ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2010-1872: Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 4.3
GHSA-679c-h9qm-hc7x: A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it.
The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
CVSS v3.1: 8
CVE-2018-20169: An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
CVSS v3.1: 6.8
CVSS v2.0: 7.2
GHSA-2g29-443f-qwh2: A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/add-portfolio.php. The manipulation of the argument ufile leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-206024.
CVSS v3.1: 9.8
CVE-2025-66224: OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system’s sendmail command. Because these values are not sanitized or constrained before being incorporated into the command execution path, certain sendmail behaviors can be unintentionally invoked during email processing. This makes it possible for the application to write files on the server as part of the mail-handling routine, and in deployments where those files end up in web-accessible locations, the behavior can be leveraged to achieve execution of attacker-controlled content. The issue stems entirely from constructing OS-level command strings using unsanitized input within the mail-sending logic. This issue has been patched in version 5.8.
CVSS v4.0: 9
CVE-2026-42733: WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 WPCS currency-switcher allows DOM-Based XSS.This issue affects WPCS: from n/a through <= 1.3.1.
CVSS v3.1: 7.1
CVE-2026-9881: Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Critical)
CVSS v3.1: 9
GHSA-869x-6wgw-grqg: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
CVSS v3.1: 7.5
GHSA-4ppp-gpcr-7qf6: HTTP Request Smuggling: Content-Length Sent Twice in Waitress
ImpactWaitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.So a request with:would get transformed to:Which would Waitress would then internally set to `Content-Lenght: 0`.Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.PatchesThis issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies.The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.WorkaroundsVarious reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).Issues/more security issues:open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
GHSA-gmmx-3xgg-g598: A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/print.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
CVE-2022-2821: Missing Critical Step in Authentication in namelessmc/nameless
Missing Critical Step in Authentication in GitHub repository namelessmc/nameless prior to v2.0.2.
CVSS v3.0: 9.8
CVE-2022-43927: IBM Db2 for Linux, UNIX and Windows information disclosure
IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted table access is used.  IBM X-Force ID:  241671.
CVSS v3.1: 5.9
CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to
Bleichenbacher-style attack when an attacker is able to provide the CMS or
S/MIME messages and observe the error code and/or decryption output.

Impact summary: The Bleichenbacher-style attack allows an attacker to use the
victim's vulnerable application as a way to decrypt or sign messages with the
victim's private RSA key.

The attack is possible in 2 variants.

1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without
providing the recipient certificate. In this case OpenSSL iterates over every
KeyTransRecipientInfo (KTRI) without stopping at the first success.

An attacker who authors a message with two KTRI entries — the first one
wrapping a real CEK under the victim's public key, the second with an
arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to
get a valid PKCS#1 v1.5 padding if the error code of the application is
available.

That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an
adaptive-chosen-ciphertext side channel from which the attacker decrypts any
RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under
it.

2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with
the recipient certificate, and the recipient is not found, a random
key is substituted.

An attacker who authors a message and is able to compare both error code and
the result of the decryption, can mount a Bleichenbacher oracle.

We are not aware of any applications that provide a remote attacker
an opportunity to mount an attack described in these scenarios. We consider
the existence of such application very unlikely, and for this reason this
CVE has been evaluated as Low severity.

To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the
invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described
in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit
rejection was explicitly disabled.

The implicit rejection mechanism always returns a plaintext value,
the symmetric key. This result is deterministic for the ciphertext and the
private key.  The length of the decryption result can happen to match the
length of the key of the symmetric cipher that was used for the content
encryption. When a certificate is not provided, the last RecipientInfo
producing a key that looks valid will be used. It may cause getting garbage
content on decryption. As a proper way to deal with this a recipient
certificate has to be provided to identify the particular RecipientInfo for
decryption.

