ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2020-20982: Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.
CVSS v3.1: 9.6
CVSS v2.0: 6.8
GHSA-gj25-4hv6-f978: The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVSS v3.0: 7.8
GHSA-5rjj-25hf-wf28: An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the internal application logs, an attacker can inject wrong IP addresses into these logs.
GHSA-364q-w7vh-vhpc: OliveTin's unsafe parsing of UniqueTrackingId can be used to write files
When the `saveLogs` feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied `UniqueTrackingId` field in the `StartAction` API request. This value is not validated or sanitized before being used in a file path, allowing an attacker to use directory traversal sequences (e.g., `../../../`) to write files to arbitrary locations on the filesystem.Affected Code**Entry point — `service/internal/api/api.go` (line 130):**The `UniqueTrackingId` from the API request is passed directly to the executor without validation:**Tracking ID accepted as-is — `service/internal/executor/executor.go` (lines 508–512):**The tracking ID is only replaced with a UUID if it is empty or a duplicate. Any other string, including one containing path separators, is accepted:**Filename construction — `service/internal/executor/executor.go` (line 1042):**The tracking ID is interpolated directly into the log filename:**File write — `service/internal/executor/executor.go` (lines 1068–1069 and 1082–1083):**The filename is joined to the configured log directory using `path.Join`, which calls `path.Clean` internally. `path.Clean` resolves `..` path segments, causing the final file path to escape the intended directory:Proof of ConceptAn attacker sends the following `StartAction` request (Connect RPC or REST):Assuming the action title is `Ping the Internet` and the timestamp is `1741320000`, the constructed filename becomes:When `path.Join` processes this with a configured results directory like `/var/olivetin/logs`:`path.Clean` resolves the traversal:Path segments: `["var", "olivetin", "logs", "Ping the Internet.1741320000...", "..", "..", "..", "tmp", "pwned.yaml"]`The `..` segments traverse upward past the log directory.Final resolved path: `/tmp/pwned.yaml`Two files are written:**`.yaml` file** — contains YAML-serialized `InternalLogEntry` (action title, icon, timestamps, exit code, output, tags, username, tracking ID)**`.log` file** — contains the raw command output (potentially attacker-influenced if the action echoes its arguments)Impact**Arbitrary file write** to any path writable by the OliveTin process.OliveTin frequently runs as root inside Docker containers, so the writable scope is often the entire filesystem.An attacker could:Overwrite OliveTin's own `sessions.yaml` to inject authenticated sessions.Write to entity file directories to inject malicious entity data.Write to system cron directories or other locations to achieve remote code execution.Cause denial of service by overwriting critical system files.Suggested FixValidate the `UniqueTrackingId` to ensure it only contains safe characters before use. A strict UUID format check is the simplest approach:Alternatively, sanitize the filename in `stepSaveLog` by stripping or rejecting path separators and `..` sequences.
CVSS v3.1: 8.5
CVE-2019-5271: There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud through Wi-Fi, the speaker incorrectly processes some data. Attackers can exploit this vulnerability to read and modify specific configurations of speakers through a series of operations.
CVSS v3.1: 5.4
CVSS v2.0: 4.8
GHSA-xmfv-pp4r-x7rf: Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability.
CVSS v3.1: 5.5
CVE-2023-21621: Adobe FrameMaker Improper Input Validation Remote Code Execution Vulnerability
FrameMaker 2020 Update 4 (and earlier), 2022 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-xp52-49j5-h754: Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
CVSS v3.1: 7.5
GHSA-4jqc-jvh2-pxg9: Path traversal for local publishers in TechDocs backend
ImpactA malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when `techdocs.publisher.type` is set to `local`.This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.PatchesThose affected are advised to upgrade to `@backstage/plugin-techdocs-node` version `1.1.2` or higher.WorkaroundsIf patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing `..`For more informationIf you have any questions or comments about this advisory:Open an issue in the [Backstage repository](https://github.com/backstage/backstage)Visit our chat, linked to in the [Backstage README](https://github.com/backstage/backstage)
GHSA-cqpx-pf6j-rwhj: The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS v3.1: 8.8
GHSA-wxpm-2rxr-g39h: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior)
CVSS v3.1: 5.9
GHSA-4834-vc2f-m7rj: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x) and O(8.x) except exynos9610/9820 in all Platforms, M(6.0) except MSM8909 SC77xx/9830 exynos3470/5420, N(7.0) except MSM8939, N(7.1) except MSM8996 SDM6xx/M6737T software. There is an integer underflow with a resultant buffer overflow in eCryptFS. The Samsung ID is SVE-2017-11857 (September 2018).
