ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-38266: An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.
CVSS v3.1: 6.5
GHSA-j947-jfqc-5v3q: In tmu_get_tr_thresholds, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 6.7
GHSA-q9wr-9rpv-8m6q: A vulnerability has been identified in SiNVR 3 Central Control Server (CCS) (all versions), SiNVR 3 Video Server (all versions). The SiNVR 3 Central Control Server (CCS) contains a directory traversal vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote attacker with network access to the CCS server could exploit this vulnerability to list arbitrary directories or read files outside of the CCS application context.
CVSS v3.1: 7.7
GHSA-48m9-cmgj-94xc: , aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.
CVSS v3.1: 6.5
GHSA-3h28-663g-h6cx: A vulnerability classified as critical was found in code-projects Blood Bank Management System 1.0. This vulnerability affects unknown code of the file /admin/admin_login.php of the component Admin Login Page. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-p7w2-mc6m-mfx2: Malicious Package in scroool
Version 0.1.7 of `scroool` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`RecommendationRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.Users may consider downgrading to version 0.1.6
CVE-2025-3209: code-projects Patient Record Management System add_patient.php sql injection
A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /add_patient.php. The manipulation of the argument itr_no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-h3vg-292w-9x2c: Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule.
CVSS v3.1: 5.3
CVE-2002-1260: The Java Database Connectivity (JDBC) APIs in Microsoft Virtual Machine (VM) 5.0.3805 and earlier allow remote attackers to bypass security checks and access database contents via an untrusted Java applet.
CVSS v2.0: 7.5
CVE-2024-0506: Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $instance[alt] parameter in the get_image_alt function in all versions up to, and including, 3.18.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.4
GHSA-jg4v-c64v-fqpx: The mintToken function of a smart contract implementation for RajTest, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVE-2023-30967: Gotham Orbital Simulator path traversal
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system. 
CVSS v3.1: 9.8
CVE-2014-5146: Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149.
CVSS v2.0: 4.7
CVE-2025-43020: Poly Clariti Manager - Multiple Security Vulnerabilities
A potential command
injection vulnerability has been identified in the Poly Clariti Manager for
versions prior to 10.12.2. The vulnerability could allow a privileged user
to submit arbitrary input. HP has addressed the issue in the latest software update.
CVSS v4.0: 5.7
GHSA-452v-w3gx-72wg: Zebra has rk Identity Point Panic in Transaction Verification
rk Identity Point Panic in Transaction VerificationSummaryOrchard transactions contain a `rk` field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the `orchard` crate which is used to verify Orchard proofs would panic when fed a `rk` with the identity value. Thus an attacker could send a crafted transaction that would make a Zebra node crash.Severity**Critical** - This is a Denial of Service Vulnerability that could allow an attacker to crash Zebra nodes.Affected VersionsAll Zebra versions prior to **version 4.3.1**.DescriptionThe vulnerability exists in the `circuits.rs` file of the `orchard` crate; it attempts to get the coordinates of the `rk` value and calls `unwrap()` on the results, which causes a panic if `rk` is the identity.Zebra parses `rk` as a byte vector; it creates an Orchard "bundle" using the `orchard` crate and then calls the same crate to verify it, triggering the panic.An attacker could exploit this by:Creating a transaction with a identity `rk`Submitting it to a Zebra node, making it crashImpact**Denial of Service****Attack Vector:** Network.**Effect:** Node crash.**Scope:** Any impacted Zebra node.Fixed VersionsThis issue is fixed in **Zebra 4.3.1**.The fix was agreed with `zcashd` developers (which has the same issue) to not allow the identity `rk` anymore and change the specification as such. Zebra now does this when parsing a transaction. This was deemed easier than fixing the issue in `orchard`, which would make the bug public before the nodes could be patched.MitigationUsers should upgrade to **Zebra 4.3.1** or later immediately.There are no known workarounds for this issue. Immediate upgrade is the only way to ensure the node remains not vulnerable to denial of service.CreditsThanks to Alex “Scalar” Sol for finding and reporting the issue.
CVSS v4.0: 9.2
CVSS v3.1: 7.5
CVE-2007-5250: The Windows dedicated server for the Unreal engine, as used by America's Army and America's Army Special Forces 2.8.2 and earlier, when Punkbuster (PB) is enabled, allows remote attackers to cause a denial of service (server hang) via packets containing 0x07 characters or other unspecified invalid characters.  NOTE: this issue may overlap CVE-2007-4443.  NOTE: this issue might be in Punkbuster itself, but there are insufficient details to be certain.
