ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2021-24614: Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
GHSA-x7x4-r59j-h6w9: A vulnerability has been identified in Nucleus NET (All versions), Nucleus RTOS (versions including affected DNS modules), Nucleus ReadyStart (All versions < V2013.08), Nucleus Source Code (versions including affected DNS modules), VSTAR (versions including affected DNS modules). The DNS client does not properly randomize UDP port numbers of DNS requests. That could allow an attacker to poison the DNS cache or spoof DNS resolving.
CVSS v3.1: 5.3
CVE-2020-4629: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
CVSS v3.0: 2.9
RHSA-2022:6833: Red Hat Security Advisory: expat security update
expat: a use-after-free in the doContent function in xmlparse.c
CVSS v3.1: 8.1
CVE-2026-41031: A Stored Cross-Site Scripting (XSS) vulnerability occurs in Vinna Process Monitor
A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.
CVSS v4.0: 9.3
CVSS v3.1: 8.7
GHSA-jgff-87j3-r73h: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pozzad Global Translator allows Stored XSS. This issue affects Global Translator: from n/a through 2.0.2.
CVSS v3.1: 5.9
CVE-2024-27806: This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
CVSS v3.1: 5.5
GHSA-qhgj-r7g7-whqw: Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.
CVSS v3.0: 5.9
CVE-2023-5300: TTSPlanning sql injection
A vulnerability classified as critical has been found in TTSPlanning up to 20230925. This affects an unknown part. The manipulation of the argument uid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240939.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2023-5074: Authentication Bypass in D-Link D-View 8
Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28
CVSS v3.1: 9.8
CVE-2017-18638: send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-f2fc-vc88-6w7q: @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
SummaryMultiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands.DetailsThe claudecodeui application provides Git integration through various API endpoints. These endpoints accept user-controlled parameters such as file paths, branch names, commit messages, and commit hashes, which are directly interpolated into shell command strings passed to execAsync().The application attempts to escape double quotes in some parameters, but this protection is trivially bypassable using other shell metacharacters such as:Command substitution: $(command) or \`command\`
Command chaining: ;, &&, ||
Newlines and other control charactersAffected Endpoints`GET /api/git/diff - file parameter`
`GET /api/git/status - file parameter`
`POST /api/git/commit - files array and message parameter`
`POST /api/git/checkout - branch parameter`
`POST /api/git/create-branch - branch parameter`
`GET /api/git/commits - commit hash parameter`
`GET /api/git/commit-diff - commit parameter`Vulnerable CodeFile: server/routes/git.jsImpactRemote Code Execution as the Node.js process userFull server compromiseData exfiltrationSupply chain attacks - modify committed code to inject malwareFix**Commit:** siteboon/claudecodeui@55567f4Root cause remediationAll vulnerable `execAsync()` calls have been replaced with the existing `spawnAsync()` helper (which uses `child_process.spawn` with `shell: false`). Arguments are passed as an array directly to the OS — shell metacharacters in user input are inert.**Endpoints patched in `server/routes/git.js`:**`GET /api/git/diff` — `file` (4 calls)`GET /api/git/file-with-diff` — `file` (3 calls)`POST /api/git/commit` — `files[]`, `message``POST /api/git/checkout` — `branch``POST /api/git/create-branch` — `branch``GET /api/git/commits` — `commit.hash``GET /api/git/commit-diff` — `commit``POST /api/git/generate-commit-message` — `file``POST /api/git/discard` — `file` (3 calls)`POST /api/git/delete-untracked` — `file``POST /api/git/publish` — `branch`A strict allowlist regex (`/^[0-9a-f]{4,64}$/i`) was also added to validate the `commit` parameter in `/api/git/commit-diff` before it reaches the git process.Before / After
