ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-fqcv-8859-86x2: CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier
SQL Injection in CustomerTransformerControllerSummaryAn **error-based SQL Injection vulnerability** was identified in the `CustomerTransformerController` within the CoreShop admin panel.  
The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.This issue is classified as **MEDIUM severity**, as it allows SQL execution in an authenticated admin context.DetailsThe vulnerability exists in the company name duplication check endpoint:Source code analysis indicates that user input is directly embedded into a SQL condition without parameterization.**Vulnerable file:****Vulnerable code pattern:**The `$value` parameter is fully user-controlled and is not escaped or bound as a prepared statement parameter.  
Supplying a double quote (`"`) causes a SQL syntax error, confirming that the input is executed in a SQL context.Exploitation Steps:PrerequisitesAdmin panel access at `https://demo4.coreshop.org/admin`Default credentials: `admin / coreshop`Authenticate to admin panelTrigger SQL error to confirm injection**Expected result:** HTTP 500 error page with title "500 | CORS - Pimcore Digital Agency"**Normal response (non-error):**Proof of Impact:**Test 1 - Normal query:****Test 2 - SQL injection (error-inducing):**The double quote character causes a SQL syntax error, confirming the injection point. The application returns a 500 error instead of the normal JSON response, proving that unescaped user input reaches the SQL query.**Sqlmap Result:**Impact**Vulnerability type:** SQL Injection (Error-based)**Affected users:** CoreShop / Pimcore admin users**Potential impact:**Database error disclosureDatabase schema enumerationPossible data extraction via error-based or blind SQL injectionRecommended Fix1. Use Parameterized Queries (Required)Avoid building SQL conditions using string concatenation or `sprintf`.  
Use Doctrine QueryBuilder parameters instead.**❌ Vulnerable example:****✅ Secure example (Doctrine QueryBuilder):**This ensures proper escaping and prevents SQL injection.2. Validate User Input (Defense-in-Depth)Apply strict input validation before processing user data:Optionally, restrict allowed characters if business logic permits.3. Handle Errors GracefullyAvoid returning raw 500 error pages to users.  
Catch database exceptions and return a controlled JSON error response instead:4. Security Best PracticeNever interpolate user input directly into SQL stringsAlways use prepared statements or ORM parameter bindingEnsure consistent input validation on all admin endpoints
CVSS v4.0: 6.9
GHSA-2jhp-cv29-xgm3: Adobe Substance 3D Painter versions 8.3.0 (and earlier) is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2025-69181: WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.4.
CVSS v3.1: 7.3
GHSA-68xj-rhqv-3cc9: DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
CVSS v3.0: 7.8
CVE-2024-25910: WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.
CVSS v3.1: 9.8
CVE-2024-49833: Improper Validation of Array Index in Camera
Memory corruption can occur in the camera when an invalid CID is used.
CVSS v3.1: 7.8
GHSA-4h4r-fq63-x6jc: PHP remote file inclusion vulnerability in include/default_header.php in Cyboards PHP Lite 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the script_path parameter, a different vector than CVE-2006-2871.
CVE-2013-7202: The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
GHSA-xhmx-2vhp-f3pq: In USB driver, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216825460References: Upstream kernel
CVSS v3.1: 5.5
CVE-2025-5662: Deserialization Vulnerability in h2oai/h2o-3
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
CVSS v3.0: 9.8
CVE-2008-3856: The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors.
CVSS v2.0: 7.5
GHSA-j86v-2vjr-fg8f: Etcd Gateway TLS endpoint validation only confirms TCP reachability
Vulnerability typeCryptographyWorkaroundsRefer to the [gateway documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md). The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation.DetailSecure endpoint validation is performed by the etcd gateway start command when the --discovery-srv flag is enabled. However, as currently implemented, it only validates TCP reachability, effectively allowing connections to an endpoint that doesn't accept TLS connections through the HTTPS URL. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.ReferencesFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)For more informationIf you have any questions or comments about this advisory:Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)
CVE-2025-15547: Jail escape by a privileged user via nullfs
By default, jailed processes cannot mount filesystems, including nullfs(4).  However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks.

If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic allows that user to escape the jail's chroot, yielding access to the full filesystem of the host or parent jail.

In a jail configured to allow nullfs(4) mounts from within the jail, the jailed root user can escape the jail's filesystem root.
CVSS v3.1: 8.8
GHSA-8mf8-w2qh-4v4g: The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, allows remote attackers to cause a denial of service (crash) via crafted packets.
