ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-hfmv-hhh3-43f2: Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
ImpactA stored **Cross-Site Scripting (XSS)** vulnerability was identified in [n8n](https://github.com/n8n-io/n8n), specifically in the **Form Trigger** node's **HTML form element**. An authenticated attacker can inject malicious HTML via an `<iframe>` with a `srcdoc` payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using `<video>` coupled `<source>` using an `onerror` event.While using `iframe` or a combination of `video` and `source` tag, this vulnerability allows for Account Takeover (ATO) by exfiltrating `n8n-browserId` and session cookies from authenticated users who visit a maliciously crafted form. Using these tokens and cookies, an attacker can impersonate the victim and change account details such as email addresses, enabling full control over the account—especially if 2FA is not enabled.PatchesThe issue was addressed in [PR #16329](https://github.com/n8n-io/n8n/pull/16329). Users should upgrade to version >=1.98.2.WorkaroundsApart from updating to the fixed version, n8n instance administrators can:Configure a reverse proxy to **serve webhook requests from a different domain** [[docs](https://docs.n8n.io/hosting/configuration/configuration-examples/webhook-url/)].Disable or restrict use of the **Form Trigger node**, particularly the **HTML** element type.Use a Content Security Policy (CSP) to block execution of inline scripts and disallow use of `srcdoc`.References[OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Prevention_Cheat_Sheet.html)[MDN: iframe `srcdoc` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-srcdoc)[HTML: `onerror` attribute](https://html.spec.whatwg.org/multipage/webappapis.html#handler-onerror)
CVSS v3.1: 8.7
CVE-2024-11235: Reference counting in php_request_shutdown causes Use-After-Free
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
CVSS v4.0: 9.2
GHSA-3426-h5fc-ghj2: LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an attacker gaining code execution via webshell. This attack appear to be exploitable via an authenticated user uploading a zip archive which can contains malicious php files that can be called under certain circumstances. This vulnerability appears to have been fixed in after commit 91d143230eb357260a19c8424b3005deb49a47f7 / version 3.14.4.
CVSS v3.0: 8.8
GHSA-8gxj-672w-9852: SQL injection vulnerability in vuBB 0.2 allows remote attackers to execute arbitrary SQL commands via the pass parameter in a cookie.
GHSA-2rgj-5hr4-v9vp: Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Path Traversal. This issue affects 6Storage Rentals: from n/a through 2.19.4.
CVSS v3.1: 6.5
CVE-2011-4898: wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters.  NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
CVSS v2.0: 5
GHSA-7w4v-5mff-3878: F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, which makes it easier for remote attackers to have unspecified impact by guessing the value.
CVE-2022-29168: Cross Site Scripting in Wire Messages
Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist.
CVSS v3.1: 9.6
CVE-2014-9558: Multiple SQL injection vulnerabilities in SmartCMS v.2.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2017-13707: Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi program can be accessed through sudo, in order to navigate the filesystem and modify a critical file such as /etc/passwd.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2004-1907: The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of service (crash) by sending hex-encoded URLs containing "%13%12%13".
CVSS v2.0: 2.6
GHSA-xv2v-3fj4-g6xm: send_message.php in AeroMail before 1.45 allows remote attackers to read arbitrary files on the server, instead of just uploaded files, via an attachment that modifies the filename to be uploaded.
CVE-2024-45848: An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on the server. If a specially crafted ‘INSERT’ query containing Python code is run against a database created with the ChromaDB engine, the code will be passed to an eval function and executed on the server.
CVSS v3.1: 8.8
CVE-2026-32959: SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Information in the traffic may be retrieved via man-in-the-middle attack.
CVSS v4.0: 8.2
CVSS v3.1: 5.9
CVE-2020-10391: The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/add-article.php by adding a question mark (?) followed by the payload.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-fm4g-2r58-3xc3: Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control.
