ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-jpph-v56f-mxcx: The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_bookmark() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter bookmark statuses.
CVSS v3.1: 4.3
GHSA-36w8-9295-q45v: Multiple cross-site request forgery (CSRF) vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for (1) hidden form elements or (2) status messages via unspecified vectors, related to "report administration."
CVE-2025-10797: code-projects Hostel Management System index.php sql injection
A vulnerability was determined in code-projects Hostel Management System 1.0. This issue affects some unknown processing of the file /justines/index.php. This manipulation of the argument log_email causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-gh2c-mj24-72g9: Unspecified vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.0.0 through 2.52, 7.50, and 7.51 on Windows allows remote attackers to access DDMI agents via unknown vectors.
GHSA-p5xp-6894-jmvx: Possible buffer overflow due to lack of input IB amount validation while processing the user command in Snapdragon Auto
CVSS v3.1: 7.8
CVE-2026-49288: Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified. This has been fixed in 5.73.23 and 6.20.0.
CVSS v3.1: 4.3
CVE-2025-15550: birkir prime <= 0.4.0.beta.0 - Cross-Site Request Forgery in GraphQL
birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query requests. Attackers can craft malicious GET requests to trigger unauthorized actions against privileged users by manipulating GraphQL query parameters.
CVSS v4.0: 5.1
CVSS v3.1: 5.3
GHSA-vx84-5fhg-pf9v: xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
CVSS v3.0: 6.5
CVE-2006-0072: Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument.  NOTE: this is probably a different vulnerability than CVE-2005-0351 since it involves a distinct attack vector.
CVSS v2.0: 7.5
CVE-2017-1002004: Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-hc9q-4g3h-9577: Windows Hyper-V Denial of Service Vulnerability
CVSS v3.1: 6.5
GHSA-vxq2-p937-3px3: Pinned entity creation form shows wrong data
ImpactLogged in user can access page state data of pinned pages of other users by pageId hash.Patch
CVSS v3.1: 4.3
CVE-2020-4430: IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.
CVSS v3.0: 4.3
RHSA-2025:11679: Red Hat Security Advisory: OpenShift Container Platform 4.18.21 security and extras update
github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog
CVSS v3.0: 7.1
CVE-2021-22364: There is a denial of service vulnerability in the versions 10.1.0.126(C00E125R5P3) of HUAWEI Mate 30 and 10.1.0.152(C00E136R7P2) of HUAWEI Mate 30 (5G) . A module does not verify certain parameters sufficiently and it leads to some exceptions. Successful exploit could cause a denial of service condition.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2023-31925: Storage of clear text password in Brocade SANnav
Brocade
 SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords
 in plaintext. A privileged user could retrieve these credentials with 
knowledge and access to these log files. SNMP 
credentials could be seen in SANnav SupportSave if the capture is 
performed after an SNMP configuration failure causes an SNMP 
communication log dump.



CVSS v3.1: 5.4
GHSA-2hxf-jmpm-jxjc: Server-Side Request Forgery (SSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.
CVSS v3.1: 7.2
CVE-2018-16186: RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) uses hard-coded credentials, which may allow an attacker on the same network segments to login to the administrators settings screen and change the configuration.
CVSS v3.0: 8.8
CVSS v2.0: 8.3
CVE-2020-9815: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2015-6008: install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-2015-7381.
