ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2022-3746: A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface.
CVSS v3.1: 6.7
CVE-2017-11842: Windows kernel in Windows 8.1 and RT 8.1, Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to log in and run a specially crafted application due to the Windows kernel improperly initializing a memory address, aka "Windows Kernel Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11849, CVE-2017-11851, and CVE-2017-11853.
CVSS v3.0: 4.7
CVSS v2.0: 1.9
CVE-2018-8761: protected\apps\member\controller\shopcarController.php in Yxcms building system (compatible cell phone) v1.4.7 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-g25h-9w3g-vppm: Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords.
CVE-2024-9739: Tungsten Automation Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Tungsten Automation Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24455.
CVSS v3.0: 7.8
GHSA-8vrg-v3rr-5xmf: Buffer overflow in les for ATM on Linux (linux-atm) before 2.4.1, if used setuid, allows local users to gain privileges via a long -f command line argument.
GHSA-vjjp-rpjm-8fq9: An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentiality and availability.
CVSS v4.0: 4.8
GHSA-32xp-8gq9-j2vq: Buffer overflow in Vypress Messenger 3.5.1 and earlier allows remote attackers to execute arbitrary code via a message with a long first field.
CVE-2021-46484: Jsish v3.5.0 was discovered to contain a heap-use-after-free via Jsi_IncrRefCount in src/jsiValue.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2026-21522: Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 6.7
CVE-2023-47774: WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability
Improper Restriction of Rendered UI Layers or Frames vulnerability in Automattic Jetpack allows Clickjacking.This issue affects Jetpack: from n/a before 12.7.
CVSS v3.1: 5.4
CVE-2025-12461: Unprotected access to parts of the application in Epsilon RH by Grupo Castilla
This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control.  The attacker could access this path ‘…/epsilonnet/License/About.aspx’ and obtain information on both the licence and the configuration of the product by knowing which modules are installed.
CVSS v4.0: 6.9
CVE-2023-31893: Telefnica Brasil Vivo Play (IPTV) Firmware: 2023.04.04.01.06.15 is vulnerable to Denial of Service (DoS) via DNS Recursion.
CVSS v3.1: 7.5
CVE-2012-1161: Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results
CVSS v3.1: 4.3
CVSS v2.0: 4
CVE-2022-1440: Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface
Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
CVSS v3.0: 9.8
GHSA-gc73-hf46-8rfq: Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file.
CVE-2021-32768: Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
CVSS v3.1: 6.1
GHSA-j3xh-96gv-642p: Cisco NX-OS 5.0 and earlier on MDS 9000 devices allows remote attackers to cause a denial of service (supervisor CPU consumption) via Authentication Header (AH) authentication in a Virtual Router Redundancy Protocol (VRRP) frame, aka Bug ID CSCte27874.
GHSA-jgpr-529r-rfw8: Cross-site scripting (XSS) vulnerability in PunBB before 1.2.5 allows remote attackers to inject arbitrary web script or HTML.
RHSA-2026:19043: Red Hat Security Advisory: corosync security update
corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet corosync: Corosync: Denial of Service via integer overflow in join message validation
CVSS v3.1: 7.5
GHSA-chgw-5c3m-whxf: Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter.
CVE-2013-6276: QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files. NOTE: 1. All active models are not affected. The last affected model was EOL since 2010. 2. The legacy authorization mechanism is no longer adopted in all active models
CVSS v3.1: 9.8
CVSS v2.0: 5
GHSA-xp82-v37c-r7g6: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Portfolio Management). Supported versions that are affected are 2.0.0, 2.0.1, 2.2.0.1 and 12.0.1. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Private Banking accessible data as well as unauthorized access to critical data or complete access to all Oracle FLEXCUBE Private Banking accessible data. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.0: 8.1
CVE-2022-43975: An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbitrary files and configurations to be read via directory traversal over TCP port 8888.
CVSS v3.1: 7.5
GHSA-hm82-wr2f-7vvq: Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
CVSS v3.0: 5.4
CVE-2025-43390: A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.
CVSS v3.1: 5.5
CVE-2011-1707: Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs parameter in a printer-url.
