ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-rq6g-6g94-jfr4: starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
SummaryPage descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar.DetailsThe descriptions, which are unsanitized, are inserted as raw HTML:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d4dfc3697a82948b3b9c4d44e9a273c79bc86b87/resources/skins.citizen.search/templates/TypeaheadListItem.mustache#L18PoCAll of the reproduction methods require the command palette to be disabled via `$wgCitizenEnableCommandPalette = false;`.
Additionally, the action API must be used as the Search Gateway via  `$wgCitizenSearchGateway = 'mwActionApi';`.TextExtracts as the description sourceEnable the TextExtracts extensionAdd `$wgCitizenSearchDescriptionSource = 'textextracts';` to your LocalSettings.phpCreate a page called `CitizenXSSTextExtracts` and insert `<img src="" onerror="alert('citizen search xss')">` into itOpen the search modal and search for `CitizenXSSTextExtracts`![image](https://github.com/user-attachments/assets/fbc88458-c429-4f08-9376-584b7db93f58)Description2 as the description sourceEnable the Description2 extensionAdd `$wgEnableMetaDescriptionFunctions = true;` to your LocalSettings.php to enable the `{{#description2:}}` parser functionAdd `$wgCitizenSearchDescriptionSource = 'pagedescription';` to your LocalSettings.phpCreate a page called `CitizenXSSDescription2` and insert `{{#description2:<img src="" onerror="alert('citizen search xss 2')">}}` into itOpen the search modal and search for `CitizenXSSDescription2`![image](https://github.com/user-attachments/assets/24513eba-dbec-4bc6-ac06-6276d509fcab)Wikibase as the description sourceNote that this method is currently untested due to issues I experienced when setting up Wikibase.Enable Wikibase client + repo in your wikiAdd `$wgCitizenSearchDescriptionSource = 'wikidata';` to your LocalSettings.phpHave an item with a description like `<img src="" onerror="alert('citizen search xss 3')">`Open the search modal and search for the page linked to the itemShortDescription as the description sourceEnable the ShortDescription extensionAdd `$wgCitizenSearchDescriptionSource = 'wikidata';` to your LocalSettings.phpCreate a page called `CitizenXSSDescription4` and insert `{{SHORTDESC:<img src="" onerror="alert('citizen search xss 4')">}}` into itOpen the search modal and search for `CitizenXSSDescription4`ImpactOn all wikis that use the aforementioned settings (command palette disabled or using an old release where the old search bar is still used; using the action API as the search gateway), anybody who can edit pages is able to insert XSS payloads into the DOM for other users who are searching for specific pages.
CVSS v3.1: 8.6
CVE-2007-4791: Buffer overflow in the swcons command in bos.rte.console in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2005-3504 and CVE-2007-0978.
CVSS v2.0: 7.2
GHSA-788r-28g9-93jm: A Windows NT system does not restrict access to removable media drives such as a floppy disk drive or CDROM drive.
CVE-2008-6827: The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2019-9409: In libhevc there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112272091
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2015-8595: In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in digital television/digital radio DRM.
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-6gv4-7fc8-2gm7: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device.This vulnerability is due to a lack of proper data protection mechanisms for certain configuration settings. An attacker with Read-Only Administrator privileges could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to view device credentials that are normally not visible to Read-Only Administrators.
CVSS v3.1: 6.5
GHSA-5pfc-43r5-qrmg: Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.
CVSS v3.1: 7.5
CVE-2024-31195: Out-of-bounds Read in libfluid_msg library
Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of13::MultipartReplyTable::unpack.

This issue affects libfluid: 0.1.0.
CVSS v3.1: 6.5
GHSA-3qxq-4rfh-fpmx: An attacker can force a printer to print arbitrary documents (e.g. if the printer doesn't require a password) or to become disabled.
GHSA-gqmv-wgq3-w6p3: The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.
CVSS v4.0: 8.6
CVSS v3.1: 9.8
GHSA-wpwc-6mhr-g8mj: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonatan Jumbert WPCode Content Ratio wpcode-content-ratio allows Reflected XSS.This issue affects WPCode Content Ratio: from n/a through <= 2.0.
CVSS v3.1: 6.1
CVE-2014-0673: Multiple cross-site scripting (XSS) vulnerabilities in the web interface on Cisco Video Surveillance 5000 HD IP Dome cameras allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCud10943 and CSCud10950.
CVSS v2.0: 4.3
CVE-2023-41640: An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain sensitive technical information via a crafted SQL query.
CVSS v3.1: 8.8
RHSA-2021:4765: Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.19.0
golang: net/http/httputil: panic due to racy read of persistConn after handler panic
CVSS v3.1: 5.9
CVE-2022-24712: Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.