CVSS v3.1: 8.8
GHSA-hw3m-5vg5-q8xq: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2021-30618: Chromium: CVE-2021-30618 Inappropriate implementation in DevTools
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-5c64-xrqv-mv4g: Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
GHSA-x783-xp3g-mqhp: PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries
SummaryThe `table_prefix` configuration value is directly used to construct SQL table identifiers without validation.If an attacker controls this value, they can manipulate SQL query structure, leading to unauthorized data access (e.g., reading internal SQLite tables such as `sqlite_master`) and tampering with query results.DetailsThis allows attackers to inject arbitrary SQL fragments into table identifiers, effectively altering query execution.This occurs because `table_prefix` is passed from configuration (`from_yaml` / `from_dict`) into `SQLiteConversationStore` and directly concatenated into SQL queries via f-strings:This value is then used in queries such as:Since SQL identifiers cannot be safely parameterized and are not validated, attacker-controlled input can modify SQL query structure.The vulnerability originates from configuration input and propagates through the following flow:**Source:** [config.py](https://github.com/MervinPraison/PraisonAI/blob/fde17acdc89cafd97ff49e9ddc81777b4445850f/src/praisonai/praisonai/persistence/config.py)
(`from_yaml` / `from_dict`) accepts external configuration input**Propagation:** [factory.py](https://github.com/MervinPraison/PraisonAI/blob/fde17acdc89cafd97ff49e9ddc81777b4445850f/src/praisonai/praisonai/persistence/factory.py)
(`create_stores_from_config`) passes `conversation_options` without validation**Sink:** [sqlite.py](https://github.com/MervinPraison/PraisonAI/blob/5ed5f1a6a96c829527abed15ac6d6166aafc6abd/src/praisonai/praisonai/persistence/conversation/sqlite.py)
Constructs SQL queries using f-strings with identifiers derived from `table_prefix`As a result, attacker-controlled `table_prefix` is interpreted as part of the SQL query, enabling injection into table identifiers and altering query semantics.PoC1. Exploit CodeThe PoC demonstrates that attacker-controlled `table_prefix` is not treated as a simple prefix but as part of the SQL query, allowing full manipulation of query structure.2. Expected Output![PoC Result](https://github.com/user-attachments/assets/aa46226e-c3cb-4772-b411-bfd26d328386)
The output shows that legitimate data is no longer returned; instead, attacker-controlled results are injected, demonstrating that query semantics have been altered.3. ImpactSQL Identifier InjectionQuery result manipulationInternal schema disclosureExploitable when untrusted input can influence configuration.Referencehttps://github.com/advisories/GHSA-59g6-v3vg-f7wc
CVSS v4.0: 6.9
RHSA-2023:7773: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
Hub: insecure galaxy-importer tarfile extraction ansible: Template Injection
CVSS v3.1: 7.1
GHSA-mm7x-c8mh-mw5q: Cross-site scripting (XSS) vulnerability in the Proxim Wireless Tsunami MP.11 2411 with firmware 3.0.3 allows remote authenticated users to inject arbitrary web script or HTML via the system.sysName.0 SNMP OID.
CVE-2021-0169: Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 6.7
CVSS v2.0: 4.6
CVE-2021-45943: GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
CVSS v3.1: 5.5
CVSS v2.0: 4.3
GHSA-m6p7-53hf-54fr: A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/article/article-edit-run.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239876.
CVSS v3.0: 6.3
GHSA-xwjg-xh72-4r4p: A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2
CVSS v3.1: 3.5
GHSA-h8vf-7rh3-vq7r: WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
GHSA-3v98-74p6-c9g6: Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Performance Schema.
CVSS v3.0: 4.7
GHSA-3g26-4vjw-j4m6: Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVSS v3.1: 7.5
CVE-2019-5024: A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical information collection devices running versions 9.0.3 or lower. A specific series of keyboard inputs can escape the restricted environment, resulting in full administrator access to the underlying operating system. An attacker can connect to the device via USB port with a keyboard or other HID device to trigger this vulnerability.
CVSS v3.0: 7.6
CVE-2019-19824: On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2.
CVSS v3.1: 8.8
CVSS v2.0: 9
CVE-2018-18913: Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location within the system. The issue lies in the loading of the shcore.dll and dcomp.dll files: these files are being searched for by the program in the same system-wide directory where the HTML file is executed.
CVSS v3.1: 7.8
CVSS v2.0: 6.9
CVE-2015-1949: The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
CVSS v2.0: 10
GHSA-29rx-6chj-44xc: In the Linux kernel, the following vulnerability has been resolved:ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptionsWhile running the self-tests on a KASAN enabled kernel, I observed a
slab-out-of-bounds splat very similar to the one reported in
commit 821bbf79fe46 ("ipv6: Fix KASAN: slab-out-of-bounds Read in
 fib6_nh_flush_exceptions").We additionally need to take care of fib6_metrics initialization
failure when the caller provides an nh.The fix is similar, explicitly free the route instead of calling
fib6_info_release on a half-initialized object.
