlled page can embed:`<img src="http://127.0.0.1:18095/victim.txt?delete">``<img src="http://127.0.0.1:18095/csrfmade?mkdir">`If the victim has already authenticated to goshs, those requests are treated as legitimate authenticated actions and the server mutates the filesystem.PoCManual verification commands used:`Terminal 1``Terminal 2`Victim actions:Open `http://127.0.0.1:18095/` in a browser and authenticate with `u:p`.Visit `http://127.0.0.1:18889/delete.html`.Visit `http://127.0.0.1:18889/mkdir.html`.Two terminal commands I ran during local validation:Expected result:the first check prints `DELETED`the second check prints `CREATED`PoC Video 1:https://github.com/user-attachments/assets/94b78934-0a70-479f-9b89-43a859939473Single-script verification:Observed script result:`Delete status: DELETED``mkdir status: CREATED``[RESULT] VULNERABLE: attacker-controlled pages triggered authenticated state changes via GET`PoC Video 2:https://github.com/user-attachments/assets/1143e039-81e4-4476-a1c3-f81ae46c9ede`gosh_poc3` script content:ImpactThis issue lets an external attacker abuse an authenticated victim's browser to perform filesystem mutations on the goshs server. In the demonstrated case, the attacker deletes an existing file and creates a new directory without the victim intentionally performing either action. Any deployment that relies on HTTP basic auth for web access is exposed to cross-site state changes when a user visits attacker-controlled content while authenticated.RemediationSuggested fixes:Move all state-changing functionality such as `delete` and `mkdir` off GET routes and require non-idempotent methods such as `POST` or `DELETE`.Add CSRF protections for authenticated browser actions, including per-request CSRF tokens plus strict `Origin` and `Referer` validation.Treat any rendered HTML content as untrusted and isolate it from issuing authenticated same-origin requests.
CVSS v4.0: 6.1
CVSS v3.1: 8.1
GHSA-v86x-5fm3-5p7j: Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
ImpactAn attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.PatchesUsers can upgrade to Alertmanager v0.2.51.WorkaroundsUsers can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.ReferencesN/A
CVSS v3.1: 5.4
CVE-2024-10925: Authorization Bypass Through User-Controlled Key in GitLab
A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML
CVSS v3.1: 5.3
CVE-2023-6959: Getwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_key_manage function in all versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete the 'Recaptcha Site Key' and 'Recaptcha Secret Key' settings.
CVSS v3.1: 4.3
CVE-2024-45738: Sensitive information disclosure in REST_Calls logging channel
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level.
CVSS v3.1: 4.9
GHSA-9mpw-pcw7-gq3g: Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.
CVE-2008-5435: Cross-site scripting (XSS) vulnerability in moderate.php in PunBB before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via a topic subject.
CVSS v2.0: 4.3
CVE-2024-1869: Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpose gateway (GGW) over port 9220.
CVSS v3.1: 7.5
GHSA-xf37-jxxr-pmvg: An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an iFrame field.
CVSS v3.1: 6.4
GHSA-2crq-pm63-66xm: Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
CVE-2025-2733: mannaandpoem OpenManus Prompt python_execute.py os command injection
A vulnerability classified as critical has been found in mannaandpoem OpenManus up to 2025.3.13. This affects an unknown part of the file app/tool/python_execute.py of the component Prompt Handler. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2024-29828: An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
CVSS v3.0: 8.4
CVE-2012-0761: The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766.
CVSS v2.0: 10
GHSA-898w-r5qq-x64c: FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request.
CVSS v3.1: 7.2
GHSA-3x7r-r5xh-2v32: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 on Mac OS X allow remote attackers to bypass the Same Origin Policy and create arbitrary socket connections via a crafted Java applet, related to the Java Embedding Plugin (JEP) and Java LiveConnect.
CVE-2023-46700: SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request, and obtain or alter information stored in the database.
CVSS v3.1: 9.8
CVE-2024-6722: Chatbot Support AI <= 1.0.2 - Admin+ Stored XSS
The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
ICSA-25-023-01: mySCADA myPRO Manager
mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system. mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
CVSS v3.1: 9.8
CVE-2025-50928: Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function.
CVSS v3.1: 4.8
GHSA-8jhf-8qjr-8c39: The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.
GHSA-45xx-m4rg-fw4x: The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have unspecified impact, via unspecified vectors.
CVSS v3.0: 7.3
CVE-2021-21029: Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
CVSS v3.1: 4.8
CVE-2023-1792: SourceCodester Simple Mobile Comparison Website GET Parameter manage_field.php sql injection
A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/fields/manage_field.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224744.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2026-27304: ColdFusion | Improper Input Validation (CWE-20)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
CVSS v3.1: 9.3
GHSA-rgx7-8wqv-m224: ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition).
CVE-2013-3910: Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2.0: 9.3
GHSA-94rc-xhf4-73hj: Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor. This issue affects RomethemeKit For Elementor: from n/a through 1.5.2.
CVSS v3.1: 4.3
GHSA-rqfr-jhc5-r4q9: Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.
CVSS v4.0: 4.8
CVE-2024-27290: Docassemble HTML and javascript injection
Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the master branch.
CVSS v3.1: 6.1
CVE-2008-1790: Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbitrary files via a crafted logo file in the "Manage Settings" functionality.  NOTE: remote exploitation is facilitated by a separate SQL injection vulnerability.
CVSS v2.0: 6.5
CVE-2024-42885: SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp page.
CVSS v3.1: 9.1
GHSA-cwvr-8j54-7jwh: A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device in a load-balanced configuration to perform a buffer overflow via a malicious crafted web request.
CVSS v3.1: 7.2