ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2021-47842: StudyMD 0.3.2 - Persistent Cross-Site Scripting
StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upload crafted markdown files with embedded JavaScript payloads that execute when the file is opened, potentially enabling remote code execution.
CVSS v4.0: 5.1
CVSS v3.1: 7.2
GHSA-wvg9-j5ff-4m6w: Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.
CVSS v3.1: 6.5
GHSA-3cfj-8mxg-4897: Improper initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow an authenticated user to potentially enable information disclosure via local access.
GHSA-cx7f-g6mp-7hqm: Path traversal vulnerability in functional web frameworks
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.Specifically, an application is vulnerable when both of the following are true:the web application uses RouterFunctions to serve static resourcesresource handling is explicitly configured with a FileSystemResource locationHowever, malicious requests are blocked and rejected when any of the following is true:the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in usethe application runs on Tomcat or Jetty
CVSS v3.1: 7.5
GHSA-cmxw-5mfj-977v: Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS v3.1: 5.4
RHSA-2023:5096: Red Hat Security Advisory: Logging Subsystem 5.5.16 - Red Hat OpenShift security update
openshift-logging: LokiStack authorisation is cached too broadly
CVSS v3.1: 5.7
GHSA-28m7-9rvj-93mc: A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be able to modify protected parts of the file system.
CVSS v3.1: 4.7
CVE-1999-0487: The DHTML Edit ActiveX control in Internet Explorer allows remote attackers to read arbitrary files.
CVSS v2.0: 2.6
GHSA-48wg-v88q-c99m: An attacker with physical access can exploit this vulnerability to execute arbitrary code during DXE phase. A malicious code installed as a result of vulnerability exploitation in DXE driver could survive across an operating system (OS) boot process and runtime This issue affects: Module name: AMITSE SHA256: 288769fcb374d9280735e259c579e2dc209491f4da43b085d6aabc2d6e6ee57d Module GUID: b1da0adf-4f77-4070-a88e-bffe1c60529a This issue affects: AMI Aptio 5.x.
CVSS v3.1: 7.2
CVE-2019-25641: Netartmedia Vlog System Lastest SQL Injection via email Parameter
Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with malicious email values in the forgotten_password module to extract sensitive database information.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-ff3j-px4r-rvxm: Missing Authorization vulnerability in wpcreativeidea Advanced Testimonial Carousel for Elementor.This issue affects Advanced Testimonial Carousel for Elementor: from n/a through 3.0.0.
CVSS v3.1: 4.3
CVE-2023-37867: WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.
CVSS v3.1: 3.7
GHSA-qqq4-5773-pmw5: uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution
I discovered a command injection vulnerability in uniget that allows arbitrary command execution through the metadata loading and version check mechanism.SummaryA command injection vulnerability exists in uniget due to unsafe execution of the `check` field from metadata files using `/bin/bash -c`. Because the `check` field is loaded directly from untrusted JSON metadata without validation or sanitization, an attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system when common uniget operations such as `describe`, `install`, `update`, or `inspect` are performed.This vulnerability can lead to arbitrary code execution with the privileges of the user running uniget.DetailsThe vulnerable code is located in:`tool.go:250`Vulnerable function:The issue occurs because the `tool.Check` field is populated directly from metadata JSON files without validation.Related structure:Metadata loading uses `json.Unmarshal()` to populate the `Tool` struct directly from JSON metadata, allowing attacker-controlled input to reach the shell execution sink.Because `/bin/bash -c` is used, shell metacharacters such as `;`, `&&`, `|`, `$()`, and backticks are interpreted by the shell, enabling arbitrary command injection.PoCStep 1 — Verify the vulnerable binary:Output:Step 2 — Create malicious metadata cache:Step 3 — Create placeholder binary:Step 4 — Trigger the vulnerable workflow:Application output:Step 5 — Verify arbitrary command execution:Actual output:This confirms arbitrary command execution through the untrusted `check` field loaded from metadata.ImpactThis issue allows arbitrary command execution on systems running uniget when processing malicious metadata.An attacker may be able to:Execute arbitrary shell commandsExfiltrate sensitive files or environment variablesInstall malware or backdoorsModify or delete accessible filesEstablish persistence on the victim machineCompromise CI/CD environments using uniget automationAny user importing or processing attacker-controlled metadata may be impacted.Suggested RemediationAvoid using `/bin/bash -c` with untrusted input.Instead of:consider executing fixed binaries and arguments directly without invoking a shell.For example:or sanitize and strictly validate allowed commands before execution.Thank you for your time and for maintaining the project. Please let me know if you need any additional information or a more detailed proof of concept.
