ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-h54m-c522-h6qr: AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
SummaryThe `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times.DetailsThe vulnerable code path in `plugin/YPTWallet/YPTWallet.php:450-517`:The `getWallet()` method (`YPTWallet.php:244`) calls `Wallet::getFromUser()` (`Wallet.php:69-84`) which executes a plain `SELECT * FROM wallet WHERE users_id = $users_id` with no `FOR UPDATE` clause. The `save()` method (`Wallet.php:105`) calls `ObjectYPT::save()` (`Object.php:293`) which executes a plain `UPDATE` — no transaction wrapping.**Race window**: Between the SELECT (step 1) and UPDATE (step 3), all concurrent requests see the same original balance. Each independently computes `original - amount`, passes the check, and writes back. The last writer wins for the sender (only one deduction effective), but the receiver gets credited once per request.**Why concurrent requests succeed**: PHP's file-based session locking serializes requests per session. However, an attacker can create multiple login sessions (different PHPSESSID cookies) for the same user account. Each session has its own lock and can execute concurrently. Each session needs its own captcha, but the captcha validation in `objects/captcha.php:58-73` compares `$_SESSION['palavra']` without unsetting it after validation, allowing unlimited reuse within each session.Entry point: `plugin/YPTWallet/view/transferFunds.json.php:39` calls `YPTWallet::transferBalance(User::getId(), $_POST['users_id'], $_POST['value'])` — requires only `User::isLogged()` and a valid captcha.PoCImpactAn authenticated attacker can exploit this race condition to:**Create wallet balance from nothing**: With a $10 balance and N concurrent requests, the recipient can receive up to $10×N while the sender only loses $10.**Bypass pay-per-view charges**: Inflate wallet balance, then purchase paid content without real payment.**Bypass subscription fees**: Use inflated balance to purchase subscriptions.**Financial integrity compromise**: The wallet ledger becomes inconsistent — total balances across all users no longer match total deposits.The attack requires solving one captcha per session (captchas are reusable within a session), creating multiple login sessions, and timing concurrent requests — achievable with basic scripting.Recommended FixReplace the read-check-write pattern with an atomic database operation using a transaction and row-level locking:Additionally, fix the captcha reuse issue in `objects/captcha.php:58-73` by unsetting `$_SESSION['palavra']` after successful validation:
CVSS v3.1: 5.3
GHSA-j8pq-pj9c-xf4c: Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow a remote attacker to cause a denial of service (DoS) condition, view sensitive data on an affected device, or redirect users to an attacker-controlled destination. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 8.1
GHSA-6cxh-hvrc-px7m: Stack-based buffer overflow in the supply_lm_input_write function in drivers/thermal/supply_lm_core.c in the MSM Thermal driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted application that sends a large amount of data through the debugfs interface.
CVSS v3.1: 7.8
CVE-2025-29385: In Tenda AC9 v1.0 V15.03.05.14_multi, the cloneType parameter of /goform/AdvSetMacMtuWan has a stack overflow vulnerability, which can lead to remote arbitrary code execution.
CVSS v3.1: 9.8
CVE-2017-2092: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
ICSMA-23-117-01: Illumina Universal Copy Service
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. CVE-2023-1968 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product. CVE-2023-1966 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.0: 7.4
GHSA-rjr7-x9gp-9rwg: An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.
CVSS v4.0: 8.6
CVSS v3.1: 8.8
CVE-2021-21835: An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when decoding the atom associated with the “csgp” FOURCC can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS v3.0: 8.8
GHSA-9hvg-qw5q-wqwp: Bagisto SSTI vulnerability in type parameter can lead to RCE
SummarySSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.DetailsGo to `http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}`ImpactCan lead to RCE, command injection.
CVSS v4.0: 7.3
GHSA-55xf-xf88-2fwh: Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
CVE-2025-53519: Advantech iView Cross-site Scripting
A vulnerability exists in Advantech iView versions prior to 5.7.05 build
 7057, which could allow a reflected cross-site scripting (XSS) attack. 
By manipulating specific parameters, an attacker could execute 
unauthorized scripts in the user's browser, potentially leading to 
information disclosure or other malicious activities.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
CVE-2018-6487: MFSBGN03799 rev.1 - Micro Focus UCMDB, Remote Disclosure of Information
Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11. This vulnerability could be remotely exploited to allow disclosure of information.
CVSS v3.0: 9.8
CVE-2023-40027: Conditionally missing authorization in @keystone-6/core
Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible (no session required) if a `session` strategy is not defined. This vulnerability does not affect developers using the `@keystone-6/auth` package, or any users that have written their own `ui.isAccessAllowed` (that is to say, `isAccessAllowed` is not `undefined`). This vulnerability does affect users who believed that their `session` strategy will, by default, enforce that `adminMeta` is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware. This vulnerability has been patched in `@keystone-6/core` version `5.5.1`. Users are advised to upgrade. Users unable to upgrade may opt to write their own `isAccessAllowed` functionality to work-around this vulnerability.
CVSS v3.1: 3.7
GHSA-xvp8-f489-jc35: The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
CVE-2020-13778: rConfig 3.9.4 and earlier allows authenticated code execution (of system commands) by sending a forged GET request to lib/ajaxHandlers/ajaxAddTemplate.php or lib/ajaxHandlers/ajaxEditTemplate.php.
CVSS v3.1: 8.8
CVSS v2.0: 9
GHSA-8xw5-q4cg-g2j3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS. This issue affects WP Social Widget: from n/a through 2.3.1.
CVSS v3.1: 6.5
GHSA-vhxw-xwj6-wx3f: Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
CVSS v3.1: 9.1
GHSA-fjhh-7wwg-jh75: admin.php in Coppermine Photo Gallery 1.4.10, and possibly earlier, allows remote authenticated users to include arbitrary local and possibly remote files via the (1) "Path to custom header include" and (2) "Path to custom footer include" form fields.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2021-32284: An issue was discovered in gravity through 0.8.1. A NULL pointer dereference exists in the function ircode_register_pop_context_protect() located in gravity_ircode.c. It allows an attacker to cause Denial of Service.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-c997-5hf8-5h33: Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that contains a memory address that causes the server to read arbitrary memory.
GHSA-c2mp-8936-8q32: Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.
CVE-2022-33149: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter.
CVSS v3.0: 8.3
CVE-2025-28198: A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.
CVSS v3.1: 5.9
PYSEC-2026-51: An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30.
`ASGIRequest` allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.
CVSS v3.1: 7.5
CVE-2019-13529: An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2023-41366: Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KERNEL 7.94, KERNEL64UC 7.22, KERNEL64UC 7.22EXT, KERNEL64UC 7.53, KERNEL64NUC 7.22, KERNEL64NUC 7.22EXT, allows an unauthenticated attacker to access the unintended data due to the lack of restrictions applied which may lead to low impact in confidentiality and no impact on the integrity and availability of the application.