CVSS v2.0: 4.3
GHSA-4685-2x5r-65pj: Pebble service manager's file pull API allows access by any user
ImpactNote: "Pebble" here refers to [Canonical's service manager](https://github.com/canonical/pebble), not the [Let's Encrypt ACME test server](https://github.com/letsencrypt/pebble).The API behind `pebble pull`, used to read files from the workload container by Juju charms, allows access from any user, instead of just admin. In Juju Kubernetes sidecar charms, Pebble and the charm run as root, so they have full access. But if another restricted unix user gains local access to the container host, they could hit the Pebble `GET /v1/files?action=read` API and would be allowed to read any file in the workload container, for example an ssh key or database password or other sensitive information. If there are ssh keys they could then potentially ssh into the workload, or if something like a database password they could log into the database.Note that this requires local user access to the host machine. It seems unlikely that an attacker could gain this level of access in a Juju Kubernetes context, but if someone did and there's sensitive information in files accessible to Pebble, the consequences are bad.To reproduce the issue, go back to the Pebble version in Juju 2.9 (5842ea68c9c7), do `pebble run` as root in one terminal window, then in another terminal window, as a regular user, use the `pebble pull` CLI. You will be able to pull any file as a regular user.PatchesThe original patch is commit https://github.com/canonical/pebble/commit/cd326225b9b0be067da7d8858e2c912078cbbbd5. There's also https://github.com/canonical/pebble/pull/406, which fixes this issue in more recent Pebble versions (that PR also fixes a separate issue we introduced more recently, but hasn't been released in Juju yet).We released the fix in the following Pebble versions:https://github.com/canonical/pebble/releases/tag/v1.1.1https://github.com/canonical/pebble/releases/tag/v1.4.2https://github.com/canonical/pebble/releases/tag/v1.7.4https://github.com/canonical/pebble/releases/tag/v1.10.2Juju will be releasing patch versions with this fix shortly:Juju 2.9.49 (Pebble v1.1.1)Juju 3.1.8 (Pebble v1.4.2)Juju 3.3.4 (Pebble v1.4.2)Juju 3.4.2 (Pebble v1.7.4)Juju 3.5.0 (Pebble v1.10.2)Referenceshttps://www.cve.org/CVERecord?id=CVE-2024-3250
CVSS v3.1: 6.5
GHSA-4v6x-wq6p-585m: In the Linux kernel, the following vulnerability has been resolved:clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probeUse devm_of_iomap() instead of of_iomap() to automatically handle
the unused ioremap region.If any error occurs, regions allocated by kzalloc() will leak,
but using devm_kzalloc() instead will automatically free the memory
using devm_kfree().
CVSS v3.1: 5.5
CVE-2025-14958: floooh sokol sokol_gfx.h _sg_pipeline_common_init heap-based overflow
A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function _sg_pipeline_common_init in the library sokol_gfx.h. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 33e2271c431bf21de001e972f72da17a984da932. It is suggested to install a patch to address this issue.
CVSS v4.0: 4.8
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 4.3
CVE-2024-0551: Download and export of file via default user role
Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack.

It is worth noting that the deterministic nature of the export name is lower risk as the UI for exporting would start the download at the same time, which once downloaded - deletes the export from the system.

The endpoint for exporting should simply be patched to a higher privilege level.
CVSS v3.0: 7.1
CVE-2020-0431: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459
CVSS v3.1: 6.7
CVSS v2.0: 4.6
GHSA-62gp-x3rq-2r53: The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273.
GHSA-jpqv-87jq-w89v: A vulnerability, which was classified as problematic, has been found in School Club Application System 1.0. This issue affects access to /scas/admin/. The manipulation of the parameter page with the input %22%3E%3Cimg%20src=x%20onerror=alert(1)%3E leads to a reflected cross site scripting. The attack may be initiated remotely and does not require any form of authentication. The exploit has been disclosed to the public and may be used.
CVSS v3.1: 6.1
GHSA-j4cq-cj3p-h367: HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss) via a flood of vCards to UDP port 9204.
GHSA-rhgq-mf3j-hc7r: The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM) file.
CVE-2024-1759: WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-75vr-25cc-76p8: WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1.
GHSA-7cx8-j7qq-8w58: Directory traversal vulnerability in printd line printer daemon (lpd) in Solaris 7 through 10 allows remote attackers to delete arbitrary files via ".." sequences in an "Unlink data file" command.
CVE-2012-0548: Unspecified vulnerability in Oracle SPARC Enterprise M Series Servers XCP 1110 and earlier allows local users to affect confidentiality, related to XSCF Control Package (XCP).