CVSS v3.0: 7.5
GHSA-r35v-g664-x496: Multiple SQL injection vulnerabilities in ProjectBB 0.4.5.1 allow remote attackers to execute arbitrary SQL commands via (1) liste or (2) desc parameters to divers.php (incorrectly referred to as "drivers.php" by some sources), (3) the search feature text area, (4) post name in the post creation feature, (5) City, (6) Homepage, (7) ICQ, (8) AOL, (9) Yahoo!, (10) MSN, or (11) e-mail fields in the profile feature or (12) the new field in the moderator section.
CVE-2024-39545: Junos OS: SRX Series, MX Series with SPC3 and NFX350: When VPN tunnels parameters are not configured in specific way the iked process will crash
An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with SPC3 and NFX350 allows allows an unauthenticated, network-based attacker sending specific mismatching parameters as part of the IPsec negotiation to trigger an iked crash leading to Denial of Service (DoS).

This issue is applicable to all platforms that run iked. This issue affects Junos OS on SRX Series, MX Series with SPC3 and NFX350: 



  *  All versions before 21.2R3-S8, 
  *  from 21.4 before 21.4R3-S7, 
  *  from 22.1 before 22.1R3-S2, 
  *  from 22.2 before 22.2R3-S1, 
  *  from 22.3 before 22.3R2-S1, 22.3R3, 
  *  from 22.4 before 22.4R1-S2, 22.4R2, 22.4R3.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-rxh7-5674-97hm: ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Course Enrolment, Group Membership, Course unenrolment, Course Enrolment List Search, Glossary, Social Group Member Search, Social Friend Search, Social Group Search, File Comment, Gradebook Test Title, User Group Membership, Inbox/Sent Items, Sent Messages, Links, Photo Album, Poll, Social Application, Social Profile, Test, Content Menu, Auto-Login, and Gradebook components resulting in information disclosure, database modification, or potential code execution.
CVSS v3.0: 9.8
GHSA-fxr5-7g6j-cj5f: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that
allows remote code execution via the “hostname” parameter when maliciously crafted hostname
syntax is entered.Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)
CVSS v3.1: 7.2
CVE-2005-0792: SQL injection vulnerability in ZPanel 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) uname parameter to index.php or (2) page parameter to zpanel.php.
CVSS v2.0: 7.5
CVE-2021-1693: Windows CSC Service Elevation of Privilege Vulnerability
Windows CSC Service Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
GHSA-fmw9-294f-f3m2: Multiple SQL injection vulnerabilities in MYRE Vacation Rental Software allow remote attackers to execute arbitrary SQL commands via the (1) garage1 or (2) bathrooms1 parameter to vacation/1_mobile/search.php, or (3) unspecified input to vacation/widgate/request_more_information.php.
GHSA-6g97-5mc3-vqqj: Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content.
CVE-2016-5818: An issue was discovered in Schneider Electric PowerLogic PM8ECC device 2.651 and older. Undocumented hard-coded credentials allow access to the device.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2026-34775: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers spawned in frames configured with nodeIntegrationInWorker: false could still receive Node.js integration. Apps are only affected if they enable nodeIntegrationInWorker. Apps that do not use nodeIntegrationInWorker are not affected. This issue has been patched in versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0.
CVSS v3.1: 6.8
RHSA-2022:0431: Red Hat Security Advisory: Red Hat Advanced Cluster Security 3.68 security and enhancement update
golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet
CVSS v3.1: 7.3
CVE-2019-9651: An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the check_bad() function's filtering is not strict, resulting in PHP code execution. This occurs because some dangerous PHP functions (such as "eval") are blocked but others (such as "system") are not, and because ".php" is blocked but ".PHP" is not blocked.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-7p9r-9x76-5h9r: The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.
CVSS v4.0: 10
CVSS v3.1: 10
GHSA-v77x-x335-v6m9: Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
CVE-2024-33867: An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.
CVSS v3.1: 4.8
CVE-2022-22546: Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad) - version 420.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2012-1721: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722.
CVSS v2.0: 10
GHSA-rrmf-fpmm-jpwr: ViMbAdmin CSRF Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators toadd an administrator user via a crafted POST request to `<vimbadmin directory>/application/controllers/DomainController.php`,remove an administrator user via a crafted GET request to `<vimbadmin directory>/application/controllers/DomainController.php`,change an administrator password via a crafted POST request to `<vimbadmin directory>/application/controllers/DomainController.php`,add a mailbox via a crafted POST request to `<vimbadmin directory>/application/controllers/MailboxController.php`,delete a mailbox via a crafted POST request to `<vimbadmin directory>/application/controllers/MailboxController.php`,archive a mailbox address via a crafted GET request to `<vimbadmin directory>/application/controllers/ArchiveController.php`,add an alias address via a crafted POST request to `<vimbadmin directory>/application/controllers/AliasController.php`, orremove an alias address via a crafted GET request to `<vimbadmin directory>/application/controllers/AliasController.php`.
