ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-14560: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious content into vulnerability code flow.
CVSS v3.1: 7.3
GHSA-4f6r-f3wr-x5fw: The Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the variable pricing option title in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 5.5
GHSA-qw95-rrxc-r294: Electric Vehicle (EV) commonly utilises the Combined Charging System (CCS) for DC rapid charging. To exchange important messages such as the State of Charge (SoC) with the Electric Vehicle Supply Equipment (EVSE) CCS uses a high-bandwidth IP link provided by the HomePlug Green PHY (HPGP) power-line communication (PLC) technology. The attack interrupts necessary control communication between the vehicle and charger, causing charging sessions to abort. The attack can be conducted wirelessly from a distance using electromagnetic interference, allowing individual vehicles or entire fleets to be disrupted simultaneously. In addition, the attack can be mounted with off-the-shelf radio hardware and minimal technical knowledge. With a power budget of 1 W, the attack is successful from around 47 m distance. The exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it. In addition to electric cars, Brokenwire affects electric ships, airplanes and heavy duty vehicles utilising these standards.
CVSS v3.1: 6.5
GHSA-53f2-8mjf-vj4j: In MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and potentially remote code execution via a long URI.
CVSS v3.1: 9.8
RHSA-2024:6268: Red Hat Security Advisory: kernel-rt security update
kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: gfs2: Fix potential glock use-after-free on unmount kernel: ionic: fix use after netif_napi_del() kernel: mm/huge_memory: don&#39;t unpoison huge_zero_folio kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list kernel: scsi: qedi: Fix crash while reading debugfs attribute kernel: tipc: force a dst refcount before doing decryption kernel: ppp: reject claimed-as-LCP but actually malformed packets kernel: Revert &#34;mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again&#34; kernel: mm: avoid overflows in dirty throttling logic
CVSS v3.1: 4.4
CVE-2018-11187: Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
CVSS v3.0: 8.8
CVSS v2.0: 6.5
CVE-2014-4846: Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.
CVSS v2.0: 4.3
GHSA-xgx2-332h-9x6q: SQL Injection in Yeswiki
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. The issue was fixed in Yeswiki version 4.1.0.
CVSS v3.1: 7.5
GHSA-5q7w-g3xf-4c68: The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information.
CVSS v3.1: 7.5
CVE-2025-40700: Reflected Cross-Site Scripting (XSS) in Governalia by IDI Eikon
Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victim's browser when a malicious URL with the 'q' parameter in '/search' is sent to them. This vulnerability can be exploited to steal sensitive information such as session cookies or to perform actions on behalf of the victim.
CVSS v4.0: 5.1
GHSA-q6hv-wcjr-wp8h: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace
ImpactBecause UPDATE validation is not being applied, it is possible for an actor with access to an instance of the [initializingworkspaces virtual workspace](https://docs.kcp.io/kcp/latest/concepts/workspaces/workspace-initialization/) to run arbitrary patches on the status field of `LogicalCluster` objects while the workspace is initializing.This allows to add or remove any initializers as well as changing the phase of a `LogicalCluster` (to "Ready" for example).As this effectively allows to skip certain initializers or the entire initialization phase, potential integrations with external systems such as billing or security could be affected. Their initializers could be skipped by a `WorkspaceType` that adds another initializer and grants permissions to the virtual workspace to a rogue or compromised entity._Who is impacted?_Impacts other owners of `WorkspaceTypes` with initializers that are inherited by other `WorkspaceTypes`.Impacts developers using the `virtual/framework` package to create their own virtualworkspaces if they are using UpdateFuncs in their custom storageWrappers.DetailsThe issue occurs because the [rest.ValidateObjectUpdateFunc](https://github.com/kcp-dev/kcp/blob/cli/v0.28.1/pkg/virtual/framework/forwardingregistry/store.go#L174) is not being called within the DefaultDynamicDelegatedStoreFuncs. As a result, the intended status overwrite protection from initializers never gets called, allowing arbitrary logicalcluster status patches.PatchesThe problem has been patched in #3599 and is available in kcp 0.28.3 and higher.WorkaroundsFurther limit access to the `initialize` verb on `WorkspaceType` objects (see [documentation](https://docs.kcp.io/kcp/v0.28/concepts/workspaces/workspace-initialization/#enforcing-permissions-for-initializers) for details).Only use trusted `WorkspaceType` objects.ReferencesSee the pull request (#3599).
CVSS v4.0: 2.3
CVE-2026-22516: WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wizor's wizors-investments allows PHP Local File Inclusion.This issue affects Wizor's: from n/a through <= 2.12.
CVSS v3.1: 8.1
GHSA-rq9r-r987-7r36: Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.
CVSS v3.1: 4.3
GHSA-4g6w-qxcf-cf8w: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Truong Thanh ATP Call Now allows Stored XSS. This issue affects ATP Call Now: from n/a through 1.0.3.
CVSS v3.1: 5.9
GHSA-8gp2-9vcg-vwj6: A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.
CVSS v3.1: 9.8
GHSA-crvv-j87g-j7hr: Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
GHSA-4v4f-2vvr-7hf5: The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to cause a denial of service, aka SQL injection. NOTE: this issue is potentially relevant to persons outside Yubico who operate a self-hosted OTP validation service; the issue does NOT affect YubiCloud.
CVE-2016-2390: The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
CVSS v3.0: 5.9
CVSS v2.0: 4.3
GHSA-wf3p-q3f6-j3g8: The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
CVSS v3.1: 5.4
CVE-2024-13351: Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
GHSA-g6m7-4q7h-7vrv: Multiple cross-site scripting (XSS) vulnerabilities in ClickGallery 5.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gallery_id parameter in gallery.asp and (2) parentcurrentpage parameter in view_gallery.asp.
CVE-2025-29816: Microsoft Word Security Feature Bypass Vulnerability
Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
CVSS v3.1: 7.5
RHSA-2018:1267: Red Hat Security Advisory: openvswitch security and bug fix update
dpdk: Information exposure in unchecked guest physical to host virtual address translations
CVSS v3.0: 6.1
ICSA-24-345-05: Horner Automation Cscape
The affected product contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code. The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading past the end of allocated data structures, resulting in execution of arbitrary code. 
CVSS v3.1: 7.5
GHSA-fwx5-5fqj-jv98: Cross-Site Scripting in morris.js
Affected versions of `morris.js` are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.RecommendationA patch for this vulnerability was created in 2014, but has still not been published to npm. In order to mitigate this issue effectively, install the library from github via:
CVE-2026-53520: Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.
CVSS v3.1: 6.5
RHSA-2009:0333: Red Hat Security Advisory: libpng security update
libpng unknown chunk handling flaw libpng arbitrary free() flaw
CVE-2012-1476: Unspecified vulnerability in the KKtalk (com.kkliaotian.android) application 4.0.0 and 4.1.5 for Android has unknown impact and attack vectors.
CVSS v2.0: 10
CVE-2024-10850: Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting
The Razorpay Payment Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
CVE-2018-17481: Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
GHSA-7rxq-q23f-jf3q: Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2022-43062: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appointment.
CVSS v3.1: 7.2
GHSA-f27x-prv4-7q7x: In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services.
CVSS v3.1: 7.5
CVE-2013-5995: data/class/helper/SC_Helper_Address.php in the front-features implementation in LOCKON EC-CUBE 2.12.3 through 2.13.0 allows remote authenticated users to obtain sensitive information via unspecified vectors related to addresses.
CVSS v2.0: 5.5
CVE-2023-7026: Lightxun IPTV Gateway web_upload_template.html unrestricted upload
A vulnerability was found in Lightxun IPTV Gateway up to 20231208. It has been rated as problematic. This issue affects some unknown processing of the file /ZHGXTV/index.php/admin/index/web_upload_template.html. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248579.
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2025-44135: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php. Manipulating the parameter username will cause SQL injection attacks.
CVSS v3.1: 6.5
GHSA-2v93-8mhc-6mf8: An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the DHCPv6 client component allows an unauthenticated remote attacker to cause an Out of Bounds Read, and possibly a Denial of Service via adjacent network access.
GHSA-jg8g-p89m-f6wh: Adobe Substance 3D Designer versions 13.0.0 (and earlier) and 13.1.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2022-42046: wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation
CVSS v3.1: 7.8
PYSEC-2020-266: Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
CVE-2023-40791: extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page.
CVSS v3.1: 6.3
CVE-2025-25928: A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.
CVSS v3.1: 8
GHSA-5v8v-gwmw-qw97: org.neo4j.procedure:apoc Path Traversal Vulnerability
ImpactA Path Traversal Vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database.
The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten.For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The procedure would need to have been allow listed in the neo4j configuration as well as having the apoc config `apoc.export.file.enabled` set to true.On a UNIX based system the following query allows arbitrary write access to the tmp folder:CALL apoc.export.csv.query('RETURN 1', 'file:///..//..//..//..//tmp/test.txt', {})PatchesThe users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12.WorkaroundsIf you cannot upgrade the library, you can control the [allowlist of the ](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist)procedures that can be used in your system, and/or turn off local file access by setting apoc.export.file.enabled=falseFor more informationIf you have any questions or comments about this advisory:Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)Email us at [security@neo4j.com](mailto:security@neo4j.com)CreditsWe want to publicly recognise the contribution Adam Reziouk - Airbus.
CVSS v3.1: 7.1
GHSA-8xwq-mq47-qvhw: A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13789).
GHSA-frw8-crh2-gr2h: Spotlight in Apple Mac OS X 10.5.8 does not properly handle temporary files, which allows local users to overwrite arbitrary files in the context of a different user's privileges via unspecified vectors.
CVE-2017-1600: IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132613.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
GHSA-2792-x8v5-77wp: Integer overflow vulnerability in tool_operate.c in curl 7.65.2 via crafted value as the retry delay.
CVSS v3.1: 9.8
CVE-2023-53284: drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()
In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init()