CVSS v2.0: 9.3
GHSA-4xwv-49c8-fvhq: OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module
SummaryCritical Error-Based SQL Injection vulnerability in the Scadenzario (Payment Schedule) bulk operations module of OpenSTAManager v2.9.8 allows authenticated attackers to extract complete database contents including user credentials, customer PII, and financial records through XML error messages.**Status:** ✅ Confirmed and tested on live instance (v2.9.8)
**Vulnerable Parameter:** `id_records[]` (POST array)
**Affected Endpoint:** `/actions.php?id_module=18` (Scadenzario module)
**Attack Type:** Error-Based SQL Injection (IN clause)DetailsOpenSTAManager v2.9.8 contains a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the `id_records` array are integers before using them in an SQL IN() clause, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.**Vulnerability Chain:****Entry Point:** `/actions.php` (Lines 503-506)The `array_clean()` function only removes empty values - it does NOT validate types.**Vulnerable Function:** `/lib/util.php` (Lines 54-60)**Impact:** The function filters out empty values but accepts any non-empty value, including SQL Injection payloads.**SQL Injection Point:** `/modules/scadenzario/bulk.php` (Line 88) **PRIMARY VULNERABILITY****Impact:** Array elements from `$id_records` are directly concatenated using `implode()` without type validation or `prepare()`, enabling full SQL Injection.**Root Cause Analysis:**The vulnerability exists because:`post('id_records')` returns user-controlled array`array_clean()` only removes empty values, not non-integer values`implode(',', $id_records)` concatenates array elements directly into SQLNo validation ensures array elements are integersAttacker can inject SQL by providing: `id_records[]=1&id_records[]=(MALICIOUS SQL)#`**Affected Code Path:**PoC**Step 1: Login****Step 2: Verify Vulnerability (Error-Based SQL Injection)****Test 1: Extract Database User and Version****Response (error message visible to attacker):****Test 2: Extract Admin Credentials****Response:****Test 3: Extract Password Hash (Part 1 - first 31 chars)****Response:****Test 4: Extract Password Hash (Part 2 - chars 32-60)****Response:****Combined Password Hash:**Impact**All authenticated users with access to the Scadenzario (Payment Schedule) module bulk operations.**Recommended Fix:****Primary Fix - Type Validation:**File: `/modules/scadenzario/bulk.php`**BEFORE (Vulnerable - Line 88):****AFTER (Fixed):**CreditsDiscovered by Łukasz Rybak
CVSS v4.0: 8.7
GHSA-48gg-mvqw-v584: daneren2005 DSub for Subsonic (Android client) version 5.4.1 contains a CWE-295: Improper Certificate Validation vulnerability in HTTPS Client that can result in Any non-CA signed server certificate, including self signed and expired, are accepted by the client. This attack appear to be exploitable via The victim connects to a server that's MITM/Proxied by an attacker.
CVSS v3.0: 5.9
CVE-2007-0830: Multiple cross-site scripting (XSS) vulnerabilities in the Admin Control Panel (AdminCP) in Jelsoft vBulletin 3.6.4 allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors related to the (1) User Group Manager, (2) User Rank Manager, (3) User Title Manager, (4) BB Code Manager, (5) Attachment Manager, (6) Calendar Manager, and (7) Forums & Moderators functions.  NOTE: the vendor disputes this issue, stating that modifying HTML is an intended privilege of an administrator.  NOTE: it is possible that this issue overlaps CVE-2006-6040
CVSS v2.0: 3.5
CVE-2018-3563: In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, untrusted pointer dereference in apr_cb_func can lead to an arbitrary code execution.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
GHSA-958x-j3cw-gmg7: An exploitable heap corruption vulnerability exists in the loadTrailer functionality of Iceni Argus version 6.6.05. A specially crafted PDF file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide a malicious PDF file to trigger this vulnerability.
CVSS v3.0: 7.8
GHSA-32p5-27p9-f97f: IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to client-side enforcement of sever-side security.
CVSS v3.1: 6.5
GHSA-42p8-rv8p-8h4j: A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2001-1254: Web Access component for COM2001 Alexis 2.0 and 2.1 in InternetPBX sends username and voice mail passwords in the clear via a Java applet that sends the information to port 8888 of the server, which could allow remote attackers to steal the passwords via sniffing.
CVSS v2.0: 7.5
CVE-2012-1591: The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
CVSS v2.0: 5
RHSA-2013:0128: Red Hat Security Advisory: conga security, bug fix, and enhancement update
conga: insecure handling of luci web interface sessions
GHSA-h9vf-m6r3-vxmh: A security vulnerability has been detected in jishenghua jshERP up to 3.6. This vulnerability affects the function addAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component addAccountHeadAndDetail Endpoint. Such manipulation of the argument fileName leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 2.1
CVSS v3.1: 5.4
CVE-2022-42744: CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.
CVSS v3.1: 9.8
GHSA-9wjh-jr2j-6r4x: Remote Code Execution in pi_video_recording
All versions of `pi_video_recording` are vulnerable to Remote Code Execution. Due to insufficient input validation the server executes arbitrary code through the /api/record/start endpoint.  After running the server, `curl -POST -H "Content-Type: application/json" -d '{"filename": " || touch /tmp/worked;"}' http://localhost:5000/api/record/start`creates a file in the /tmp/ directoryRecommendationNo fix is currently available. Consider using an alternative module until a fix is made available.