CVSS v3.1: 6.3
CVE-2025-26395: SolarWinds SWOSH DOM-based reflective XSS Vulnerability
SolarWinds Observability Self-Hosted

 was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack requires authentication using an administrator-level account and user interaction is required.
CVSS v3.1: 7.1
CVE-2006-6380: Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS v2.0: 6.8
CVE-2017-1536: IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0, 8.0, 8.5 and 9.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130733.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
RHSA-2025:1334: Red Hat Security Advisory: ACS 4.5 enhancement and security update
npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html go-git: argument injection via the URL field go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies
CVSS v3.1: 7.5
GHSA-r9c2-72m4-f79p: IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, related to a "User Mode Write AV starting at PDF!xmlGetGlobalState+0x0000000000031abe."
CVSS v3.0: 7.8
CVE-2024-30287: Adobe FrameMaker PDF File Pparsing Out of Bound Read
Adobe Framemaker versions 2020.5, 2022.3 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
cisco-sa-ndfc-shkv-snQJtjrp: Cisco Nexus Dashboard Fabric Controller SSH Host Key Validation Vulnerability
A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices.

This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.1: 8.7
GHSA-8pc8-7phf-384v: A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS v3.0: 8.1
CVE-2018-3693: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.
CVSS v3.1: 5.6
CVSS v2.0: 4.7
CVE-2025-39373: WordPress JNews Theme <= 11.6.16 - Broken Access Control Vulnerability
Missing Authorization vulnerability in jegtheme JNews jnews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JNews: from n/a through <= 11.6.16.
CVSS v3.1: 5.3
GHSA-8vvh-jgp7-wq8g: Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted remote attackers to execute arbitrary code via a crafted .ibkey file containing a long string.
GHSA-fwrv-328x-h2gm: Azure RTOS GUIX Studio Remote Code Execution Vulnerability.
CVSS v3.1: 7.8
GHSA-gwrv-2q33-6vmr: Multi-Tech ProxyServer products MTPSR1-100, MTPSR1-120, MTPSR1-202ST, MTPSR2-201, and MTPSR3-200 ship with a null password, which allows remote attackers to gain administrative privileges via Telnet or HTTP.
GHSA-677g-x5rm-h62c: Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically generating a command to schedule scans for SCCM. This allows an attacker to execute arbitrary commands on the AssetExplorer Server with NT AUTHORITY/SYSTEM privileges.
CVSS v3.1: 7.2
GHSA-q3mq-4fgj-6w9m: Adobe Acrobat and Reader versions 2020.006.20042 and earlier, 2017.011.30166 and earlier, 2017.011.30166 and earlier, and 2015.006.30518 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2013-7063: The Invitation module 7.x-2.x for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive information via unspecified default views.
CVSS v2.0: 5
GHSA-f7wq-7cmj-9wqj: A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router via sending a specially crafted URL to an authenticated victim. The authenticated victim need to visit this URL, for the router to reboot.
CVSS v3.1: 7.4
GHSA-gxp8-hq7m-332h: Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generated Python code, causing Snowflake CLI to execute attacker-controlled code in the local context of the user running the CLI. Successful exploitation requires the victim to run the relevant bundling or deployment workflow against attacker-controlled project content, and any resulting code runs with the privileges of that local execution context. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
CVSS v3.1: 8.8
GHSA-4q7p-q2qv-66rm: Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
CVSS v4.0: 5.1
GHSA-jq8v-rmf6-65jw: Gogs has Stored XSS in `.ipynb` Preview
SummaryAlthough `.ipynb` previews are sanitized on the server side via `/-/api/sanitize_ipynb`, the inserted content is **re-rendered on the client side without sanitization** using `marked()` on elements with the `.nb-markdown-cell` class. During this process, links containing schemes such as `javascript:` can be regenerated.As a result, when a victim views an attacker-crafted `.ipynb` file and clicks the link, **arbitrary JavaScript is executed in the Gogs origin**, leading to a click-based Stored XSS.DetailsAfter the rendered output of a `.ipynb` file is sanitized via `/-/api/sanitize_ipynb` and inserted into the DOM, **only the Markdown cell portions are re-rendered using `marked()` and overwritten in the DOM**. During this process, links with the `javascript:` scheme can be regenerated.`templates/repo/view_file.tmpl:42–71`While **regular HTML pages (including `.ipynb` preview pages)** are served **without a Content Security Policy (CSP)**, CSP headers are applied **only to attachment delivery routes**.`internal/cmd/web.go:323`Steps to ReproduceAs the attacker, add and push/commit a `.ipynb` file containing a `javascript:` link in a Markdown cell to a repository.Example (PoC):The victim opens the file on Gogs (e.g., `/<user>/<repo>/src/<branch>/poc.ipynb`).