CVSS v2.0: 2.1
ICSMA-18-156-01: Philips' IntelliVue Patient and Avalon Fetal Monitors
The vulnerability allows an unauthenticated attacker to access memory (write-what-where) from an attacker-chosen device address within the same subnet.CVE-2018-10597 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). The vulnerability allows an unauthenticated attacker to read memory from an attacker-chosen device address within the same subnet.CVE-2018-10599 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L). The vulnerability exposes an echo service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.CVE-2018-10601 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H).
CVSS v3.0: 8.2
RHSA-2012:0333: Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: perf: Fix software event overflow kernel: xfs: potential buffer overflow in xfs_readlink() kernel: oom_badness() integer overflow kernel: keys: NULL pointer deref in the user-defined key type kernel: possible privilege escalation via SG_IO ioctl kernel: nfs4_getfacl decoding kernel oops kernel: jbd/jbd2: invalid value of first log block leads to oops kernel: xfs heap overflow kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl() kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries kernel-rt: stack corruption when task gets scheduled out using the debug stack
CVE-2018-6203: In eScan Antivirus 14.0.1400.2029, the driver file (econceal.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300210C.
CVSS v3.0: 7.8
CVSS v2.0: 6.1
CVE-2018-14886: The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description.
CVSS v3.0: 4.9
CVSS v2.0: 4
GHSA-c84x-657q-q6vq: The Shield Security  WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS v3.1: 6.1
CVE-2025-28981: WordPress WP Mail Options plugin <= 0.2.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through <= 0.2.3.
CVSS v3.1: 7.1
GHSA-g559-66g4-jx42: There is a Improper Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to account authentication bypassed.
CVE-2015-0326: Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0328.
CVSS v2.0: 10
CVE-2024-11089: Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to logged-in users.
CVSS v3.1: 5.3
GHSA-xp63-j3jr-p74v: Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.
CVE-2016-7665: An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Graphics Driver" component, which allows remote attackers to cause a denial of service via a crafted video.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
ICSA-19-078-01: AVEVA InduSoft Web Studio and InTouch Edge HMI
The uncontrolled search path element vulnerability allows an attacker to load and execute a malicious file from the ux32w.dll in third-party component Sentinel UltraPro.CVE-2019-6534 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.0: 6.5
CVE-2026-32264: Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.5 and from version 5.0.0-RC1 to before version 5.9.11, there is a Behavior injection RCE vulnerability in ElementIndexesController and FieldsController. Craft control panel administrator permissions and allowAdminChanges must be enabled for this to work. This issue has been patched in versions 4.17.5 and 5.9.11.
CVSS v4.0: 8.6
CVE-2024-38232: Windows Networking Denial of Service Vulnerability
Windows Networking Denial of Service Vulnerability
CVSS v3.1: 7.5
GHSA-4f7j-5j3r-xxc5: Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.63, DM200 before 1.0.0.61, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN3000RPv2 before 1.0.0.68, and WNR2000v5 before 1.0.0.66.
CVE-2020-7819: nTracker USB Enterprise SQL-Injection vulnerability
A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information.
CVSS v3.1: 9.3
GHSA-h362-xvf2-9x75: pam_console PAM module in Linux systems allows a user to access the system console and reboot the system when a display manager such as gdm or kdm has XDMCP enabled.
GHSA-5pvv-9846-fqj9: SmarterTools SmarterMail before Build 7776 allows XSS.
CVE-2024-8754: External Control of Critical State Data in GitLab
An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.
CVSS v3.1: 6.4
GHSA-84ww-gp3p-3hmw: In msmtp 1.8.2 and mpop 1.4.3, when tls_trust_file has its default configuration, certificate-verification results are not properly checked.
CVSS v3.0: 5.3
PYSEC-2011-2: The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
CVE-2026-1375: Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
CVSS v3.1: 8.1
GHSA-h46g-35r6-chx9: Download of Code Without Integrity Check vulnerability in Centreon web allows Reflected XSS.
A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.
This issue affects web: from 24.10.0 before 24.10.5, from 24.04.0 before 24.04.11, from 23.10.0 before 23.10.22, from 23.04.0 before 23.04.27, from 22.10.0 before 22.10.29.
CVSS v3.1: 8.4
CVE-2018-10994: js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-1999-0904: Buffer overflow in BFTelnet allows remote attackers to cause a denial of service via a long username.
CVSS v2.0: 5
CVE-2024-42022: An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
CVSS v3.0: 7.5
GHSA-whm2-f248-cc6r: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPZest Disable Comments | WPZest.This issue affects Disable Comments | WPZest: from n/a through 1.51.
CVSS v3.1: 7.6
CVE-2021-0316: In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11, Android-8.0, Android-8.1, Android-9, Android-10; Android ID: A-168802990.
CVSS v3.1: 9.8
CVSS v2.0: 10