ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6hrm-34p3-9244: SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action.
CVE-2024-1409: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [reg-select-role] shortcode in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2022-21338: Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: General Framework). The supported version that is affected is 3.0.2.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
CVSS v3.1: 4.6
GHSA-c685-rwgf-6fvh: An unspecified function in the web interface in Proofpoint Messaging Security Gateway 6.2.0.263:6.2.0.237 and earlier in Proofpoint Protection Server 5.5.3, 5.5.4, 5.5.5, 6.0.2, 6.1.1, and 6.2.0 allows remote attackers to execute arbitrary commands via unknown vectors, related to a "command injection" issue.
GHSA-v6rw-hhgg-wc4x: Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit
Impact_What kind of vulnerability is it? Who is impacted?_An attacker can use this bug to bypass the block gas limit and gas payment completely to perform a full Denial-of-Service against the chain.DisclosureEvmos versions below `v11.0.1` do not check for `MsgEthereumTx` messages that are nested under other messages. This allows a malicious actor to perform EVM transactions that do not meet the checks performed under `newEthAnteHandler`. This opens the possibility for the DOS of validators and consequently halt the chain through an infinite EVM execution.Additional detailsThe attack scenario is as follows:The attacker deploys a simple smart contract with an infinite loop to the chain.The attacker calls the smart contract using an embedded transaction with an extremely high gas value (`uint64` max or similar).Once the transaction is included in a block, nodes will try to execute the EVM transaction with almost infinite gas and get stuck. **This stops new block creation and effectively halts the chain, requiring a manual restart of all nodes.**Users ImpactedAll Evmos users are impacted by this vulnerability as it has the potential to halt the chain. Users' funds and chain state are safe but when under attack, the chain could be deemed unusable.Patches_Has the problem been patched? What versions should users upgrade to?_The vulnerability has been patched on Evmos versions ≥v12.0.0.DetailsAs a temporary workaround, the fix blocks `MsgEthereumTxs` messages from being sent under the `authz` module's `MsgExec` message. It also covers the scenario in which `MsgEthereumTx` are deeply nested by:Doing a recursive check over the nested messages of `MsgExec`Limiting the amount of possible nested messages (inner messages) in `MsgExec`This is done by adding an additional `AnteHandler` decorator (`AuthzLimiterDecorator`) for Cosmos and EIP-712 transactions.This is a state machine-breaking change as it restricts previously allowed messages and thus requires a hard-fork upgrade.References__Are there any links users can visit to find out more?__For more informationIf you have any questions or comments about this advisory:Reach out to the Core Team in [Discord](https://discord.gg/evmos)Open a discussion in [evmos/evmos](https://github.com/evmos/evmos/discussions)Email us at [security@evmos.org](mailto:security@evmos.org) for security questionsFor Press, email us at [evmos@west-comms.com](mailto:evmos@west-comms.com).
CVSS v3.1: 9.1
GHSA-fcvr-5v45-3j27: The Web Administrator service (STEMWADM.EXE) in Websense Personal Email Manager 7.1 before Hotfix 4 and Email Security 7.1 before Hotfix 4 allows remote attackers to cause a denial of service (crash) by sending a HTTP GET request to TCP port 8181 and closing the socket before the service can send a response.
CVE-2008-2534: Directory traversal vulnerability in admin/admin_frame.php in Phoenix View CMS Pre Alpha2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ltarget parameter.
CVSS v2.0: 7.5
CVE-2026-41914: OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies.
CVSS v4.0: 5.1
CVSS v3.1: 8.5
GHSA-8mwr-p576-fpf9: An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allows a guest user to elevate privileges to the Administrator using this vulnerability. Authentication is required to exploit the vulnerability.
CVSS v3.1: 8.8
GHSA-mqqc-qq8p-5w3r: Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the debug page and obtain device status information.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
GHSA-cc6c-7c4q-p82p: In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to arbitrary code execution if IntSan were not enabled, which it is by default. No additional execution privileges are required. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-131859347
ICSA-24-074-08: Siemens SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family
Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file. Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated attacker to cause a denial of service condition. The device needs to be restarted for the web interface to become available again.
CVSS v3.1: 2.7
CVE-2025-64717: ZITADEL vulnerable to Account Takeover with deactivated Instance IdP
ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding IdP was not active or if the organization did not allow federated authentication. This vulnerability stems from the platform's failure to correctly check or enforce an organization's specific security settings during the authentication flow. An Organization Administrator can explicitly disable an IdP or disallow federation, but this setting was not being honored during the auto-linking process. This allowed an unauthenticated attacker to initiate a login using an IdP that should have been disabled for that organization. The platform would incorrectly validate the login and, based on a matching criteria, link the attacker's external identity to an existing internal user account. This may result in a full Account Takeover, bypassing the organization's mandated security controls. Note that accounts with MFA enabled can not be taken over by this attack. Also note that only IdPs create on an instance level would allow this to work. IdPs registered on another organization would always be denied in the (auto-)linking process. Versions 4.6.6, 3.4.4, and 2.71.19 resolve the issue by correctly validating the organization's login policy before auto-linking an external user. No known workarounds are available aside from upgrading.
CVSS v4.0: 7.4
cisco-sa-amp-redirect-rQ2Bu7dU: Cisco Orbital Open Redirect Vulnerability
A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage.