CVSS v2.0: 7.5
GHSA-39cv-hx7c-vjcq: In the Linux kernel, the following vulnerability has been resolved:net_sched: sch_sfq: move the limit validationIt is not sufficient to directly validate the limit on the data that
the user passes as it can be updated based on how the other parameters
are changed.Move the check at the end of the configuration update process to also
catch scenarios where the limit is indirectly updated, for example
with the following configurations:tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 depth 1
tc qdisc add dev dummy0 handle 1: root sfq limit 2 flows 1 divisor 1This fixes the following syzkaller reported crash:------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:203:6
index 65535 is out of range for type 'struct sfq_head[128]'
CPU: 1 UID: 0 PID: 3037 Comm: syz.2.16 Not tainted 6.14.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x201/0x300 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_out_of_bounds+0xf5/0x120 lib/ubsan.c:429
 sfq_link net/sched/sch_sfq.c:203 [inline]
 sfq_dec+0x53c/0x610 net/sched/sch_sfq.c:231
 sfq_dequeue+0x34e/0x8c0 net/sched/sch_sfq.c:493
 sfq_reset+0x17/0x60 net/sched/sch_sfq.c:518
 qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035
 tbf_reset+0x41/0x110 net/sched/sch_tbf.c:339
 qdisc_reset+0x12e/0x600 net/sched/sch_generic.c:1035
 dev_reset_queue+0x100/0x1b0 net/sched/sch_generic.c:1311
 netdev_for_each_tx_queue include/linux/netdevice.h:2590 [inline]
 dev_deactivate_many+0x7e5/0xe70 net/sched/sch_generic.c:1375
CVSS v3.1: 7.8
GHSA-9rg4-33x9-wfrh: The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.
CVSS v3.1: 6.7
GHSA-cp3q-q6mx-w79j: External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could exploit this weakness to discover the existence of restricted network infrastructure and service availability. Improvements were made to include deny-lists not only during the check of the provided connection data, but also during use. No publicly available exploits are known.
CVSS v3.1: 4.3
CVE-2023-21541: Windows Task Scheduler Elevation of Privilege Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2022-28886: Denial-of-Service (DoS) Vulnerability
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine
CVSS v3.1: 4.3
GHSA-785g-rp7v-287f: jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
CVSS v3.1: 7.2
CVE-2019-20472: An issue was discovered on One2Track 2019-12-08 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device simply produces a "Remove PIN and restart!" message, and cannot be used. This makes it easier for an attacker to use the SIM card by stealing the device.
CVSS v3.1: 6.2
GHSA-pm8c-3qq3-72w7: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Summary`CurrentUser::setTokenData()` in `phpmyfaq/src/phpMyFAQ/User/CurrentUser.php` at lines 515-534 builds a SQL UPDATE statement with `sprintf` and interpolates OAuth token fields (`refresh_token`, `access_token`, `code_verifier`, and `json_encode($token['jwt'])`) without calling `$db->escape()`. Sibling methods `setAuthSource()` and `setRememberMe()` in the same file do call `$db->escape()` on user-controlled values, so the omission is local to this method. An attacker (Bob) whose Azure AD display name contains a single quote (for example `O'Brien`, or a deliberate SQL payload) breaks out of the string literal and injects arbitrary SQL against the phpMyFAQ database.Details**Vulnerable code** (`phpmyfaq/src/phpMyFAQ/User/CurrentUser.php`, lines 513-534):`json_encode()` does NOT escape single quotes. A JWT claim such as `{"preferred_username": "O'Malley"}` produces `{"preferred_username":"O'Malley"}` after `json_encode`, which terminates the SQL string literal at the apostrophe.**Correct pattern in the same file** (`setAuthSource`, line 458-461):`setRememberMe()` (line 471-478) follows the same safe pattern with `$db->escape()`.**Reachability**: The phpMyFAQ Azure AD (Entra ID) OAuth flow calls `setTokenData()` after token exchange. The token response includes an `id_token` whose payload originates from the identity provider. An attacker registers a Microsoft account with a display name or custom claim containing SQL metacharacters. When that user logs into a phpMyFAQ instance with Azure AD auth enabled, the malicious claim flows into the UPDATE without sanitization.Proof of ConceptPrerequisites: phpMyFAQ instance with Azure AD / Entra ID authentication enabled.Bob registers an Azure AD account with display name `x]","email":"x',(SELECT SLEEP(5)))-- -`.Bob initiates the OAuth login flow on the target phpMyFAQ.After authorization, the token endpoint returns a JWT with the crafted claim.phpMyFAQ calls `setTokenData()` with the unsanitized token array. The resulting SQL becomes:The single quote after `x` closes the `jwt` string literal. Everything after it executes as attacker-controlled SQL.To confirm time-based blind injection locally (requires modifying the OAuth token response in a proxy):ImpactAn attacker who can authenticate via Azure AD with a crafted claim achieves arbitrary SQL execution on the phpMyFAQ database. This permits reading all FAQ data (including restricted entries), modifying or deleting content, and extracting password hashes and session tokens of all users including administrators.**CWE**: CWE-89 (SQL Injection)Recommended FixEscape all interpolated values using `$this->configuration->getDb()->escape()`, matching the pattern used by `setAuthSource()` and `setRememberMe()` in the same file:*Found by [aisafe.io](https://aisafe.io)*