The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as
CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.
CVSS v3.1: 3.7
GHSA-wp93-prx6-vqjm: A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of the file /goform/formAdvNetwork. The manipulation leads to improper access controls. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
GHSA-jcr6-4frq-9gjj: Users vulnerable to unaligned read of `*const *const c_char` pointer
Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior.In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in some other way, including the possibility of working correctly in some architectures.The crate is not currently maintained, so a patched version is not available.Recommended alternatives[`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)[`sysinfo`](https://crates.io/crates/sysinfo)
CVE-2024-51260: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.
CVSS v3.1: 9.8
GHSA-5crh-973f-rf4c: NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVE-2010-1759: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.
CVSS v2.0: 9.3
GHSA-qqgp-67mp-f5w9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood RSS Feed Widget allows Stored XSS.This issue affects RSS Feed Widget: from n/a through 2.9.7.
CVSS v3.1: 5.9
CVE-2024-29738: In gov_init, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
GHSA-g2qj-prgh-4g9r: Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback
Refresh Token Leaked via URL Query Parameter in OAuth Provider CallbackSummaryThe auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs.Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer.Affected Component**Repository**: `github.com/nhost/nhost`**Service**: `services/auth`**File**: `services/auth/go/controller/sign_in_provider_callback_get.go`**Function**: `signinProviderProviderCallback` (lines 257-261)Root CauseIn `sign_in_provider_callback_get.go:257-261`, after successful OAuth sign-in, the refresh token is appended as a URL query parameter:This results in a redirect like:Proof of ConceptStep 1: Initiate OAuth loginStep 2: Complete OAuth flow with providerStep 3: Auth service redirects with token in URLStep 4: Token is now visible in owned infrastructure and services:**Browser History:****HTTP Referer Header:****Server Access Logs:**Step 5: Attacker uses stolen refresh tokenImpact**Session Hijacking**: Anyone who obtains the token before it is consumed by the legitimate client can generate new access tokens, though the refresh token is one-time use and cannot be reused after consumption.**Leak Vectors**: URL query parameters are visible in owned infrastructure and integrated services:Browser history (local access)HTTP Referer headers (mitigated by modern browser default referrer policies; only sent to developer-integrated services)Server access logs (owned infrastructure)Proxy/CDN/WAF logs (owned infrastructure)**Affects All OAuth Providers**: Every OAuth provider flow (GitHub, Google, Apple, etc.) goes through the same callback handler.FixImplemented PKCE (Proof Key for Code Exchange) for the OAuth flow. With PKCE, the authorization code cannot be exchanged without the `code_verifier` that only the original client possesses, preventing token misuse even if the URL is logged.See: https://docs.nhost.io/products/auth/pkce/ResourcesOWASP: Session Management - Token Transport: "Session tokens should not be transported in the URL"RFC 6749 Section 10.3: "Access tokens and refresh tokens MUST NOT be included in the redirect URI"CWE-598: Use of GET Request Method With Sensitive Query StringsCWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS v4.0: 2.3
CVSS v3.1: 7.5
GHSA-gf29-gwj9-7xvj: An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.
CVSS v3.1: 8.8
CVE-2026-24997: WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.8.
CVSS v3.1: 5.3
RHSA-2021:0856: Red Hat Security Advisory: kernel security and bug fix update
kernel: malicious USB devices can lead to multiple out-of-bounds write kernel: out-of-bounds reads in pinctrl subsystem. kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c kernel: performance counters race condition use-after-free kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c kernel: Geneve/IPsec traffic may be unencrypted between two Geneve endpoints kernel: use-after-free in read in vt_do_kdgkb_ioctl kernel: ICMP rate limiting can be used for DNS poisoning attack kernel: SCSI target (LIO) write to any block on ILO backstore kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free kernel: increase slab leak leads to DoS
CVSS v3.1: 5.1
CVSS v3.0: 6.8
GHSA-qg24-8xj4-gj2h: Unaligned memory allocation in chunky
An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
CVSS v3.1: 7.5
GHSA-g86x-jhxw-c6c2: In FreeBSD 12.1-STABLE before r361918, 12.1-RELEASE before p6, 11.4-STABLE before r361919, 11.3-RELEASE before p10, and 11.4-RC2 before p1, an invalid memory location may be used for HID items if the push/pop level is not restored within the processing of that HID item allowing an attacker with physical access to a USB port to be able to use a specially crafted USB device to gain kernel or user-space code execution.
CVE-2009-0170: Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obtain unspecified other "access to resources," by visiting the Configuration Items component in the console.
CVSS v2.0: 6