This vulnerability is due to improper validation of URL paths in the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted URL. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability, known as an open redirect attack, is used in phishing attacks to persuade users to visit malicious sites.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-redirect-rQ2Bu7dU ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-redirect-rQ2Bu7dU"]
CVSS v3.1: 4.7
GHSA-75jw-84pf-jxc9: A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL command via the fromdate parameter in a POST HTTP request.
CVSS v3.1: 7.6
RHSA-2022:9074: Red Hat Security Advisory: thunderbird security update
Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content Mozilla: Arbitrary file read from a compromised content process Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and Thunderbird 102.6 Mozilla: Use-after-free in WebGL Mozilla: Memory corruption in WebGL Mozilla: Use-after-free in WebGL
CVSS v3.1: 8.1
GHSA-vmw6-ff98-m24q: The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.  NOTE: some of these details are obtained from third party information.
CVE-2018-16026: Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS v3.0: 8.8
CVSS v2.0: 9.3
CVE-2016-6627: An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
CVSS v3.0: 5.3
CVSS v2.0: 5
GHSA-rrvw-82f6-w56j: The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions.
CVSS v3.0: 9.8
CVE-2026-53026: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg
In the Linux kernel, the following vulnerability has been resolved:

NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg

In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already
set by another thread, __nfs4_file_get_access should not be called
to increment the nfs4_file access count since that was already done
by the thread that added READ access to the file. The extra fi_access
count in nfs4_file can prevent the corresponding nfsd_file from being
freed.

When stopping nfs-server service, these extra access counts trigger a
BUG in kmem_cache_destroy() that shows nfsd_file object remaining on
__kmem_cache_shutdown.

This problem can be reproduced by running the Git project's test
suite over NFS.
CVSS v3.1: 7.5
CVE-2022-27452: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-3hfq-9fxf-h35p: A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper and so cause a denial of service or potentially escalate privileges to root.
CVSS v3.1: 7.3
CVE-2025-60075: WordPress hpb seo plugin for WordPress plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin for WordPress: from n/a through <= 3.0.1.
CVSS v3.1: 7.1
GHSA-v3hf-m7m3-6crp: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 7.5
RHSA-2019:3127: Red Hat Security Advisory: java-11-openjdk security update
OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) OpenJDK: Out of bounds access in optimized String indexof implementation (Hotspot, 8224062) OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765)
CVSS v3.1: 4.8
CVSS v3.0: 4.7
GHSA-cx43-qj46-j7wr: A remote, authenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the webserver and the CODESYS Control runtime system.
CVSS v3.1: 6.5
GHSA-335f-9mr2-fg88: A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
CVSS v3.1: 4.3
CVE-2025-55214: Copier safe template has filesystem write access outside destination path
Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently write files outside the destination path where a project shall be generated or updated. This is possible when rendering a generated directory structure whose rendered path is either a relative parent path or an absolute path. Constructing such paths is possible using Copier's builtin pathjoin Jinja filter and its builtin _copier_conf.sep variable, which is the platform-native path separator. This way, a malicious template author can create a template that overwrites arbitrary files (according to the user's write permissions), e.g., to cause havoc. This vulnerability is fixed in 9.9.1.
CVSS v4.0: 6.9
CVE-2022-26908: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS v3.1: 8.3
CVE-2023-3706: ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
CVSS v3.1: 4.3
GHSA-wmgm-jqrv-9fx8: A vulnerability was found in projectworlds Online Food Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin-page.php. The manipulation of the argument 1_price leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
GHSA-rv4p-c2hf-pcw7: Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing System (UCS) 1.0 and 1.1 before 1.1(1j) and 1.2 before 1.2(1b) allows remote attackers to execute arbitrary code via malformed data in a UDP packet, aka Bug ID CSCtd32371.
GHSA-g9m5-p82f-mqgm: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS v3.1: 9.8
GHSA-7rr3-3wcq-vxff: In PicoTCP 1.7.0, TCP ISNs are improperly random.
CVSS v3.1: 9.1
CVE-2022-44261: Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
CVSS v3.1: 6.1
CVE-2026-28717: Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
CVSS v3.0: 5
cisco-sa-FND-SQL-zEkBnL2h: Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability
A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device.

The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. An attacker could exploit this vulnerability by crafting malicious API requests to the affected device. A successful exploit could allow the attacker to gain access to the back-end database of the affected device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.


CVSS v3.0: 6.3
CVE-2022-4248: Movie Ticket Booking System editBooking.php sql injection
A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBooking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214625 was assigned to this vulnerability.
CVSS v3.1: 5
CVE-2015-8431: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
CVSS v2.0: 10
GHSA-g9mp-5jh6-mp73: An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php.
CVE-2006-3963: Multiple SQL injection vulnerabilities in Banex PHP MySQL Banner Exchange 2.21 allow remote attackers to execute arbitrary SQL commands via the (1) site_name parameter to (a) signup.php, and the (2) id, (3) deleteuserbanner, (4) viewmem, (5) viewmemunb, (6) viewunmem,or (7) deleteuser parameters to (b) admin.php.
CVSS v2.0: 7.5
GHSA-7c47-xr7q-p6hg: free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter
**Impact**  
This is an Improper Input Validation vulnerability leading to Denial of Service.**Security Impact**: A remote attacker can cause the NRF service to panic and crash by sending a crafted HTTP GET request with a malformed `group-id-list` parameter. This results in complete denial of service for the NRF discovery service.**Functional Impact**: The `EncodeGroupId` function attempts to access array indices [0], [1], [2] without validating the length of the split data. When the parameter contains insufficient separator characters, the code panics with "index out of range".**Affected Parties**: All deployments of free5GC v4.0.1 using the NRF discovery service.**Patches**  
Yes, the issue has been patched.  
The fix is implemented in PR free5gc/nrf#80 (commit: [add fix reference here]).  
Users should upgrade to the next release of free5GC that includes this commit.**Workarounds**  
There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the NRF API to trusted sources only.
CVSS v4.0: 8.7
CVE-2017-11583: dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-ffpg-w7v7-gmrp: A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for the Inspector to be susceptible to ARP spoofing.
CVSS v3.1: 7.5