CVSS v3.1: 5.3
CVE-2021-26688: An issue was discovered on LG Wing mobile devices with Android OS 10 software. The biometric sensor has weak security properties. The LG ID is LVE-SMP-200030 (February 2021).
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-pcg3-37vg-6x68: The transferFrom function of a smart contract implementation for Useless Ethereum Token (UET), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all victims' balances into their account) because certain computations involving _value are incorrect, as exploited in the wild starting in December 2017, aka the "transferFlaw" issue.
CVSS v3.0: 7.5
GHSA-mg2x-mggj-6955: Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.
CVSS v3.1: 6.5
CVE-2025-26594: X.org: xwayland: use-after-free of the root cursor
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
CVSS v3.1: 7.8
GHSA-p68x-rvf5-mfv6: Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files.
CVE-2019-20889: An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2006-2796: Cross-site scripting (XSS) vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message.
CVSS v2.0: 6.8
CVE-2017-18870: An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
CVSS v3.1: 4.3
CVSS v2.0: 3.5
PYSEC-2024-155: cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
CVSS v3.1: 7.5
CVE-2026-52692: WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.
CVSS v3.1: 7.5
CVE-2013-10074: Nagios XI < 2012R2.6 XSS via Tools Menu
Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS v4.0: 5.1
CVE-2023-32486: 

Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could potentially exploit this vulnerability, leading to escalation of privileges.


CVSS v3.1: 6.7
CVE-2015-8616: Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
CVSS v3.0: 8.6
CVSS v2.0: 7.5
GHSA-c2j2-v9h2-w84j: In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
CVE-2025-55476: FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This parameter is unsafely evaluated in a SQL ORDER BY clause without proper sanitization, allowing an attacker to inject arbitrary SQL subqueries.
CVSS v3.1: 6.5
CVE-2005-0997: Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlink function, (4) the orderby, min, or show parameters in the search function, or (5) the ratenum parameter in the MostPopular function.
CVSS v2.0: 7.5
RHSA-2012:1577: Red Hat Security Advisory: java-1.4.2-ibm-sap End of Support Notice
The java-1.4.2-ibm-sap packages shipped in the Red Hat Enterprise Linux 5
and 6 for SAP RHN repositories are no longer supported for SAP products. As
a result, these packages will no longer be updated and may contain security
flaws. Users are advised to migrate to the supported version of SAP
certified Java.
CVE-2020-15337: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests.
CVSS v3.1: 5.3
CVE-2025-14446: Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset
The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotify_cp_reset() function in all versions up to, and including, 1.1.37. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset plugin settings to their default values.
CVSS v3.1: 5.4
CVE-2001-0266: Vulnerability in Software Distributor SD-UX in HP-UX 11.0 and earlier allows local users to gain privileges.
CVSS v2.0: 7.2
CVE-2025-22237: CVE-2025-22237 salt advisory
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.
CVSS v3.1: 6.7
CVE-2005-3516: Cross-site scripting (XSS) vulnerability in recommend.php in Chipmunk Directory script allows remote attackers to inject arbitrary web script or HTML via the entryID parameter.
CVSS v2.0: 4.3
GHSA-rr22-7m4r-xf6r: A vulnerability has been found in Dahua products.  After
obtaining the administrator's username and password, the attacker can send a
carefully crafted data packet to the interface with vulnerabilities, causing
the device to crash.
CVSS v3.1: 4.9
GHSA-gx8j-3gxx-r6x6: A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow an unauthenticated adjacent attacker to obtain sensitive information about the device on which the Webex client is running. The vulnerability exists because sensitive information is included in the mDNS reply. An attacker could exploit this vulnerability by doing an mDNS query for a particular service against an affected device. A successful exploit could allow the attacker to gain access to sensitive information.
CVE-2015-2512: The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2507.
CVSS v2.0: 7.2
GHSA-f73v-rm28-j7c4: In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-198346478
CVSS v3.1: 5.5
GHSA-gx58-v339-c87j: Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS v3.1: 10
CVE-2025-4912: SourceCodester Student Result Management System Image File update_student.php path traversal
A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/core/update_student.php of the component Image File Handler. The manipulation of the argument old_photo leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 5.4
CVSS v3.0: 5.4
CVSS v2.0: 5.5
CVE-2008-3848: SQL injection vulnerability in single.php in Z-Breaknews 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS v2.0: 7.5
CVE-2020-19824: An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter.
CVSS v3.1: 7