ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-955m-4443-8f7r: A vulnerability was found in D-Link DIR-619L 2.04B04. It has been classified as critical. This affects the function formSysCmd. The manipulation of the argument sysCmd leads to command injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2021-33098: Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentially enable denial of service via local access.
CVSS v3.1: 5.5
CVSS v2.0: 4.9
CVE-2015-3989: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.
CVSS v2.0: 4.3
GHSA-8993-m67v-m44q: Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (out-of-bounds read operation) via a crafted packet that triggers a certain Find Node check attempt.
CVE-2025-0789: ESAFENET CDG doneDetail.jsp sql injection
A vulnerability classified as critical has been found in ESAFENET CDG V5. This affects an unknown part of the file /doneDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2026-56351: n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes
n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integrity.
CVSS v4.0: 5.3
CVSS v3.1: 8.2
GHSA-qrj9-r3jx-p4gc: Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $( ). Attackers can inject arbitrary commands through the $( ) syntax when passed as arguments to allowed commands like ping to execute unrestricted shell access.
CVSS v4.0: 8.6
CVSS v3.1: 8.4
RHSA-2021:3392: Red Hat Security Advisory: kpatch-patch security update
kernel: race condition for removal of the HCI controller
CVSS v3.1: 7
GHSA-9q5q-7m8w-wgxm: The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
CVSS v3.1: 7.2
CVE-2023-51507: WordPress Quiz And Survey Master plugin <= 8.1.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16.
CVSS v3.1: 5.3
GHSA-72wf-hwcq-65h9: Cross-Site Request Forgery in Filebrowser
A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.
CVSS v3.1: 8.8
CVE-2011-2133: Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 8 and 9 before 9.0.1.262, and RoboHelp Server 8 and 9, allows remote attackers to inject arbitrary web script or HTML via the URI, related to template_stock/whutils.js.
CVSS v2.0: 4.3
CVE-2018-3931: In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document can lead to an out-of-bounds write, resulting in remote code execution. This vulnerability occurs in the `putShapeProperty` method.
CVSS v3.0: 8.8
CVE-2007-1244: Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php.  NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
CVSS v2.0: 6.8
GHSA-j4p8-h8mh-rh8q: Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
ImpactIn self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node.This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including:Reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions)Writing files to the host filesystem (subject to the same restrictions)Starting with n8n version 1.2.1, access to files in the n8n home directory (`.n8n`) is blocked by default. However, this does not restrict access to other parts of the filesystem unless additional file access limitations are configured.PatchesUpgrade to **n8n version 2.0.0 or later**, where task runners are enabled by default for Code node execution.On **n8n version 1.71.0 and above**, enable task runners by setting `N8N_RUNNERS_ENABLED=true`.WorkaroundsIf you cannot immediately migrate to task runners:Limit file operations by setting `N8N_RESTRICT_FILE_ACCESS_TO` to a dedicated directory (e.g., `~/.n8n-files`) and ensure it contains no sensitive data.Keep `N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true` (default) to block access to `.n8n` and user-defined config files.If workflow editors are not fully trusted, consider disabling high-risk nodes (including the Code node) using `NODES_EXCLUDE`.Resourcesn8n Docs: [Task runners](https://docs.n8n.io/hosting/configuration/task-runners/)n8n Docs: [Task runner environment variables](https://docs.n8n.io/hosting/configuration/environment-variables/task-runners/)n8n Docs: [Security environment variables](https://docs.n8n.io/hosting/configuration/environment-variables/security/#security-environment-variables)n8n Docs: [v2.0 breaking changes](https://docs.n8n.io/2-0-breaking-changes/#enable-task-runners-by-default)
CVSS v3.1: 7.1
GHSA-8p52-7cxv-6c95: Downloads Resources over HTTP in curses
Affected versions of `curses` insecurely download an executable over an unencrypted HTTP connection.In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `curses`.RecommendationNo patch is currently available for this vulnerability, and the package has not been updated since 2013.The best mitigation is currently to avoid using this package, using a different package if available.Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
CVE-2022-41042: Visual Studio Code Information Disclosure Vulnerability
Visual Studio Code Information Disclosure Vulnerability
CVSS v3.1: 7.4
CVE-2023-31761: Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
CVSS v3.1: 7.5
CVE-2019-12433: An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow creating internal projects in private groups, leading to multiple permission issues.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2013-2430: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; JavaFX 2.2.7 and earlier; and OpenJDK 6 and 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to ImageIO. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "JPEGImageReader state corruption" when using native code.
