ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-pj88-9xww-gxmh: Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
SummarySwing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) can browse arbitrary directories on the server filesystem.DetailsThe `@api.post("/dir-browser")` endpoint lacks proper path validation and authorization checks:**No authorization requirement**: Any authenticated user can access the endpoint**Improper path handling**: The code attempts to prepend "/" to non-existent paths but this doesn't prevent traversal:PoCCreate a non-admin userAuthenticate as a non-admin userSend the following request:The response will list directories from `/proc/self` instead of restricting to user-accessible paths:Impact**Information Disclosure:**Server filesystem structure and layoutConfiguration file locations and namesUser account names from directory listingsSoftware versions and installed packagesLog file locations and system paths**Additional Risks:**Preparation for further attacks (LFI, RCE)Bypass of access control mechanismsExposure of sensitive directory structures
CVSS v4.0: 5.3
GHSA-xhp8-fw7x-gxph: Cross-site scripting (XSS) vulnerability in index.html in IceWarp WebMail 5.5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter.
CVE-2023-39349: Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
CVSS v3.1: 8.1
CVE-2022-26522: The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xc4a3.
CVSS v3.1: 7.8
GHSA-jc9r-j5j5-r5w9: Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
CVSS v3.1: 4.3
GHSA-88pj-43x4-vj4q: njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.
CVSS v3.1: 5.5
GHSA-pvch-8324-7772: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).  Supported versions that are affected are Prior to 6.1.44 and  Prior to 7.0.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as  unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS v3.1: 3.6
GHSA-xgx6-92f3-rhqf: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through <= 8.7.0.
CVSS v3.1: 7.5
GHSA-gwv6-pq6m-p3rq: SGLanG: Multimodal scheduler deserializes untrusted pickle data on 0.0.0.0 ROUTER socket
SGLang's multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the internet.
CVSS v3.1: 9.8
GHSA-vv4v-mwp2-jr4q: Missing Authorization vulnerability in Codexpert, Inc CoDesigner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CoDesigner: from n/a through 4.25.2.
CVSS v3.1: 4.3
GHSA-c8rc-rxc2-r2r2: Acrobat Reader DC version 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
CVE-2000-0443: The web interface server in HP Web JetAdmin 5.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack.
CVSS v2.0: 7.5
GHSA-962j-gjgv-9xmr: WorkSimple 1.2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for data/usr.txt.
GHSA-5528-5vmv-3xc2: Multer Vulnerable to Denial of Service via Uncontrolled Recursion
ImpactA vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.PatchesUsers should upgrade to `2.1.1`WorkaroundsNoneResourceshttps://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2https://www.cve.org/CVERecord?id=CVE-2026-3520https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752https://cna.openjsf.org/security-advisories.html
CVSS v4.0: 8.7
GHSA-9pgw-3rfw-wgqj: A Missing Release of Memory after Effective Lifetime vulnerability in the Flow Processing Daemon (flowd) of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). In an IPsec VPN environment, a memory leak will be seen if a DH or ECDH group is configured. Eventually the flowd process will crash and restart. This issue affects Juniper Networks Junos OS on SRX Series: All versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S8, 19.4R3-S10; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2.
CVSS v3.1: 7.5
GHSA-gx78-xfgv-xgx7: An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
CVSS v3.1: 7.5
CVE-2022-2566: Heap-memory write in FFMPEG
A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc->ctts_data[i].count` to `sc->sample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05
CVSS v3.1: 9
RHSA-2021:0700: Red Hat Security Advisory: grub2 security update
grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled grub2: Use-after-free in rmmod command grub2: Out-of-bounds write in grub_usb_device_initialize() grub2: Stack buffer overflow in grub_parser_split_cmdline() grub2: cutmem command allows privileged user to remove memory regions when Secure Boot is enabled grub2: Heap out-of-bounds write in short form option parser grub2: Heap out-of-bounds write due to miscalculation of space required for quoting
CVSS v3.1: 7.5
CVE-2022-2309: NULL Pointer Dereference in lxml/lxml
NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
CVSS v3.0: 5.3
GHSA-r54v-c2hx-5x23: Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low)
CVSS v3.1: 4.3
CVE-2006-3107: Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in (1) GLOBALS[where_framework] to (a) admin/modules/news/news_class.php and (b) admin/modules/content/content_class.php, and (2) GLOBALS[where_cms] to (c) admin/modules/block_media/util.media.php.  NOTE: this issue might be resultant from a global overwrite vulnerability.  This issue is similar to CVE-2006-2576, but the vectors are different.
CVSS v2.0: 5.1
GHSA-jwgc-gq99-q68c: Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents, and thereby execute arbitrary code, via crafted JavaScript, related to a "design issue."
GHSA-5cx3-52rw-f37w: SQL injection vulnerability in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to blog.php.
CVE-2025-69001: WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects FluentForm: from n/a through <= 6.1.11.
CVSS v3.1: 5.3
GHSA-pprf-mh8g-67wh: The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: A partial fix for the issue was introduced in version 10.0.1, and an additional patch (version 10.0.2) was released to address a workaround.
CVSS v3.1: 5.4
CVE-2025-4842: D-Link DCS-932L ucp isUCPCameraNameChanged stack-based overflow
A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. This vulnerability affects the function isUCPCameraNameChanged of the file /sbin/ucp. The manipulation of the argument CameraName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2023-2417: ks-soft Advanced Host Monitor rma_active.exe unquoted search path
A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability.
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 4.3
CVE-2023-42573: PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data.