CVSS v3.1: 9.1
CVE-2026-24664: Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability allows unauthenticated attackers to identify valid user accounts by analyzing differences in the login response behavior. This issue has been patched in version 4.2.
CVSS v3.1: 5.3
GHSA-6q99-cq2x-vcqr: zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files.
RHSA-2019:4023: Red Hat Security Advisory: samba security and bug fix update
samba: Combination of parameters and permissions can allow user to escape from the share path definition
CVSS v3.0: 6.5
GHSA-w5v4-r62p-wm2c: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Sports Rankings and Lists allows Absolute Path Traversal. This issue affects Sports Rankings and Lists: from n/a through 1.0.2.
CVSS v3.1: 7.5
CVE-2019-19530: In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CID-c52873e5a1ef.
CVSS v3.1: 4.6
CVSS v2.0: 4.9
GHSA-gp7j-cqhm-vf6q: There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a denial of service.
CVSS v3.0: 5.5
CVE-2000-0123: The shopping cart application provided with Filemaker allows remote users to modify sensitive purchase information via hidden form fields.
CVSS v2.0: 7.5
CVE-2021-44977: In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-vc46-cf2x-6638: The LetsRecover WordPress plugin through 1.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
CVSS v3.1: 7.2
GHSA-7mxg-8jv7-cj7v: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
RHSA-2025:7545: Red Hat Security Advisory: firefox security update
firefox: thunderbird: Privilege escalation in Firefox Updater firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames firefox: thunderbird: Unsafe attribute access during XPath parsing firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
CVSS v3.1: 8.8
GHSA-f7v2-34w5-rp4f: A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP POST Request Handler. The manipulation of the argument mit_ssid leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
GHSA-9xhm-rcrp-wq9j: A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer communications until the system is rebooted.
CVSS v3.1: 6.5
CVE-2025-32436: AutoGPT has a DoS vulnerability in AddAudioToVideoBlock
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `AddAudioToVideoBlock` will download and store the video and audio in a temporary directory without deleting before all noded are done. `StepThroughItemsBlock` can be used to iterate `MediaDurationBlock` multiple times. `StepThroughItemsBlock` does not limit the number of loops. In addition, `AddAudioToVideoBlock` does not limit the amount of disk space consumed in the current working directory and does not delete the video after outputing the result. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.
CVSS v4.0: 7.1
CVE-2023-4885: Multiple vulnerabilities in Open5GS
Man in the Middle vulnerability, which could allow an attacker to intercept VNF (Virtual Network Function) communications resulting in the exposure of sensitive information.
CVSS v3.1: 6.5
CVE-2025-40927: CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw
CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw
This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.

Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.



As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.

The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.

Impact

By injecting %0A (newline) into a query string parameter, an attacker can:

  *  Break the current HTTP header
  *  Inject a new header or entire body
  *  Deliver a script payload that is reflected in the server’s response
That can lead to the following attacks:

  *  reflected XSS
  *  open redirect
  *  cache poisoning
  *  header manipulation
CVSS v3.1: 7.3
GHSA-34q5-gx35-4r68: Multiple buffer overflows in FTP Print Server 2.4 and 2.4.5 in HP LaserJet 5000 Series printers with firmware R.25.15 or R.25.47, and HP LaserJet 5100 Series printers with firmware V.29.12, allow remote attackers to cause a denial of service (device crash) via a long string in the (1) LIST or (2) NLST command.
CVE-2023-5409: HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These models may be susceptible to a physical attack, allowing an untrusted source to tamper with the system firmware using a publicly disclosed private key. HP is providing recommended guidance for customers to reduce exposure to the potential vulnerability.
CVSS v3.1: 6.8
RHSA-2024:2888: Red Hat Security Advisory: thunderbird security update
Mozilla: Arbitrary JavaScript execution in PDF.js Mozilla: IndexedDB files retained in private browsing mode Mozilla: Potential permissions request bypass via clickjacking Mozilla: Cross-origin responses could be distinguished between script and non-script content-types Mozilla: Use-after-free could occur when printing to PDF Mozilla: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11
CVSS v3.1: 6.1
CVE-2025-48080: WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
CVSS v3.1: 6.5
GHSA-c688-2x49-65h9: An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.
CVSS v3.0: 5.5
GHSA-3q6m-7jw2-r5m4: The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 4.9
CVE-2017-5929: QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2019-19886: Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2018-3744: The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
CVSS v3.1: 9.8
CVSS v2.0: 5
GHSA-69wr-7pf5-gjvf: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS v3.1: 9.8
CVE-2026-27880: OpenFeature evaluation API reads input data with no bounds
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
CVSS v3.1: 7.5
GHSA-966j-fwrw-4gxw: There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The payload is stored on the configuring project Id page.
CVE-2017-15266: In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-v3r3-642v-rqj8: A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. 
This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1.
CVSS v3.1: 7.5
GHSA-w85w-m9jr-jffx: A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.
CVSS v3.1: 7.2
GHSA-m6rw-m2v9-7hx4: OS Command Injection in wifiscanner
wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.
CVSS v3.1: 9.8
CVE-2019-5318: A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions, 8.x.x.x: all versions prior to 8.8.0.0. Aruba has released patches for ArubaOS that address this security vulnerability.
CVSS v3.1: 6.5
CVSS v2.0: 7.1
CVE-2024-4626: JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-wvfm-cgxx-8pv9: iScripts eSwap v2.4 has CSRF via "registration_settings.php" in the Admin Panel.
CVSS v3.0: 8.8
GHSA-gpm6-xpxh-fvfp: Command injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVSS v3.1: 9.1
CVE-2009-0041: IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVSS v2.0: 5
GHSA-4cmj-wxxv-wvw4: In ft_open_face_internal of ftobjs.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
GHSA-6p96-cp5r-7g8c: Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php, (2) add a port forwarding rule via a request to port_forwarding_add.php, (3) change the wireless network to open via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the keyword parameter to managed_sites_add_keyword.php.
GHSA-4g7g-hm6x-hp5r: Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp.
GHSA-px7p-wv92-2466: OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.
CVSS v3.1: 9.8
GHSA-5vf7-pfc4-5ppj: The BGP Router process in Cisco IOS before 12.2(50)SY1 allows remote attackers to cause a denial of service (memory consumption) via vectors involving BGP path attributes, aka Bug ID CSCsw63003.
CVE-2005-0065: The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for data that has been sent but not acknowledged (aka "TCP sequence number checking"), which makes it easier for attackers to forge ICMP error messages for specific TCP connections and cause a denial of service, as demonstrated using (1) blind connection-reset attacks with forged "Destination Unreachable" messages, (2) blind throughput-reduction attacks with forged "Source Quench" messages, or (3) blind throughput-reduction attacks with forged ICMP messages that cause the Path MTU to be reduced.  NOTE: CVE-2004-0790, CVE-2004-0791, and CVE-2004-1060 have been SPLIT based on different attacks; CVE-2005-0065, CVE-2005-0066, CVE-2005-0067, and CVE-2005-0068 are related identifiers that are SPLIT based on the underlying vulnerability.  While CVE normally SPLITs based on vulnerability, the attack-based identifiers exist due to the variety and number of affected implementations and solutions that address the attacks instead of the underlying vulnerabilities.
CVSS v2.0: 10
CVE-2024-3321: SourceCodester eLearning System Maintenance Module cross site scripting
A vulnerability classified as problematic has been found in SourceCodester eLearning System 1.0. This affects an unknown part of the component Maintenance Module. The manipulation of the argument Subject Code/Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259389 was assigned to this vulnerability.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2025-66154: WordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.
CVSS v3.1: 5.4
GHSA-243w-cr2g-7p8m: The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1.
CVE-2023-45894: The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques.
CVSS v3.1: 10
CVE-2025-31900: WordPress Lexicata plugin <= 1.0.16 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lexicata Lexicata lexicata allows Reflected XSS.This issue affects Lexicata: from n/a through <= 1.0.16.
CVSS v3.1: 7.1
CVE-2011-5233: Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pixel" values in a TIFF image file.
CVSS v2.0: 4.3
CVE-2022-47336: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVSS v3.1: 5.5
CVE-2023-43040: IBM Spectrum Fusion HCI improper access control
IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access.  IBM X-Force ID:  266807.
CVSS v3.1: 6.5