CVSS v3.1: 7.5
CVE-2023-22464: ViewVC XSS vulnerability in revision view changed path "copyfrom" locations
ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a Subversion repository exposed by an otherwise trusted ViewVC instance. The attack vector involves files with unsafe names (names that, when embedded into an HTML stream, would cause the browser to run unwanted code), which themselves can be challenging to create. Users should update to at least version 1.2.3 (if they are using a 1.2.x version of ViewVC) or 1.1.30 (if they are using a 1.1.x version).

ViewVC 1.0.x is no longer supported, so users of that release lineage should implement one of the following workarounds. Users can edit their ViewVC EZT view templates to manually HTML-escape changed path "copyfrom paths" during rendering. Locate in your template set's `revision.ezt` file references to those changed paths, and wrap them with `[format "html"]` and `[end]`.  For most users, that means that references to `[changes.copy_path]` will become `[format "html"][changes.copy_path][end]`. (This workaround should be reverted after upgrading to a patched version of ViewVC, else "copyfrom path" names will be doubly escaped.)

CVSS v3.1: 5.4
CVE-2023-28147: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r29p0 through r32p0, Bifrost r17p0 through r42p0 before r43p0, Valhall r19p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0.
CVSS v3.1: 5.5
GHSA-vv9m-2w98-m7rf: Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."
GHSA-c5q7-3pcx-j4qr: Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields.
CVE-2018-5488: NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2025-62711: Wasmtime vulnerable to segfault when using component resources
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched to fix this issue. There are no workarounds.
CVSS v4.0: 2.1
CVE-2025-43551: Substance3D - Stager | Out-of-bounds Read (CWE-125)
Substance3D - Stager versions 3.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-g6wm-2v64-wq36: LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
DescriptionThe LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare an external entity that references an internal URL, which the server will then attempt to fetch when parsing the XML.The vulnerability specifically occurs in the location constraint processing, where the XML parser resolves external entities without proper validation or restrictions. When the external entity is resolved, the server makes an HTTP request to the specified URL and includes the response content in the parsed XML document.This vulnerability can be exploited to perform server-side request forgery (SSRF) attacks, allowing an attacker to make requests to internal services or resources that should not be accessible from external networks. The server will include the responses from these internal requests in the resulting bucket configuration, effectively leaking sensitive information.Steps to ReproduceCreate an XML document that includes an external entity declaration pointing to the internal target:Send a PUT request to create a new bucket with this configuration:Retrieve the bucket location to see the resolved entity content:When these steps are executed, the server processes the XML, resolves the external entity by making a request to the internal URL, and includes the response in the bucket's location constraint. The attacker can then retrieve this information through the bucket location endpoint.MitigationsDisable XML external entity resolution in the XML parser configuration. Most XML parsers have options to disable external entity processing.Implement proper input validation for XML documents, rejecting those that contain DOCTYPE declarations or external entity references.Use XML parsers that are configured securely by default and don't process external entities.If external entity processing is required, implement a whitelist of allowed URLs and validate all URLs before making any requests.ImpactThe vulnerability allows unauthenticated attackers to make the server perform HTTP requests to internal networks and services, potentially exposing sensitive information or enabling further attacks against internal systems. The attacker only needs to be able to send HTTP requests to the LocalS3 service to exploit this vulnerability.
