ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v8rp-6xcv-fwgh: Kiwi TCMS's /init-db/ page renders and responds to requests after first use
Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use.ImpactThe /init-db/ page does not require any user authentication because it is the first setup operation that needs to be executed in order for Kiwi TCMS to function. Database initialization happens before there are any user accounts available!While that looks serious at first the /init-db/ page is merely a proxy behind the `/Kiwi/manage.py migrate` command, which itself is designed to be reentrant. In the case of repeated access to the /init-db/ page after first use the output is:as shown on the screenshots below:There is no data loss because migrations result in a no-op if they are already applied!No application state is altered because all state changes have already been applied!No confidential information revealed because database migrations only report status on migrations which are clearly visible in source code!RemediationThe /init-db/ page has been modified to short-circuit itself if migrations have already been applied, resulting in a no-op on the webUI layer as well.
CVSS v4.0: 2.7
CVE-2026-38715: InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.
CVE-2014-6048: phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-6rj4-wj32-8fj7: Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.
CVSS v3.0: 9.8
CVE-2026-0870: GIGABYTE｜MacroHub - Local Privilege Escalation
MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper privileges, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-953q-pp3w-6gv5: The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-based applications and (b) the administrative console.
GHSA-wj5g-5xxg-2f92: A logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive data.
CVSS v3.1: 7.5
CVE-2023-41506: An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS v3.1: 9.8
GHSA-g3jh-2c96-x65c: Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter. Attackers can send crafted requests to profile.php with UNION-based SQL injection payloads to retrieve table names, column names, and sensitive data from the information_schema database.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-mp9r-g5gq-fwfp: Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Logging). The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows physical access to compromise Oracle Application Object Library. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
CVSS v3.0: 4.3
CVE-2023-44172: SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.
CVSS v3.1: 9.8
CVE-2021-24583: Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
CVSS v3.1: 4.3
CVSS v2.0: 4.3
GHSA-9pmc-x2f3-23jm: A vulnerability has been found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file scgi-bin/platform.cgi?page=bandwidth_profile.htm of the component Web Management Interface. The manipulation of the argument BandWidthProfile.ProfileName leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227659. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 2.4
GHSA-5p6r-pf49-94px: SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.
CVE-2025-54110: Windows Kernel Elevation of Privilege Vulnerability
Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 8.8
GHSA-6q79-p96r-5cvq: In opm service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVSS v3.1: 5.5
CVE-2014-10054: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 400, SD 450, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SDX20, lack of input validation on BT HCI commands processing allows privilege escalation.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2024-31990: Argo CD' API server does not enforce project sourceNamespaces
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

CVSS v3.1: 4.8
GHSA-c8pm-7v2j-xmww: The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.
CVE-2005-3803: Cisco IP Phone (VoIP) 7920 1.0(8) contains certain hard-coded ("fixed") public and private SNMP community strings that cannot be changed, which allows remote attackers to obtain sensitive information.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-g5fq-p794-xxc8: College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious code via student.php file.
CVSS v3.1: 7.2
CVE-2025-34264: Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId}
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an authenticated user adds or edits Software Watchdog process rules for an agent, the monitored process name is stored in the settings array and later rendered in the Software Watchdog UI without proper HTML sanitation. An attacker can inject malicious script into the process name, which is then executed in the browser context of users who view or interact with the affected rules, potentially enabling session compromise and unauthorized actions as the victim.
CVSS v4.0: 5.1
CVE-2026-9458: Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2024-38121: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2018-14737: An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A NULL pointer dereference can occur in pbc_wmessage_string in wmessage.c.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-9m9f-r948-79f6: A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL.
CVSS v3.1: 6.1
GHSA-jv4h-8f2w-wf2w: Buffer overflow in mcedit in Midnight Commander 4.5.1 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted text file.
GHSA-x82q-pg9x-gxh4: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 7.4
CVSS v3.1: 8.8
CVE-2025-0113: Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers
A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.
CVSS v4.0: 5.3
CVE-2008-0283: PHP remote file inclusion vulnerability in /aides/index.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS v2.0: 6.8
CVE-2024-43157: WordPress FormCraft plugin <= 1.2.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10.
CVSS v3.1: 4.3
GHSA-92p6-r57c-hr4v: SQL injection vulnerability in calendar.php in vBulletin 3.0.x allows remote attackers to execute arbitrary SQL commands via the eventid parameter.  NOTE: the affected version has been disputed by the vendor.  It appears that this is the same issue as CVE-2004-0036, which was fixed in 2.3.4.
GHSA-qj8w-cfmv-pqfm: SecureCRT 4.0, 4.1, and possibly other versions, allows remote attackers to execute arbitrary commands via a telnet:// URL that uses the /F option to specify a configuration file on a samba share.
GHSA-3vrw-rqr5-gvcv: NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.
CVSS v3.0: 8.1
CVE-2023-53737: Kentico Xperience <= 13.0.101 Localization Application Stored XSS
A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. Attackers can execute scripts that could affect multiple parts of the administration interface.
CVSS v4.0: 5.1
CVSS v3.1: 4.8
CVE-2001-0768: GuildFTPd 0.9.7 stores user names and passwords in plaintext in the default.usr file, which allows local users to gain privileges as other FTP users by reading the file.
CVSS v2.0: 4.6
RHSA-2018:1696: Red Hat Security Advisory: redhat-virtualization-host security update
hw: cpu: speculative store bypass
CVSS v3.0: 5.6
GHSA-x444-585r-8jf5: Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2656.