CVSS v3.1: 9.8
GHSA-2x2c-w34j-v42x: The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-m7q4-j5c4-6pjq: Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.
CVSS v3.1: 6.1
CVE-2016-4162: Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, and CVE-2016-4163.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2024-36208: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
GHSA-jm56-mq2p-7c4g: In Parse_art of eas_mdls.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote information disclosure in the media extractor with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-150159906
GHSA-6r6j-cgc2-24qw: Out-of-bounds read vulnerability in the register configuration of the DMA module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS v3.1: 6.7
GHSA-hwmp-fjcm-wrhx: debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.
GHSA-qgqh-phj7-7fm4: The igraph_i_strdiff function in igraph_trie.c in igraph through 0.7.1 has an NULL pointer dereference that allows attackers to cause a denial of service (application crash) via a crafted object.
CVSS v3.0: 6.5
CVE-2020-17152: Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2021-31972: Event Tracing for Windows Information Disclosure Vulnerability
Event Tracing for Windows Information Disclosure Vulnerability
CVSS v3.1: 5.5
GHSA-rqxx-q98j-rh75: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the QUOTA_USERS parameter when creating a user quota rule. When a user adds a new user quota rule the application issues an HTTP POST request to /cgi-bin/urlfilter.cgi with the MODE parameter set to USERQUOTA and the assigned user(s) provided in the QUOTA_USERS parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected quota entry.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-ww7g-pffg-wq82: CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to db/MailingList.mdb.
CVE-2022-30816: elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-1485: Real Cookie Banner < 5.1.6 - Admin+ Stored XSS
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 4.8
CVE-2013-1904: Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
CVSS v2.0: 5
CVE-2023-3598: Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
CVE-2014-8128: LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-3xc5-vgfg-rqw3: IPChains in Linux kernels 2.2.10 and earlier does not reassemble IP fragments before checking the header information, which allows a remote attacker to bypass the filtering rules using several fragments with 0 offsets.
CVE-2020-6125: An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS v3.0: 6.4
CVE-2017-9741: install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-8xjr-4p39-wfqw: Unspecified vulnerability in Oracle JD Edwards HTML Server 8.95.F1 SP23_L1 has unspecified impact and attack vectors, as identified by Oracle Vuln# JDE01.
GHSA-4mqr-m9jc-xm98: SQL injection vulnerability in Arki-DB 1.0 and 2.0 allows remote attackers to execute arbitrary SQL commands via the catid parameter in a view action (view.php) to index.php.
CVE-2020-3917: This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to use an SSH client provided by private frameworks.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
GHSA-2268-w43v-j544: Cross-Site Request Forgery (CSRF) in stitionai/devika
CVSS v3.0: 8.8
CVE-2021-36967: Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
CVSS v3.1: 8
CVE-2024-3937: Playlist for Youtube <= 1.32 - Editor+ Stored XSS
The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS v3.1: 4.8
GHSA-4v63-pgpj-7w24: Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.
CVE-2025-14195: code-projects Employee Profile Management System add_file_query.php unrestricted upload
A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-5h25-r5h3-xwpw: A weakness has been identified in Free5GC up to 4.1.0. Affected is the function SessionDeletionResponse of the component SMF. This manipulation causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. It is suggested to install a patch to address this issue.
CVSS v4.0: 5.5
CVSS v3.1: 5.3
CVE-2018-10885: In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster.