CVSS v2.0: 7.6
CVE-2012-2239: Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
GHSA-8vx7-65jm-cwq7: An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
CVSS v3.1: 5.9
GHSA-5gp9-q9jf-wgmv: Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.
GHSA-8rvv-wcx9-q5mr: NVIDIA mediaserver contains a vulnerability where it is possible a use after free malfunction can occur due to an incorrect bounds check which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android: A-63802421. References: N-CVE-2017-6276.
CVSS v3.0: 7.8
CVE-2020-0362: In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123237930
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2018-9340: In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, causing information disclosure.
CVSS v3.1: 7.5
GHSA-wg9x-9fvm-m48v: pSlash PHP script 0.7 and earlier allows remote attackers to execute arbitrary code by including files from remote web sites, using an HTTP request that modifies the includedir variable.
CVE-2010-2622: SQL injection vulnerability in the Joomanager component, possibly 1.1.1, for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVSS v2.0: 7.5
CVE-2016-9902: The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-mjg7-65xv-hcjw: In the Linux kernel, the following vulnerability has been resolved:zram: fix slot write race conditionParallel concurrent writes to the same zram index result in leaked
zsmalloc handles.  Schematically we can have something like this:CPU0                              CPU1
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
				zram_slot_lock()
				zs_free(handle)
				zram_slot_lock()compress			compress
handle = zs_malloc()		handle = zs_malloc()
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
				zram_slot_lock
				zram_set_handle(handle)
				zram_slot_lockEither CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done
too early.  In fact, we need to reset zram entry right before we set its
new handle, all under the same slot lock scope.
CVSS v3.1: 4.7
CVE-2021-36015: Adobe Media Encoder Memory Corruption Could Lead To Remote Code Execution
Adobe Media Encoder version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-fp3m-w4r4-j69f: index.php in ActiveCampaign KnowledgeBuilder 2.4 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an invalid category parameter, which causes a large number of SQL queries to be processed.
CVE-2025-69727: An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu) allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to missing authorization checks and lack of rate-limiting when generating or accessing these URLs, an unauthenticated or unauthorized actor may retrieve profile pictures of users by crafting requests with guessed or known identifiers.
CVSS v3.1: 5.3
GHSA-2wvg-62qm-gj33: pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
Vulnerability Details**CWE-918**: Server-Side Request Forgery (SSRF)The `parse_urls` API function in `src/pyload/core/api/__init__.py` (line 556) fetches arbitrary URLs server-side via `get_url(url)` (pycurl) without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission can:Make HTTP/HTTPS requests to internal network resources and cloud metadata endpoints**Read local files** via `file://` protocol (pycurl reads the file server-side)**Interact with internal services** via `gopher://` and `dict://` protocols**Enumerate file existence** via error-based oracle (error 37 vs empty response)Vulnerable Code**`src/pyload/core/api/__init__.py` (line 556)**:No validation is applied to the `url` parameter. The underlying pycurl supports `file://`, `gopher://`, `dict://`, and other dangerous protocols by default.Steps to ReproduceSetupLog in as any user with ADD permission and extract the CSRF token:PoC 1: Out-of-Band SSRF (HTTP/DNS exfiltration)**Result**: 7 DNS/HTTP interactions received on the callback server (Burp Collaborator). Screenshot attached in comments.PoC 2: Local file read via file:// protocolThe difference confirms pycurl successfully reads local files. While `parse_urls` only returns extracted URLs (not raw content), any URL-like strings in configuration files or environment variables are leaked. The error vs success differential also serves as a **file existence oracle**.Files confirmed readable:`/etc/passwd`, `/etc/hosts``/proc/self/environ` (process environment variables)`/config/settings/pyload.cfg` (pyLoad configuration)`/config/data/pyload.db` (SQLite database)PoC 3: Internal port scanningPoC 4: gopher:// and dict:// protocol supportBoth protocols are accepted by pycurl, enabling interaction with internal services (Redis, memcached, SMTP, etc.).ImpactAn authenticated user with ADD permission can:**Read local files** via `file://` protocol (configuration, credentials, database files)**Enumerate file existence** via error-based oracle (`Couldn't open file` vs empty response)**Access cloud metadata endpoints** (AWS IAM credentials at `http://169.254.169.254/`, GCP service tokens)**Scan internal network** services and ports via error-based timing**Interact with internal services** via `gopher://` (Redis RCE, SMTP relay) and `dict://`**Exfiltrate data** via DNS/HTTP to attacker-controlled serversThe multi-protocol support (`file://`, `gopher://`, `dict://`) combined with local file read capability significantly elevates the impact beyond a standard HTTP-only SSRF.Proposed FixRestrict allowed protocols and validate target addresses:
CVSS v3.1: 7.7
CVE-2015-1453: The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences.