CVSS v3.1: 7.8
CVE-2022-4269: A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.
CVSS v3.1: 5.5
GHSA-cmph-9x4x-xcj3: cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
CVE-2024-57234: NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
CVSS v3.1: 6.5
GHSA-hq49-jp92-xfgx: The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple vectors including a long room name and a long source account, and (2) a stack-based buffer overflow with a long username in an information request.  NOTE: some of these details are obtained from third party information.
GHSA-4ppw-fh8f-gwjp: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
CVSS v3.1: 6.1
CVE-2024-12125: 3scale-porta: readonly fields not validated server-side
A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.
CVSS v3.1: 7.5
CVE-2009-0323: Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable.  NOTE: these are different vectors than CVE-2008-6005.
CVSS v2.0: 10
GHSA-wxm5-2gcr-wvxp: PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote attackers to execute arbitrary PHP code via the sys_dbtype parameter.
GHSA-5qwh-74pw-p44j: Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.
CVSS v3.1: 9.1
RHSA-2023:0384: Red Hat Security Advisory: libXpm security update
libXpm: compression commands depend on $PATH libXpm: Runaway loop on width of 0 and enormous height libXpm: Infinite loop on unclosed comments
CVSS v3.1: 7.5
CVE-2016-7884: Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2016-1599: Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-4g85-q6g8-m8qc: Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B20241207.
CVSS v4.0: 7.3
CVSS v3.1: 8.8
GHSA-xcmh-9w7w-qf4p: The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.
CVSS v3.1: 7.5
RHSA-2026:30078: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)
transformers: code execution when converting a malicious SEW model checkpoint transformers: code execution when converting a malicious SEW-D model checkpoint transformers: code execution when converting a malicious HuBERT model checkpoint transformers: code execution when processing a malicious GLM4 model file libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file vim: arbitrary command execution via modeline sandbox bypass OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode libsndfile: integer overflow in ima_reader_init() jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers jq: jq: Denial of Service via crafted JSON object causing hash collisions urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers urllib3: urllib3: Denial of Service due to excessive HTTP response decompression
CVSS v3.1: 7.5
CVE-2022-24293: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-qh28-2cfg-qg6m: Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-8445, CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8458, CVE-2014-8461, and CVE-2014-9158.
GHSA-f9gf-3986-8cqm: SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability.
CVE-2009-3105: Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 211.241 for Domino 8.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR EZEL7UURYC.
CVSS v2.0: 4.3
CVE-2024-56216: WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through <= 7.6.3.
CVSS v3.1: 6.5
CVE-2026-23953: Incus container environment configuration newline injection
Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this issue on IncusOS requires a slight modification of the payload to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with /tmp mounted from the host (A privileged action for validation only). A fix is planned for versions 6.0.6
and 6.21.0, but they have not been released at the time of publication.
CVSS v3.1: 8.7
GHSA-xvwf-58fx-rg4f: In prepare_response of lwis_periodic_io.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-rjhx-p7x7-qfq6: An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function.
CVSS v3.1: 9.8
CVE-2003-0696: The getipnodebyname() API in AIX 5.1 and 5.2 does not properly close sockets, which allows attackers to cause a denial of service (resource exhaustion).
CVSS v2.0: 5
CVE-2007-3470: Multiple unspecified vulnerabilities in the KSSL kernel module in Sun Solaris 10, when configured with the KSSL proxy, allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors related to "memory buffers" of Secure Socket Layer (SSL) records.
