ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-38cw-85xc-xr9x: Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
SummaryAn SQL injection vulnerability exists in the `@veramo/data-store` package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is caused by insufficient validation of the `column` parameter in the `order` array of query requests.Details`packages/data-store/src/data-store-orm.ts` (lines 416-434)The vulnerability exists in the `decorateQB()` function which processes query ordering parameters:**Root Cause:**The `item.column` value from user input is passed directly as the **alias** parameter to `addSelect()` without any sanitization or validationWhile TypeScript defines allowed column types (e.g., `TCredentialColumns = 'context' | 'type' | ...`), this is only compile-time checkingAt runtime, the function accepts `FindArgs<any>`, allowing arbitrary strings to bypass type restrictionsTypeORM inserts the alias directly into the SQL query, enabling SQL injection**Affected Endpoints:**All endpoints are located in `packages/data-store/src/data-store-orm.ts`:| Endpoint | Method | Line |
|----------|--------|------|
| `dataStoreORMGetIdentifiers` | identifiersQuery() | 85-98 |
| `dataStoreORMGetMessages` | messagesQuery() | 129-153 |
| `dataStoreORMGetVerifiableCredentialsByClaims` | claimsQuery() | 168-198 |
| `dataStoreORMGetVerifiableCredentials` | credentialsQuery() | 227-252 |
| `dataStoreORMGetVerifiablePresentations` | presentationsQuery() | 275-297 |All these methods call `decorateQB()` which processes the vulnerable `order` parameter.PoC**Prerequisites:**A running Veramo agent with the REST API exposed (e.g., via `@veramo/remote-server`)Valid authentication credentials (Bearer token)The agent uses `@veramo/data-store` with a SQLite or compatible database**Example Exploit to Extract Private Keys From DB:**similar exploit could be used against the other affected endpointsImpact**Attack capabilities:**Complete database read accessReading or write files into fs depending on dbms usedDatabase-specific escalation pathsDos through timebased or multiple long running queries
CVSS v3.1: 6.8
CVE-2013-4109: An unspecified cross-site scripting (XSS) vulnerability exists in Cryptocat Message Handling 1.1.165.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2001-0341: Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll.
CVSS v2.0: 7.5
GHSA-87cr-f8hp-2h8x: In the Linux kernel, the following vulnerability has been resolved:usb: storage: Fix memory leak in USB bulk transportA kernel memory leak was identified by the 'ioctl_sg01' test from Linux
Test Project (LTP). The following bytes were mainly observed: 0x53425355.When USB storage devices incorrectly skip the data phase with status data,
the code extracts/validates the CSW from the sg buffer, but fails to clear
it afterwards. This leaves status protocol data in srb's transfer buffer,
such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can
lead to USB protocols leaks to user space through SCSI generic (/dev/sg*)
interfaces, such as the one seen here when the LTP test requested 512 KiB.Fix the leak by zeroing the CSW data in srb's transfer buffer immediately
after the validation of devices that skip data phase.Note: Differently from CVE-2018-1000204, which fixed a big leak by zero-
ing pages at allocation time, this leak occurs after allocation, when USB
protocol data is written to already-allocated sg pages.
GHSA-v69f-jf53-66f6: Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE_SCHEMA, Memo Rendering Component, and Public/Private Memo View pages
CVSS v3.1: 6.1
CVE-2023-21513: Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that results in unexpected behavior in CC Mode under specific condition.
CVSS v3.1: 6.1
GHSA-3hfh-w64f-p273: Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 7.5
CVE-2005-2717: PHP remote file inclusion vulnerability in WebCalendar before 1.0.1 allows remote attackers to execute arbitrary PHP code when opening settings.php, possibly via send_reminders.php or other scripts.
CVSS v2.0: 7.5
GHSA-2m65-7fpj-78p9: In the Linux kernel, the following vulnerability has been resolved:hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()The acpi_power_meter driver's .notify() callback function,
acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock
that is also acquired by callbacks in sysfs attributes of the device
being unregistered which is prone to deadlocks between sysfs access and
device removal.Address this by moving the hwmon device removal in
acpi_power_meter_notify() outside the lock in question, but notice
that doing it alone is not sufficient because two concurrent
METER_NOTIFY_CONFIG notifications may be attempting to remove the
same device at the same time.  To prevent that from happening, add a
new lock serializing the execution of the switch () statement in
acpi_power_meter_notify().  For simplicity, it is a static mutex
which should not be a problem from the performance perspective.The new lock also allows the hwmon_device_register_with_info()
in acpi_power_meter_notify() to be called outside the inner lock
because it prevents the other notifications handled by that function
from manipulating the "resource" object while the hwmon device based
on it is being registered.  The sending of ACPI netlink messages from
acpi_power_meter_notify() is serialized by the new lock too which
generally helps to ensure that the order of handling firmware
notifications is the same as the order of sending netlink messages
related to them.In addition, notice that hwmon_device_register_with_info() may fail
in which case resource->hwmon_dev will become an error pointer,
so add checks to avoid attempting to unregister the hwmon device
pointer to by it in that case to acpi_power_meter_notify() and
acpi_power_meter_remove().