CVSS v2.0: 5
CVE-2026-34266: Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Absence Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Absence Management accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise HCM Absence Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.1: 6.5
GHSA-rwpc-6q3r-gfqf: NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.
CVSS v3.1: 8.8
GHSA-4gcf-5m39-98mc: Woodpecker does not validate webhook before changing any data
ImpactAn attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository.
This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage.PatchesPlease use either next or the latest v1.0 e.g. v1.0.2WorkaroundsSecure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.ReferencesFix: https://github.com/woodpecker-ci/woodpecker/pull/2221
Backport: https://github.com/woodpecker-ci/woodpecker/pull/2222
CVSS v3.1: 8.1
CVE-2025-53304: WordPress Contact Form – 7 : Hide Success Message plugin <= 1.1.4 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through <= 1.1.4.
CVSS v3.1: 5.3
CVE-2024-10309: Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
CVSS v3.1: 5.9
CVE-2006-4294: Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVSS v2.0: 5
GHSA-w5x7-vwr2-4x27: RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through August 2023.
CVSS v3.1: 7.8
GHSA-62q6-4hv4-vjrw: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
ImpactWhen Ghost is behind a shared caching layer that results in cached content being shared between different visitors (e.g., Fastly, Cloudflare, nginx proxy_cache, and others), an unauthenticated user could send an `x-ghost-preview` header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the same page, allowing cache poisoning of request-specific preview output.When running Ghost's frontend and admin panel on the same domain this could be used to take over staff user accounts. When running these on different domains staff accounts have no exposure.Vulnerable versionsThis vulnerability is present in Ghost from v4.0 up to v6.36.0.Patchesv6.37.0 contains a fix for this issue.How to updateFor self-hosters using Docker, find [Docker's official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).If you suspect a credential compromise, use the “Reset all authentication” dialogue under Settings / Danger Zone. This is available starting with Ghost v6.41.0.WorkaroundsAt the caching layer, bypass the cache for `x-ghost-preview` requests.ReferencesGhost thanks [CryptoCat](https://linkedin.com/in/cryptocat) for disclosing this vulnerability responsibly.For more informationIf you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).
CVSS v3.1: 9.6
CVE-2024-22638: liveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the component /livesite/edit_designer_region.php or /livesite/add_email_campaign.php.
CVSS v3.1: 9.8
GHSA-28h7-jgqq-qp89: UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack appears to be exploitable via network connectivity. These vulnerabilities have been fixed in revision 1204.
CVSS v3.1: 9.8
CVE-2023-22099: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: Only applicable to 7.0.x platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 8.2
CVE-2023-21103: In registerPhoneAccount of PhoneAccountRegistrar.java, uncaught exceptions in parsing persisted user data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-259064622
CVSS v3.1: 5.5
CVE-2020-13892: The SportsPress plugin before 2.7.2 for WordPress allows XSS.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-p24j-phqw-pqf4: Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials
CVSS v3.1: 10
CVE-2025-37941: ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe()
In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: wcd937x: fix a potential memory leak in wcd937x_soc_codec_probe()

When snd_soc_dapm_new_controls() or snd_soc_dapm_add_routes() fails,
wcd937x_soc_codec_probe() returns without releasing 'wcd937x->clsh_info',
which is allocated by wcd_clsh_ctrl_alloc. Add wcd_clsh_ctrl_free()
to prevent potential memory leak.
CVSS v3.1: 5.5