GHSA-5xcf-6367-46j2: Cross-site request forgery vulnerability exists in surveillance cameras provided by i-PRO Co., Ltd.. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.
CVSS v4.0: 5.1
CVSS v3.0: 4.3
RHSA-2018:2737: Red Hat Security Advisory: mod_perl security update
mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess
CVSS v3.0: 6.3
CVE-2008-0861: Cross-site scripting (XSS) vulnerability in leg/Main.nsf in IBM Lotus Quickplace 7.0 allows remote attackers to inject arbitrary web script or HTML via an h_SearchString sub-parameter in the PreSetFields parameter of an EditDocument action.
CVSS v2.0: 4.3
CVE-2026-27901: Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were not properly escaped. This could enable HTML injection and Cross-Site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server. Version 5.53.5 fixes the issue.
CVSS v4.0: 5.3
CVE-2023-23510: A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be able to access a user’s Safari history.
CVSS v3.1: 5.5
CVE-2017-10853: Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.
CVSS v3.0: 8.8
CVSS v2.0: 8.3
GHSA-mfc2-qp9w-5vj4: tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.
CVE-2022-0488: An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes.
CVSS v3.1: 3.5
GHSA-h73m-j8vc-h4q2: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-hpfg-rrmq-6p7v: The mintToken function of a smart contract implementation for esportz, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVE-2024-8393: Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion
The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Please note that this can also be exploited via CSRF techniques.
CVSS v3.1: 6.6
RHSA-2024:10492: Red Hat Security Advisory: webkit2gtk3 security update
webkitgtk: data isolation bypass vulnerability
CVSS v3.1: 6.1
CVE-2009-3820: SQL injection vulnerability in the Flagbit Filebase (fb_filebase) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 7.5
GHSA-gwmp-w6mx-r484: A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/{note_id}/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-c5qq-g673-5p49: Puppet allows local users to overwrite arbitrary files via a symlink attack
`telnet.rb` in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (`/tmp/out.log`).
GHSA-3g68-h29c-7326: The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
CVSS v3.1: 8.8
GHSA-6m83-456q-vvpj: SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor. This is in ipac.jsp in a SELECT WHERE statement, in a part of the uri= variable in the second part of the full= inner variable.
CVSS v3.1: 7.5
GHSA-wwhq-cx22-f7vv: Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint
SummaryAn IDOR vulnerability exists in the Channels feature of `Open WebUI`, allowing any channel member to modify messages sent by other members (including administrators) within the same channel. This vulnerability affects the latest version (`v0.8.12`) of `Open WebUI`.DetailsIn the `update_message_by_id` function, for `group` or `dm` type channels, only the caller's membership in the channel is checked via the `is_user_channel_member` function, without verifying message ownership. This allows any channel member to modify messages sent by other members within the same channel. The problematic code is as follows [(https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/channels.py#L1355)](https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/channels.py#L1355) :Non-group/dm types include a check for the user ID, while the `group/dm` type clearly lacks this verification.PoCThe `Channels` feature is disabled by default and can be enabled first through the `admin` interface.
<img width="1024" height="618" alt="image" src="https://github.com/user-attachments/assets/a36502e9-c6cd-41cd-a69c-8b6ac809768f" />Create a `group` type channel with members including users `test1` and `test2`.User `test2` sends a message in the channel.User `test1` can directly modify the message that `test2` just sent.Messages sent by administrators can also be modified.ImpactMalicious users can arbitrarily tamper with messages published by other users (including administrators), allowing them to disseminate false information.Suggested FixAdd a message ownership check in the `group/dm` branch of `channels.py`.
CVSS v3.1: 4.3
RHSA-2022:5068: Red Hat Security Advisory: OpenShift Container Platform 4.11.0 packages and security update
golang.org/x/crypto: empty plaintext packet causes panic golang: net/http: improper sanitization of Transfer-Encoding header ignition: configs are accessible from unprivileged containers in VMs running on VMware products prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString golang: cmd/go: misinterpretation of branch names can lead to incorrect access control golang: crypto/elliptic: IsOnCurve returns true for invalid field elements golang: encoding/pem: fix stack overflow in Decode golang: regexp: stack exhaustion via a deeply nested expression golang: crash in a golang.org/x/crypto/ssh server golang: crypto/elliptic: panic caused by oversized scalar runc: incorrect handling of inheritable capabilities
CVSS v3.1: 5.6
CVE-2021-32809: Arbitrary HTML injection vulnerability in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVSS v3.1: 4.6
GHSA-wm2x-pgq2-vxxm: The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
GHSA-gf79-pr99-3gvq: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS v3.1: 5.4