CVSS v3.1: 5.5
CVE-2026-11625: Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes.

When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced.

Secrets generated in multiprocess applications are predictable across processes.
CVE-2015-0686: The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors, aka Bug ID CSCuq92240.
CVSS v2.0: 6.3
GHSA-r49j-rm79-m76m: The EchBay Admin Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_ebnonce' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-648r-gxw4-j288: Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10.  NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER.  NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.
CVE-2024-43352: WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Organic Themes GivingPress Lite allows Stored XSS.This issue affects GivingPress Lite: from n/a through 1.8.6.
CVSS v3.1: 6.5
GHSA-rm5x-vf5q-5mp5: NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege access to execute arbitrary code.
CVSS v3.1: 6.7
CVE-2026-8730: Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service
A flaw has been found in Open5GS up to 2.7.6. This impacts the function ogs_sbi_nf_instance_set_id in the library /lib/sbi/context.c of the component NRF. Executing a manipulation of the argument nfInstanceId can lead to denial of service. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
GHSA-qmj6-6gg3-prp7: Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.
GHSA-hpqh-jxqm-vm9x: GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title.
CVSS v3.1: 5.4
CVE-2006-6040: Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs parameter in a buildnavprefs action or (2) the navprefs parameter in a savenavprefs action.
CVSS v2.0: 6.8
CVE-2024-2123: Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
CVE-2021-2228: Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive Compensation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Incentive Compensation accessible data as well as unauthorized access to critical data or complete access to all Oracle Incentive Compensation accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1: 8.1
CVE-2026-40978: SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.

Affected versions:
Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
CVSS v3.1: 8.8
GHSA-5wmx-f8h4-x4h7: Cross-site scripting (XSS) vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a (1) GET or (2) POST parameter, aka Bug ID CSCus08074.
GHSA-j62f-48c7-864m: SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custom_field parameter to sl-xml.php.
CVSS v3.0: 9.8
CVE-2021-34691: iDrive RemotePC before 4.0.1 on Linux allows denial of service. A remote and unauthenticated attacker can disconnect a valid user session by connecting to an ephemeral port.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-26549: An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-4gm3-j7hq-575w: Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI.The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 4.1 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS v4.0: 6.9
CVSS v3.1: 6.5
GHSA-qv7x-mr4c-wj5h: Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_add_str POST parameter directly into an HTML form hidden input value attribute. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
CVE-2007-1745: The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.1
GHSA-6p52-jr3q-c94g: Nameko Arbitrary code execution due to YAML deserialization
ImpactNameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:PatchesThe problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.WorkaroundsThe vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.
CVSS v4.0: 9.3
CVSS v3.1: 8.6
CVE-2006-1350: PHP remote file include vulnerability in index.php in 99Articles.com (aka ArticlesOne.com) Free articles directory allows remote attackers to include and execute arbitrary PHP code via a URL in the page parameter.
CVSS v2.0: 7.5
CVE-2002-1508: slapd in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows local users to overwrite arbitrary files via a race condition during the creation of a log file for rejected replication requests.
CVSS v2.0: 1.2
CVE-2026-0082: In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v4.0: 10
CVE-2024-4319: Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms.
CVSS v3.1: 5.3
GHSA-5g3w-62hr-p464: A vulnerability in the API endpoints for Cisco DNA Center could allow an authenticated, remote attacker to gain access to sensitive information that should be restricted. The attacker must have valid device credentials. This vulnerability is due to improper access controls on API endpoints. An attacker could exploit the vulnerability by sending a specific API request to an affected application. A successful exploit could allow the attacker to obtain sensitive information about other users who are configured with higher privileges on the application.