CVSS v4.0: 5.5
GHSA-wvx7-72hc-rp32: Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-534c-hcr7-67jg: Kimai has an XXE Leading to Local File Read
SummaryKimai uses [PHPSpreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) for importing and exporting invoices. Recently, a [CVE](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7) was identified in PHPSpreadsheet, which could lead to an XXE vulnerability.DetailsExploitation requires an Administrator account, allowing the upload of an `XLSX` template containing the payload. The vulnerability is triggered by the following code snippet:The `IOFactory::load` function utilizes `simplexml_load_string`, which has previously been demonstrated to be vulnerable to XXE attacks.While this is not directly an XXE in Kimai, it does however impact the latest stable version.PoCBy uploading a malicious `XLSX` template, the payload will be triggered every time an invoice is generated.For a better a visibility, I will upload both a:Malicious template sample for testingAn exported invoice, showing the contents of target file during the export.ImpactLocal File Read / RCE in edge cases where `phar://` can be utilized with [gadget chains](https://github.com/ambionics/phpggc) .[export.xlsx](https://github.com/user-attachments/files/16803913/export.xlsx)
[sample_template.xlsx](https://github.com/user-attachments/files/16803916/sample_template.xlsx)
CVSS v4.0: 8.5
CVSS v3.1: 6.5
GHSA-fj7x-9fvg-hw4w: AV1 Video Extension Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-30167.
CVSS v3.1: 7.8
CVE-2019-0839: An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0838.
CVSS v3.0: 4.4
CVSS v2.0: 2.1
GHSA-j285-83fw-r98g: subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.
CVSS v3.0: 9.8
CVE-2007-3566: Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.
CVSS v2.0: 7.5
GHSA-g9vw-6pvx-7gmw: Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults
SummaryA use-after-free (UAF) vulnerability in Envoy's DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.DetailsThe vulnerability exists in Envoy's Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:Dynamic Forwarding Filter is enabled.`envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled.The Host header is modified between the Dynamic Forwarding Filter and Router filters.ImpactDenial of service due to abnormal process termination.Attack vector(s)Request to Envoy configured as indicated above.PatchesUsers should upgrade to v1.35.1 or v1.34.5.WorkaroundSet the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag to `false`.DetectionAbnormal process termination with the `Envoy::Event::DispatcherImpl::runPostCallbacks()` frame in the call stack.CreditsRohit Agrawal ([agrawroh](https://github.com/agrawroh)) ([rohit.agrawal@databricks.com](mailto:rohit.agrawal@databricks.com))
CVSS v3.1: 7.5
RHSA-2024:10178: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.6 Update
org.keycloak/keycloak-quarkus-server: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability keycloak-core: mTLS passthrough org.keycloak:keycloak-services: Keycloak Denial of Service org.keycloak:keycloak-quarkus-server: Sensitive Data Exposure in Keycloak Build Process keycloak-quarkus-server: Keycloak path trasversal
CVSS v3.1: 5.9
CVSS v3.0: 2.7
CVE-2024-37859: Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php.
CVSS v3.1: 6.1
CVE-2023-26570: Missing Authentication In IDAttend’s IDWeb Application
Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers.
CVSS v3.1: 7.5
GHSA-4r36-c55m-fp5v: The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to cause a denial of service (hang or crash) via invalid field length values in a malformed (1) document or (2) request.
CVE-2016-6802: Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2021-23846: B426 Credential Disclosure
When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. This will be fixed starting from Firmware version 3.11.5, which will be released on the 30th of June, 2021.
CVSS v3.1: 8.8