<img width="2386" height="1218" alt="image" src="https://github.com/user-attachments/assets/b0d93fd8-c5ca-4058-8af0-98dee590d3ad" />When the victim clicks the `poc` link displayed in the preview, `alert(document.domain)` is executed in the same Gogs origin.
<img width="2390" height="1388" alt="image" src="https://github.com/user-attachments/assets/0eb6ebe8-632c-4a41-8a11-46471514b4c4" />Minimum Required Privileges**Attacker**: Ability to place a `.ipynb` file as a **regular (non-admin) user**For example: a general user who can create a public repository and add files.Or: write access (collaborator, etc.) to an existing repository that the victim will view.**Victim**: Permission to view the repository (a click is required).ImpactUnauthorized actions performed with the victim’s account privileges (e.g., repository settings changes, Issue operations,誘導 to token creation).Theft of information accessible to the victim (repository/Issue/Wiki contents, tokens exposed in page context).If the victim is an administrator, the impact may escalate to instance-wide configuration changes and user management.
CVSS v3.1: 8.9
GHSA-qg2m-m758-mr3c: PHP remote file inclusion vulnerability in index.php in FreeFAQ 1.0.e allows remote attackers to execute arbitrary PHP code via a URL in the faqpath parameter.
CVE-2024-37216: WordPress Sketchfab Embed plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rami Yushuvaev Sketchfab Embed allows Stored XSS.This issue affects Sketchfab Embed: from n/a through 1.5.
CVSS v3.1: 6.5
CVE-2023-3933: Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-36fv-6vjc-jf92: If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.
CVSS v3.1: 6.7
GHSA-xrrh-h86w-pwfj: Alluxio vulnerable to arbitrary code execution
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
CVSS v3.1: 9.8
RHSA-2025:9071: Red Hat Security Advisory: firefox security update
firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content firefox: thunderbird: Potential local code execution in “Copy as cURL” command firefox: thunderbird: Script element events leaked cross-origin resource status firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details firefox: thunderbird: Memory safety bugs firefox: thunderbird: Memory safety bug libvpx: Double-free in libvpx encoder
CVSS v3.1: 8.1
CVE-2020-25250: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client applications can write arbitrary data to the server logs.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2020-1664: Junos OS: Buffer overflow vulnerability in device control daemon
A stack buffer overflow vulnerability in the device control daemon (DCD) on Juniper Networks Junos OS allows a low privilege local user to create a Denial of Service (DoS) against the daemon or execute arbitrary code in the system with root privilege. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.2X75 versions prior to 18.2X75-D53, 18.2X75-D65; 18.3 versions prior to 18.3R2-S4, 18.3R3-S4; 18.4 versions prior to 18.4R2-S5, 18.4R3-S5; 19.1 versions prior to 19.1R3-S3; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2; 20.2 versions prior to 20.2R1-S1, 20.2R2. Versions of Junos OS prior to 17.3 are unaffected by this vulnerability.
CVSS v3.1: 7.8
CVE-2000-0801: Buffer overflow in bdf program in HP-UX 11.00 may allow local users to gain root privileges via a long -t option.
CVSS v2.0: 7.2
GHSA-j986-qw5c-w3jw: A Stored Cross-Site Scripting (XSS) vulnerability was found in /lms/admin/department.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the d and pi parameters in a POST HTTP request.
CVSS v3.1: 5.4
GHSA-6pw8-5p8j-m67x: An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not used.
CVSS v3.1: 6.5
RHSA-2025:4597: Red Hat Security Advisory: mod_auth_openidc:2.3 security update
mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled
CVSS v3.1: 7.5
CVE-2018-1096: An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.
CVSS v3.0: 6.5
CVSS v2.0: 4
GHSA-jr5f-4v8f-4m67: Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an empty database on which they can connect with default credentials.
RHSA-2020:2539: Red Hat Security Advisory: net-snmp security and bug fix update
net-snmp: NULL pointer exception in snmp_oid_compare in snmplib/snmp_api.c resulting in a denial of service
CVSS v3.0: 7.5
GHSA-5xq8-86qp-x5q2: Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.
GHSA-gfh6-3pqw-x2j4: SmallRye Fault Tolerance out-of-memory (OOM) issue
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
CVSS v3.1: 7.5
GHSA-c743-639c-676m: Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
GHSA-x839-gjmw-5j5v: A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.
CVSS v3.0: 6.1
GHSA-5jh7-6r77-pm4f: there is a possible privilege escalation due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-9v72-p5p3-9w65: Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin
jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
CVSS v3.0: 3.7
GHSA-xjvr-8p9x-8pr9: SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.