CVSS v2.0: 7.8
CVE-2026-40228: In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.
CVSS v3.1: 2.9
GHSA-cgcr-5g8h-p7j5: Absolute path traversal vulnerability in admin/fileKontrola/browser.asp in Omnicom Content Platform (OCP) 2.0 allows remote attackers to list arbitrary directories via a full pathname in the root parameter.
CVE-2007-0116: Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for data/intranet.mdb.
CVSS v2.0: 7.5
CVE-2026-2963: Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection
A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyTypeRight.aspx. This manipulation of the argument id/offsnum causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-9pg8-fgjh-8wqr: In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for configuring the BPO tools.
CVSS v3.0: 8.8
ICSA-22-314-01: Siemens Parasolid
The affected application contains an out of bounds read past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17745) The affected application contains an out of bounds write past the end of an allocated buffer while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17854)
CVSS v3.1: 7.8
GHSA-g39f-h5w4-xhgq: Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation.
CVSS v3.1: 9.8
GHSA-c8gv-x3r9-q7p4: Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic.
CVSS v4.0: 6.9
CVSS v3.1: 4.8
CVE-2021-45394: An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
CVE-2026-43183: media: cx25821: Fix a resource leak in cx25821_dev_setup()
In the Linux kernel, the following vulnerability has been resolved:

media: cx25821: Fix a resource leak in cx25821_dev_setup()

Add release_mem_region() if ioremap() fails to release the memory
region obtained by cx25821_get_resources().
CVSS v3.1: 5.5
RHSA-2026:2048: Red Hat Security Advisory: freerdp security update
freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability
CVSS v3.1: 7.6
GHSA-gq3m-ffw3-prrq: Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS).
CVE-2023-2700: A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.
CVSS v3.1: 5.5
GHSA-wr48-m8vq-hpjp: Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. These vulnerabilities are due to improper parsing of crafted EnergyWise packets destined to an affected device. An attacker could exploit these vulnerabilities by sending crafted EnergyWise packets to be processed by an affected device. An exploit could allow the attacker to cause a buffer overflow condition or a reload of the affected device, leading to a DoS condition. Cisco IOS Software and Cisco IOS XE Software support EnergyWise for IPv4 communication. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities. IPv6 packets cannot be used to trigger these vulnerabilities. Cisco Bug ID CSCut50727.
CVSS v3.0: 8.6
GHSA-pp3f-f6jx-w9jr: Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList.
CVSS v3.1: 7.5
GHSA-cgcw-gg6m-8r52: Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.
CVSS v3.0: 6.1
CVE-2006-6601: Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service via a .MID (MIDI) file with a malformed header chunk without any track chunks, possibly involving (1) number of tracks of (2) time division fields that are set to 0.
CVSS v2.0: 4.3
CVE-2017-17594: DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-m8v4-m34m-jgj6: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.
CVSS v3.0: 9.8
GHSA-375g-qj2r-88m9: in OpenHarmony v3.2.4 and prior versions allow an adjacent attacker arbitrary code execution through out-of-bounds write.
CVSS v3.1: 4.2
GHSA-m36c-hhr2-59cc: Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.
CVSS v3.1: 9.8
CVE-2023-6902: codelyfe Stupid Simple CMS upload.php unrestricted upload
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-manager/upload.php. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248260.
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 5.2
RHSA-2012:1123: Red Hat Security Advisory: bind security update
bind: heavy DNSSEC validation load can cause assertion failure
GHSA-vm4p-5p2v-2x96: ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.
CVSS v3.1: 8.8
GHSA-crff-82gh-9235: A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-242188.
CVSS v3.0: 7.3
GHSA-2hmh-wq42-q44g: Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3) allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2.
CVSS v3.0: 6.1
GHSA-76m4-44fx-547p: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url  attribute within the plugin's Site Title widget in all versions up to, and including, 1.6.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-6c2p-9hhc-8hc8: A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability'.