CVSS v3.1: 4.7
CVE-2024-24780: Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.4.

Users are recommended to upgrade to version 1.3.4, which fixes the issue.
CVSS v3.1: 9.8
GHSA-v97q-699f-9m4x: In imgsys, there is a possible memory corruption due to improper locking. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10363254; Issue ID: MSV-5617.
CVSS v3.1: 5.5
GHSA-jrfh-w785-mgxc: Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from a user's local files via a crafted HTML page.
CVSS v3.1: 6.5
CVE-2017-1000176: In SWFTools, a memcpy buffer overflow was found in swfc.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
GHSA-63c4-4xxp-x2q7: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS v3.1: 6.5
CVE-2025-1020: Memory safety bugs fixed in Firefox 135 and Thunderbird 135
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVSS v3.1: 9.8
CVE-2022-31386: A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter.
CVSS v3.1: 9.1
CVSS v2.0: 6.4
CVE-2017-17593: Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2024-6022: ContentLock <= 1.0.3 - Settings Update via CSRF
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS v3.1: 8.8
CVE-2022-23169: Amodat - Mobile Application Gateway SQL Injection (SQLi)
attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel.
CVSS v3.1: 5.9
CVE-2017-16787: The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2021-47921: Free Photo & Video Vault 0.0.2 Directory Traversal Vulnerability via Web Request
Free Photo & Video Vault 0.0.2 contains a directory traversal web vulnerability that allows remote attackers to manipulate application path requests and access sensitive system files. Attackers can exploit the vulnerability without privileges to retrieve environment variables and access unauthorized system paths.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
GHSA-gmpx-hjjv-xj6f: In the Linux kernel, the following vulnerability has been resolved:tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leakIn crb_acpi_add(), we get the TPM2 table to retrieve information
like start method, and then assign them to the priv data, so the
TPM2 table is not used after the init, should be freed, call
acpi_put_table() to fix the memory leak.
CVSS v3.1: 5.5
RHSA-2024:0113: Red Hat Security Advisory: kernel security update
kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c kernel: UAF during login when accessing the shost ipaddress kernel: use after free in unix_stream_sendpage kernel: vmwgfx: reference count issue leads to use-after-free in surface handling amd: Return Address Predictor vulnerability leading to information disclosure kernel: netfilter: potential slab-out-of-bound access due to integer underflow
CVSS v3.1: 7
CVE-2019-0762: A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins, aka 'Microsoft Browsers Security Feature Bypass Vulnerability'.
CVSS v3.0: 4.3
CVSS v2.0: 4.3
GHSA-hr9f-jjcw-jcr8: Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution and Elevation of privileges.
CVSS v3.1: 7.8
GHSA-248c-9vj8-9325: Unspecified vulnerability in DCE in HP HP-UX B.11.11, B.11.23, and B.11.31 allows remote attackers to cause a denial of service via unknown vectors.
GHSA-7cgf-2cw6-4pvm: A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().
CVSS v3.1: 7.8
CVE-2025-50690: A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit 2120adfa17ddd535bd0f539e6c4988fa3a2cb491). The vulnerability is caused by improper handling of user input in the search query parameter. An attacker can craft a specially formed URL with malicious JavaScript code, which is then reflected back and executed in the victim's browser. This flaw allows an attacker to execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, phishing attacks, data theft, or redirection to malicious sites. The issue is exposed on publicly accessible pages, making it exploitable by an unauthenticated attacker.
CVSS v3.1: 6.1
RHSA-2022:1021: Red Hat Security Advisory: OpenShift Container Platform 4.9.26 security update
haproxy: Denial of service via set-cookie2 header workflow-cps: OS command execution through crafted SCM contents workflow-cps-global-lib: OS command execution through crafted SCM contents workflow-multibranch: OS command execution through crafted SCM contents workflow-cps: Pipeline-related plugins follow symbolic links or do not limit path names workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names workflow-multibranch: Pipeline-related plugins follow symbolic links or do not limit path names workflow-cps: Password parameters are included from the original build in replayed builds workflow-cps-global-lib: Sandbox bypass vulnerability workflow-cps-global-lib: Sandbox bypass vulnerability workflow-cps-global-lib: Sandbox bypass vulnerability pipeline-build-step: Password parameter default values exposed
CVSS v3.1: 6.5
CVE-2016-0901: Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-0900.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2025-5721: SourceCodester Student Result Management System Profile Setting Page update_profile cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /script/academic/core/update_profile of the component Profile Setting Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
CVE-2026-8940: WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update
The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the top-level included script in msp-options.php. This makes it possible for unauthenticated attackers to change the plugin's msp_loop_file and msp_nav_location settings via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2022-28678: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.2.1.53537. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16805.
CVSS v3.0: 7.8
CVE-2024-2949: Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode'
The Carousel, Slider, Gallery by WP Carousel – Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the carousel widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2022-4467: Search & Filter < 1.2.16 - Contributor+ Stored XSS
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVSS v3.1: 5.4
CVE-2022-36069: Poetry Argument Injection vulnerability can lead to local Code Execution
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When building the commands, Poetry correctly avoids Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. If a developer is exploited, the attacker could steal credentials or persist their access. If the exploit happens on a server, the attackers could use their access to attack other internal systems. Since this vulnerability requires a fair amount of user interaction, it is not as dangerous as a remotely exploitable one. However, it still puts developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by vetting any Git or Poetry config files that might be present in the directory. Versions 1.1.9 and 1.2.0b1 contain patches for this issue.
CVSS v3.1: 7.3