GHSA-g8fg-g275-53mg: The default configuration of TIBCO Rendezvous (RV) 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network.
GHSA-9f4r-8qhp-55cq: In the Linux kernel, the following vulnerability has been resolved:dmaengine: idxd: Fix crash when the event log is disabledIf reporting errors to the event log is not supported by the hardware,
and an error that causes Function Level Reset (FLR) is received, the
driver will try to restore the event log even if it was not allocated.Also, only try to free the event log if it was properly allocated.
CVSS v3.1: 5.5
CVE-2026-14013: Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
RHBA-2024:1226: Red Hat Bug Fix Advisory: openvswitch2.17 bug fix and enhancement update
openvswitch: openvswitch don't match packets on nd_target field
CVSS v3.1: 5.5
CVE-2020-10920: This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493.
CVSS v3.0: 9.8
GHSA-25q4-2c75-g7c9: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2789, CVE-2014-2795, and CVE-2014-2804.
GHSA-vjvv-65h7-vw77: A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
CVSS v3.1: 6.1
CVE-2006-6418: Buffer overflow in the POSIX Threads library (libpthread) on HP Tru64 UNIX 4.0F PK8, 4.0G PK4, and 5.1A PK6 allows local users to gain root privileges via a long PTHREAD_CONFIG environment variable.
CVSS v2.0: 7.2
CVE-2014-9576: VDG Security SENSE (formerly DIVA) 2.3.13 has a hardcoded password of (1) ArpaRomaWi for the root Postgres account and !DVService for the (2) postgres and (3) NTP Windows user accounts, which allows remote attackers to obtain access.
CVSS v2.0: 5
GHSA-66cw-5j4x-3r2w: In the Linux kernel, the following vulnerability has been resolved:s390/dasd: fix error recovery leading to data corruption on ESE devicesExtent Space Efficient (ESE) or thin provisioned volumes need to be
formatted on demand during usual IO processing.The dasd_ese_needs_format function checks for error codes that signal
the non existence of a proper track format.The check for incorrect length is to imprecise since other error cases
leading to transport of insufficient data also have this flag set.
This might lead to data corruption in certain error cases for example
during a storage server warmstart.Fix by removing the check for incorrect length and replacing by
explicitly checking for invalid track format in transport mode.Also remove the check for file protected since this is not a valid
ESE handling case.
CVSS v3.1: 7.8
GHSA-6gm6-3v5f-xfhg: Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
CVSS v3.0: 7.5
GHSA-x3j2-v37x-2v84: A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setdeviceName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument deviceMac/deviceName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272595. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
GHSA-mccv-jqp5-6vx4: Multiple heap-based buffer overflows in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allow remote attackers to have an unspecified impact via a crafted RealMedia file.
CVE-2005-2353: run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files.
CVSS v2.0: 2.1
RHSA-2020:4907: Red Hat Security Advisory: freetype security update
freetype: Heap-based buffer overflow due to integer truncation in Load_SBit_Png
CVSS v3.1: 8.6
RHSA-2026:2823: Red Hat Security Advisory: Updated discovery-cli release RPM versions 2.4.3
wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking
CVSS v3.1: 7.1
GHSA-rw7w-hjmw-gj5r: The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback application-path parameter and a hard link.
CVSS v3.0: 4.7
GHSA-ph92-rph5-h9x8: Usedesk before 1.7.57 allows filter reflected XSS.
CVSS v3.1: 6.1
GHSA-8497-6qx5-88vv: An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters.
CVSS v3.1: 6.3
GHSA-57w2-43hc-hjm2: The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.
CVSS v3.1: 7.5
GHSA-4pr9-2v9c-fmpv: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping on user supplied attributes such as thumb_mode and date_type. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-5wr9-jp8m-f367: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
CVSS v3.1: 5.6
CVE-2017-1624: IBM QRadar 7.3 and 7.3.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 133122.
CVSS v3.0: 4.2
GHSA-3f5f-x3vv-f92r: The password protection feature of Microsoft Money can store the password in plaintext, which allows attackers with physical access to the system to obtain the password, aka the "Money Password" vulnerability.
GHSA-83vr-m785-6cfc: SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via vectors involving categorysearch and smartSearch.
CVSS v3.0: 9.8
CVE-2024-24998: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. 
CVSS v3.0: 8.8
CVE-2017-3014: Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable use after free vulnerability in XML Forms Architecture (XFA) related to reset form functionality. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2024-2739: Advance Search <= 1.1.6 - Shortcode Deletion via CSRF
The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS v3.1: 8.7
CVE-2020-15489: An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2023-42834: A privacy issue was addressed with improved handling of files. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVSS v3.1: 6.2
CVE-2022-0162: Vulnerability in TP-LinK TL-WR841N wireless router
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perform administrative operations on the affected device through web-based management interface.
CVSS v3.1: 8.4
CVE-2024-43560: Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability
Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2023-41281: QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later
QuTScloud c5.1.5.2651 and later

CVSS v3.1: 5.5
GHSA-r5wg-v848-8x3g: Cross-site scripting (XSS) vulnerability in the Web Server (HTTP) task in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.2 FP2, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-16271: The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to read and modify data in the KeePass database via a WebSocket connection.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-cj65-9hr7-j38f: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVSS v3.1: 7.8