CVSS v3.1: 7.1
RHSA-2026:10111: Red Hat Security Advisory: python3.12 security update
python: Python: Command-line option injection in webbrowser.open() via crafted URLs
CVSS v3.1: 7.1
CVE-2018-10493: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the U3D Final Maximum Resolution attribute. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5426.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-fvfr-gwjc-3cpp: The WP Hardening â€“ Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
CVSS v3.1: 6.1
CVE-2013-4390: Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
CVSS v2.0: 5.8
CVE-2022-41224: Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
CVSS v3.1: 5.4
CVE-1999-1051: Default configuration in Matt Wright FormHandler.cgi script allows arbitrary directories to be used for attachments, and only restricts access to the /etc/ directory, which allows remote attackers to read arbitrary files via the reply_message_attach attachment parameter.
CVSS v2.0: 5
GHSA-9gp7-jvm2-r4mx: Apache Struts Improper Input Validation vulnerability
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
CVSS v3.0: 5.9
CVE-2023-5068: Delta Electronics DIAScreen Out-of-bounds Write
Delta Electronics DIAScreen may write past the end of an allocated 
buffer while parsing a specially crafted input file. This could allow an
 attacker to execute code in the context of the current process.


CVSS v3.1: 7.8
CVE-2021-45929: Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from CompileElseBlock and Compile_If).
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2026-9980: Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 5
CVE-2018-18348: Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
CVE-2013-7366: The SAP Software Deployment Manager (SDM), in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications.
CVSS v2.0: 5
CVE-2024-12400: Tourmaster < 5.3.5 - Reflected XSS
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
CVSS v3.1: 7.1
CVE-2004-1331: The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File Download - Security Warning" dialog and save arbitrary files with arbitrary extensions via the SaveAs command.
CVSS v2.0: 2.6
GHSA-338q-vjff-j9cr: An elevation of privilege vulnerability exists when the Windows Backup Engine improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Backup Engine Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1535, CVE-2020-1539, CVE-2020-1540, CVE-2020-1541, CVE-2020-1542, CVE-2020-1543, CVE-2020-1544, CVE-2020-1545, CVE-2020-1546, CVE-2020-1547, CVE-2020-1551.
CVSS v3.1: 7.8
GHSA-26qx-fmxx-pg6h: Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
CVSS v3.0: 6.1
CVE-2022-34204: A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
CVSS v3.1: 4.3
CVSS v2.0: 4
GHSA-rv69-975f-qp5x: Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.1: 7.8
GHSA-rvmj-prf9-4422: PHP remote file inclusion vulnerability in user_language.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the language_dir parameter.
GHSA-j8m4-q5fc-hgxx: Windows Port Class Library Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-gm9x-q798-hmr4: Command Injection in git-tags-remote
All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.The following proof-of-concept creates a file in `/tmp`:
CVSS v3.1: 7.2
GHSA-cx5q-6qmm-2chw: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound FLX Dashboard Groups allows Reflected XSS. This issue affects FLX Dashboard Groups: from n/a through 0.0.7.
CVSS v3.1: 7.1
CVE-2006-1733: Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."
CVSS v2.0: 6.8
GHSA-pxpx-vcwr-c656: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module.
CVSS v3.1: 9.8
GHSA-c4r7-vqgv-hxrw: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS v3.1: 8.8
GHSA-cv3x-4274-fr24: ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specially crafted parameter. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.
CVE-2020-1712: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
CVSS v3.1: 7.8
CVE-2024-43126: WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce allows Reflected XSS.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.14.
CVSS v3.1: 7.1
CVE-2022-1256: Improper Privilege Management in McAfee Agent for Windows
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation of symbolic links.
CVSS v3.1: 7.8
GHSA-2p25-wrwc-3qp8: An elevation of privilege vulnerability in the Broadcom bcmdhd driver. Product: Android. Versions: Android kernel. Android ID: A-63374465. References: B-V2017081501.
CVSS v3.0: 7.8
CVE-2005-3834: Cross-site scripting (XSS) vulnerability in search.php in Tunez 1.21 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchFor parameter.
CVSS v2.0: 4.3
CVE-2017-5552: Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS v3.1: 6.5
CVSS v2.0: 4.9