GHSA-89gv-h8wf-cg8r: URIjs Vulnerable to Hostname spoofing via backslashes in URL
ImpactIf using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.Example URL: `https:/\/\/\expected-example.com/path`
Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).PatchesVersion 1.19.7 is patched against all known payload variants.Referenceshttps://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)For more informationIf you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.jsReporter credit[ready-research](https://github.com/ready-research) via https://huntr.dev/
CVSS v3.0: 5.3
CVE-2018-12916: In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-22gp-7w9x-c2xx: In the Linux kernel, the following vulnerability has been resolved:drm/ast: Fix soft lockupThere is a while-loop in ast_dp_set_on_off() that could lead to
infinite-loop. This is because the register, VGACRI-Dx, checked in
this API is a scratch register actually controlled by a MCU, named
DPMCU, in BMC.These scratch registers are protected by scu-lock. If suc-lock is not
off, DPMCU can not update these registers and then host will have soft
lockup due to never updated status.DPMCU is used to control DP and relative registers to handshake with
host's VGA driver. Even the most time-consuming task, DP's link
training, is less than 100ms. 200ms should be enough.
CVSS v3.1: 5.5
CVE-2023-45831: WordPress AMP WP Plugin <= 1.5.15 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions.
CVSS v3.1: 5.4
GHSA-qh3h-3qgq-cxv8: Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 149.0.2.
CVSS v3.1: 8.8
GHSA-rvg5-hcw7-2823: Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.
CVE-2025-2617: yangyouwang 杨有旺 crud 简约后台管理系统 Department Page cross site scripting
A vulnerability classified as problematic was found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected by this vulnerability is an unknown functionality of the component Department Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-cq7v-vrjg-jccw: Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a long SSID Information Element in a command to a Netlink socket.
CVSS v3.0: 6.1
GHSA-p2xr-m559-3m72: ** DISPUTED **  Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853.  NOTE: the vendor has notified CVE that the current version only creates static pages, and that slistl.php/slid never existed in any version.
CVE-2019-10783: All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-32f8-xfvp-9m45: A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the argument list/queryById results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 3.9.2 is able to resolve this issue. The affected component should be upgraded.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
GHSA-6wg2-rhf8-jx86: Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.
CVSS v3.0: 6.5
GHSA-gxm8-54cq-9h89: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.We have already fixed the vulnerability in the following versions:
QTS 4.5.4.2790 build 20240605 and later
QuTS hero h4.5.4.2790 build 20240606 and later
CVSS v3.1: 6.6
GHSA-7787-p7x6-fq3j: Candid infinite decoding loop through specially crafted payload
ImpactThe Candid library causes a Denial of Service while parsing a specially crafted payload with `empty` data type. For example, if the payload is `record { * ; empty }` and  the canister interface expects `record { * }` then the rust candid decoder treats `empty` as an extra field required by the type.  The problem with type `empty` is that the candid rust library wrongly categorizes `empty` as a recoverable error when skipping the field and thus causing an infinite decoding loop.Canisters using affected versions of candid are exposed to denial of service by causing the decoding to run indefinitely until the canister traps due to reaching maximum instruction limit per execution round. Repeated exposure to the payload will result in degraded performance of the canister.For asset canister users, `dfx` versions `>= 0.14.4` to `<= 0.15.2-beta.0` ships asset canister with an affected version of candid.UnaffectedRust canisters using candid `< 0.9.0` or `>= 0.9.10`Rust canister interfaces of type other than `record { * }`Motoko based canistersdfx (for asset canister) `<= 0.14.3` or `>= 0.15.2`PatchesThe issue has been patched in `0.9.10`. All rust based canisters on candid versions `>= 0.9.0` must upgrade their candid versions to `>= 0.9.10` and deploy their canisters to mainnet as soon as possible.WorkaroundsThere is no workaround for canisters using the affected versions of candid other than upgrading to patched version.References[dfinity/candid/pull/478](https://github.com/dfinity/candid/pull/478)[Candid Library Reference](https://internetcomputer.org/docs/current/references/candid-ref)[Candid Specification](https://github.com/dfinity/candid/blob/master/spec/Candid.md)[Internet Computer Specification](https://internetcomputer.org/docs/current/references/ic-interface-spec)
CVSS v3.1: 7.5
CVE-2023-25150: Document content of files can be obtained through Collabora for files of other users
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
CVSS v3.1: 5.8
GHSA-wgwp-547x-6m92: IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253.
CVSS v3.0: 8.8