Because of the possilble failure of devm_kzalloc(), dpu_wb_conn might
be NULL and will cause null pointer dereference later.

Therefore, it might be better to check it and directly return -ENOMEM.

Patchwork: https://patchwork.freedesktop.org/patch/512277/
[DB: fixed typo in commit message]
CVSS v3.1: 5.5
GHSA-wjjh-xg7v-8wf9: win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
CVSS v3.1: 7.8
CVE-2024-33050: Buffer Over-read in WLAN Host Communication
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
CVSS v3.1: 7.5
CVE-2024-53204: phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe
In the Linux kernel, the following vulnerability has been resolved:

phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe

In rtk_usb3phy_probe() devm_kzalloc() may return NULL
but this returned value is not checked.
CVSS v3.1: 5.5
CVE-2007-4990: The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
CVSS v2.0: 7.5
GHSA-fjh3-g8gq-9q92: Cross-Site Scripting in Content Preview
ProblemIt has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability.SolutionUpdate to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described.CreditsThanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.References[TYPO3-CORE-SA-2021-007](https://typo3.org/security/advisory/typo3-core-sa-2021-007)
CVSS v3.1: 5.4
GHSA-46m2-r42j-gr4p: Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.
CVSS v3.1: 6.5
CVE-2011-1839: IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
CVSS v2.0: 5
GHSA-445g-h2v6-5fxw: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AppStudioUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13894.
GHSA-rv94-c9xq-5m2q: The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Accounting Manager access (erp_ac_view_sales_summary capability) and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 8.8