CVSS v3.0: 8.8
GHSA-7chv-rrw6-w6fc: XStream is vulnerable to a Remote Command Execution attack
ImpactThe vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.PatchesIf you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17.WorkaroundsSee [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.ReferencesSee full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-29505](https://x-stream.github.io/CVE-2021-29505.html).CreditsV3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.For more informationIf you have any questions or comments about this advisory:Open an issue in [XStream](https://github.com/x-stream/xstream/issues)Email us at [XStream Google Group](https://groups.google.com/group/xstream-user)
CVSS v3.1: 7.5
CVE-2023-0302: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.
CVSS v3.0: 8.6
GHSA-2ffm-9xhq-mwc8: SpotIE 2.9.5 contains a denial of service vulnerability in the registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
CVSS v4.0: 4.6
CVSS v3.1: 7.5
GHSA-4mm9-fmg4-q68j: A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the web UI of the Self Care Portal. An attacker could exploit this vulnerability by sending crafted HTTP input to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.
CVSS v3.0: 6.8
GHSA-p689-w6mf-2ph7: In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239557547References: N/A
CVSS v3.1: 6.7
CVE-2024-11627: : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
CVSS v3.1: 6.8
CVE-2003-0415: Remote PC Access Server 2.2 allows remote attackers to cause a denial of service (crash) by receiving packets from the server and sending them back to the server.
CVSS v2.0: 5
GHSA-c6pf-2v8j-96mc: Cilium node based network policies may incorrectly allow workload traffic
Impact[Node based network policies](https://docs.cilium.io/en/stable/security/policy/language/#node-based) (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium.PatchesThis issue was fixed by https://github.com/cilium/cilium/pull/36657.This issue affects:Cilium v1.16 between v1.16.0 and v1.16.7 inclusiveCilium v1.17 between v1.17.0 and v1.17.1 inclusiveThis issue is fixed in:Cilium v1.16.8Cilium v1.17.2WorkaroundsUsers can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.AcknowledgementsThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @oblazek  for reporting and fixing this issue.For more informationIf you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority. Please also address any comments or questions on this advisory to the same mailing list.
CVSS v3.1: 3.4
CVE-2021-1709: Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
CVSS v3.1: 7
GHSA-r4f3-r23x-xm4q: Unrestricted Upload of File with Dangerous Type vulnerability in Ben Ritner - Kadence WP Kadence WooCommerce Email Designer allows Upload a Web Shell to a Web Server. This issue affects Kadence WooCommerce Email Designer: from n/a through 1.5.14.
CVSS v3.1: 9.1
CVE-2021-30193: CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2022-45895: Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) and the WhoAmI endpoint (e.g., path disclosure).
CVSS v3.1: 6.5
CVE-2016-3350: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3377.
CVSS v3.0: 7.5
CVSS v2.0: 7.6
GHSA-rr3v-f6qj-vgw6: Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to INFRA, a different vulnerability than CVE-2016-5620.
CVSS v3.0: 8.1
CVE-2008-4497: SQL injection vulnerability in event_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL commands via the event_id parameter.
CVSS v2.0: 7.5
GHSA-rg9h-vx28-xxp5: llama-index has Insecure Temporary File
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
CVSS v3.0: 7.1
CVE-2006-5444: Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow.
CVSS v2.0: 7.5
GHSA-qhrq-52qx-58fx: Deserialization of Untrusted Data vulnerability in Scott Olson My Reading Library allows Object Injection.This issue affects My Reading Library: from n/a through 1.0.
CVSS v3.1: 9.8
CVE-2022-41484: Tenda AC1900 AP500(US)_V1_180320(Beta) was discovered to contain a buffer overflow in the 0x32384 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS v3.1: 7.5
GHSA-768f-hg28-693m: The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
GHSA-wvpg-4wrh-5889: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
ImpactWrong usage of the PHP `array_search()` allows bypass of validation.PatchesThe problem has been patched in versions:v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.Credits[Léo CUNÉAZ](https://github.com/inem0o) reported this issue.
CVSS v3.1: 3.8