CVSS v3.1: 4.3
CVE-2018-17441: An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-9r48-45jv-qjj7: Adobe Experience Manager versions 6.5, and 6.4 have an uncontrolled resource consumption vulnerability. Successful exploitation could lead to denial-of-service.
CVE-2011-3981: PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
CVSS v2.0: 7.5
GHSA-4h3h-6vxm-m4vr: Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.
CVSS v4.0: 9.2
CVE-2022-42287: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure and data tampering.
CVSS v3.1: 6
CVE-2025-64204: WordPress SmartMag theme <= 10.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This issue affects SmartMag: from n/a through <= 10.3.1.
CVSS v3.1: 6.5
CVE-2024-48459: A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (Jixiang Tenda) v.DI_7003G-19.12.24A1V16.03.29.50;V16.03.29.50;V16.03.29.50. An attacker can exploit this vulnerability by constructing a malicious payload to execute commands and further obtain shell access to the router's file system with the highest privileges.
CVSS v3.1: 7.3
GHSA-4h35-wggv-9625: IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177356.
GHSA-rfrf-jqfv-23vc: Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/cells/manage_cell.php:4
CVSS v3.1: 8.8
GHSA-282v-666c-3fvg: transformers has Insecure Temporary File
Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0.
CVSS v3.1: 4.7
RHSA-2019:1489: Red Hat Security Advisory: kernel security and bug fix update
kernel: Double free in lib/idr.c Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service
CVSS v3.0: 5.3
CVE-2019-13664: Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
RHSA-2025:7620: Red Hat Security Advisory: JBoss EAP XP 5.0 Update 2.0 release. See references for release notes.
protobuf: StackOverflow vulnerability in Protocol Buffers narayana: deadlock via multiple join requests sent to LRA Coordinator
CVSS v3.1: 5.9
RHSA-2016:0620: Red Hat Security Advisory: samba4 security, bug fix, and enhancement update
samba: crash in dcesrv_auth_bind_ack due to missing error check samba: Man-in-the-middle attacks possible with NTLMSSP authentication samba: Spoofing vulnerability when domain controller is configured samba: Missing downgrade detection samba: Server certificates not validated at client side samba: Samba based active directory domain controller does not enforce smb signing samba: Smb signing not required by default when smb client connection is used for ipc usage samba: SAMR and LSA man in the middle attacks
GHSA-8jfx-rqjm-9jhf: OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf worker can steer or kill sibling runs and cause execution with broader tool policies by exploiting insufficient authorization checks on subagent control requests.
CVSS v4.0: 9.3
CVSS v3.1: 8.8
CVE-2009-0351: Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code via a long LIST argument beginning with an * (asterisk) character.
CVSS v2.0: 9
GHSA-v56g-44rc-67wq: In the Linux kernel, the following vulnerability has been resolved:md raid: fix hang when stopping arrays with metadata through dm-raidWhen using device-mapper's dm-raid target, stopping a RAID array can cause
the system to hang under specific conditions.This occurs when:A dm-raid managed device tree is suspended from top to bottom
 (the top-level RAID device is suspended first, followed by its
  underlying metadata and data devices)The top-level RAID device is then removedRemoving the top-level device triggers a hang in the following sequence:
the dm-raid destructor calls md_stop(), which tries to flush the
write-intent bitmap by writing to the metadata sub-devices. However, these
devices are already suspended, making them unable to complete the write-intent
operations and causing an indefinite block.Fix:Prevent bitmap flushing when md_stop() is called from dm-raid
destructor context
and avoid a quiescing/unquescing cycle which could also cause I/OStill allow write-intent bitmap flushing when called from dm-raid
suspend contextThis ensures that RAID array teardown can complete successfully even when the
underlying devices are in a suspended state.This second patch uses md_is_rdwr() to distinguish between suspend and
destructor paths as elaborated on above.
CVSS v3.1: 5.5
GHSA-8fp6-957g-c524: Sophos Anti-Virus and Endpoint Security before 6.0.5, Anti-Virus for Linux before 5.0.10, and other platforms before 4.11, when "Enabled scanning of archives" is set, allows remote attackers to cause a denial of service (infinite loop) via a malformed RAR archive with an Archive Header section with the head_size and pack_size fields set to zero.
GHSA-3r47-p7p5-69cv: In the Citadel chip firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-175116439
CVE-2026-25765: Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL's host/authority component. This means that if any application passes user-controlled input to Faraday's get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.
CVSS v3.1: 5.8
GHSA-q7gc-j674-5xp7: A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability.
CVSS v3.1: 8.2