CVSS v3.0: 6.5
CVE-2025-31387: WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connect allows PHP Local File Inclusion.This issue affects InstaWP Connect: from n/a through <= 0.1.0.82.
CVSS v3.1: 7.5
GHSA-vgx7-53vc-44m5: A vulnerability was found in code-projects Blood Bank Management 1.0 and classified as critical. This issue affects some unknown processing of the file /file/accept.php. The manipulation of the argument reqid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-287x-6r2h-f9mw: UnoPim vulnerable to CSRF on Product edit feature and creation of other types
SummarySome of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF).
| Method | Endpoint | Status   | Reason |
|:------:|:------:|:------:|:------:|
| POST | /admin/catalog/products/create | Not Vulnerable :white_check_mark: | `X-XSRF-TOKEN` header used |
| GET | /admin/catalog/products/copy/{id}| Vulnerable :x: | Missing `X-XSRF-TOKEN` header or similar protection |
| POST | /admin/catalog/products/edit/{id}| Vulnerable :x: | Missing `X-XSRF-TOKEN` header or similar protection |
| POST | /admin/settings/users/create | Not Vulnerable :white_check_mark: | `X-XSRF-TOKEN` header used |The below are some of the vulnerable endpoints that allow state changing actions including but not limited to:DetailsCSRF attack happens when you visit an attacker controlled website which sends a cross origin request to vulnerable application in order to perform a state changing operation like edit the price of a product without the intention of victim.
In this case, the POST request doesn't need any special headers ( X-XSRF-TOKEN header missing ) and the content-type is either `application/x-www-form-urlencoded` or `multipart/form-data` so we can say this is a `Simple request` ( doesn't need preflight request ).  The cookies are send because `samesite` is set to `None`. We have every ingredients for a successful CSRF attack.PoCPOC Video link: https://drive.proton.me/urls/VXNDKQ4WKR#LpvE777hl8OJ`csrf-poc.html`:ImpactAttacker can perform action on behalf of the victim as this happens on the victim's browser provide the victim is already authenticated to the application.
Attacker can use an image tag to send the GET request such that when the page is loaded, it'll get executed.
As shown in the video POC, the product information can be tampered, create new categories etc.Remediation:Use CSRF token for every state changing request.Use samesite: lax or strict, now it is set 'None'. Make sure all state changing requests are done using POST instead of GET. Noticed that for product copy feature, GET is used which means Samesite:strict needs to be set in that case. Otherwise Samesite: lax should suffice.
CVSS v4.0: 6.9
GHSA-g485-x4m8-3jwm: In libAACdec, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112661893
GHSA-hm98-22vr-c62v: Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
CVSS v4.0: 5.1
CVSS v3.1: 4.8
CVE-2023-6895: Hikvision Intercom Broadcasting System ping.php os command injection
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 5.8
CVE-2023-0848: Netgear WNDR3700v2 Web Management Interface denial of service
A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221147.
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2016-10252: Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to trigger memory consumption.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
CVE-2008-0367: Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.
CVSS v2.0: 5
CVE-2006-6925: Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
CVSS v2.0: 6.8
CVE-2019-0775: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0702, CVE-2019-0755, CVE-2019-0767, CVE-2019-0782.
CVSS v3.0: 4.7
CVSS v2.0: 1.9
CVE-2026-53864: OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables
OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.
CVSS v4.0: 7.6
CVSS v3.1: 8.1
CVE-2023-41965: Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information
Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.
CVSS v3.1: 7.5
CVE-2021-46368: TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileges.
CVSS v3.1: 7.8
CVSS v2.0: 4.6
GHSA-2fjm-qc6m-8q8h: Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP.
CVSS v3.1: 6.2
CVE-2021-36132: An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variable, it might not validate all appropriate user rights, thus allowing a user with insufficient rights to perform operations (specifically file uploads) that they should not be allowed to perform.
CVSS v3.1: 8.8
CVSS v2.0: 6
CVE-2006-1437: UPOINT @1 Event Publisher stores sensitive information under the web document root with insufifcient access control, which allows remote attackers to read private comments via a direct request to eventpublisher.txt.
CVSS v2.0: 5