ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-rjx4-6pxq-6pqg: The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows local users (e.g., users who have command access as a consequence of CVE-2017-9479 exploitation) to read arbitrary files via UPnP access to /var/IGD/.
CVSS v3.0: 5.5
GHSA-q56f-p5h4-mjcf: In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Check link_res->hpo_dp_link_enc before using it[WHAT & HOW]
Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res
without initializing hpo_dp_link_enc and it is necessary to check for
null before dereferencing.This fixes 2 FORWARD_NULL issues reported by Coverity.
CVSS v3.1: 5.5
CVE-2015-2443: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
CVSS v2.0: 9.3
CVE-2025-31463: WordPress TGG WP Optimizer plugin <= 1.25 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preetindersodhi TGG WP Optimizer tgg-wp-optimizer allows Stored XSS.This issue affects TGG WP Optimizer: from n/a through <= 1.25.
CVSS v3.1: 5.9
GHSA-gv3j-fjgf-469v: python jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary Python commands by deserializing malicious JSON payloads containing py/repr objects. Attackers can craft JSON strings with py/repr directives that invoke the eval function during deserialization to execute system commands and arbitrary code.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2020-12835: An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-rg37-qjm5-vw5p: A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/ReposAuthMapper.xml. Executing a manipulation of the argument searchWord can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-pqqg-5f4f-8952: FacturaScripts has SQL Injection in Autocomplete Actions
Summary**FacturaScripts contains a critical SQL Injection vulnerability in the autocomplete functionality** that allows authenticated attackers to extract sensitive data from the database including user credentials, configuration settings, and all stored business data. The vulnerability exists in the `CodeModel::all()` method where user-supplied parameters are directly concatenated into SQL queries without sanitization or parameterized binding.DetailsMultiple controllers in FacturaScripts, including `CopyModel`, `ListController`, and `PanelController`, implement an autocomplete action that processes user input through the `CodeModel::search()` or `CodeModel::all()` methods. These methods construct SQL queries by directly concatenating user-controlled parameters without any validation or escaping.Vulnerable Code Location**File:** `/Core/Model/CodeModel.php`
**Method:** `all()`
**Lines:** 108-109Vulnerable ParametersThe following parameters are vulnerable to SQL Injection:**`source`** → Maps to `$tableName` - Table name injection**`fieldcode`** → Maps to `$fieldCode` - Column name injection**`fieldtitle`** → Maps to `$fieldDescription` - Column name injection (Primary attack vector)Attack FlowAttacker authenticates with valid credentials (any user role)Attacker sends POST request to `/CopyModel` with `action=autocomplete`Malicious SQL functions/queries are injected via the `fieldtitle` parameterApplication executes the injected SQL and returns results in JSON formatAttacker extracts sensitive data from the databaseProof of Concept (PoC)PrerequisitesValid authentication credentials (admin/admin in test instance)Access to FacturaScripts web interfaceStep-by-Step Manual Exploitation (CLI)Since FacturaScripts uses `MultiRequestProtection`, a valid `multireqtoken` is required for every POST request.**1. Obtain initial token and session cookie:**
FacturaScripts redirects `/` to `/login`, so we use `-L` to follow redirects and `-c` to save the session cookie.**2. Authenticate (Login):**
Use the saved cookie and the token to log in.**3. Extract Database Version:**
Obtain a fresh token for the next request and execute the injection.**4. Extract Database User and Name:****5. Extract Admin Password Hash:**Automated Exploitation ScriptImpactThis SQL injection vulnerability has **CRITICAL** impact:Data Confidentiality**Complete database disclosure** - Attacker can extract all data including:User credentials (password hashes)Customer information (names, addresses, tax IDs, etc.)Financial records (invoices, payments, bank details)Business logic and configuration dataPlugin and system settingsWho is Impacted?**All FacturaScripts installations** running vulnerable versions**All authenticated users** can exploit (not just admins)**Businesses using FacturaScripts** for accounting/invoicing**Customers whose data is stored** in the systemRecommended FixImmediate Remediation**Option 1: Use Prepared Statements**Credits**Discovered by:** Łukasz Rybak
CVSS v4.0: 8.7
GHSA-g4w7-vcv3-f74v: Tungsten Automation Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24458.
CVSS v3.0: 7.8
CVE-2025-26568: WordPress Easy Amazon Product Information plugin <= 4.0.1 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue affects Easy Amazon Product Information: from n/a through <= 4.0.1.
CVSS v3.1: 7.1
CVE-2020-3261: Cisco Mobility Express Software Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Mobility Express Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user with an active session on an affected device to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, including modifying the configuration, with the privilege level of the user.
CVSS v3.0: 8.1
CVE-2009-2956: The (1) Net.Commerce and (2) Net.Data components in IBM WebSphere Commerce Suite store sensitive information under the web root with insufficient access control, which allows remote attackers to discover passwords, and database and filesystem details, via direct requests for configuration files.
CVSS v2.0: 5
CVE-2011-3639: The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
CVSS v2.0: 4.3
GHSA-fcf5-p95m-fc28: In the Linux kernel, the following vulnerability has been resolved:x86/mm: Check return value from memblock_phys_alloc_range()At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of
contiguous free memory available at this point, the kernel will crash
and burn because memblock_phys_alloc_range() returns 0 on failure,
which leads memblock_phys_free() to throw the first 4 MiB of physical
memory to the wolves.At a minimum it should fail gracefully with a meaningful diagnostic,
but in fact everything seems to work fine without the weird reserve
allocation.
CVSS v3.1: 5.5
GHSA-mmj4-777p-fpq9: Validation bypass in frourio-express
日本語影響v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。パッチfrourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。ワークアラウンドcontroller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。さらなる情報このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。[frourio](https://github.com/frouriojs/frourio)にIssueを開く。EnglishImpactFrourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)PatchesPlease update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.WorkaroundsValidate objects from request with class-transformer in controllers by yourself, or prevent using validators.For more informationIf you have any questions or comments about this advisory:Open an issue in [frourio](https://github.com/frouriojs/frourio)
CVSS v3.1: 8.1
CVE-2015-0832: Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.
CVSS v2.0: 5
GHSA-j57w-cc2h-3w6w: MariaDB Server 10.10 through 10.11.* and 11.0 through 11.4.* crashes in JOIN::fix_all_splittings_in_plan.
CVSS v3.1: 4.9
GHSA-37w3-fgfh-xjrf: In vow, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07032634; Issue ID: ALPS07032634.
CVSS v3.1: 4.4
GHSA-v5jc-hjph-84c2: An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is a part of the image conversion module that handles XPS files. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
CVSS v3.0: 8.8
GHSA-mq39-jwgr-3jxw: Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2016-3519: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity via vectors related to PC / Get Shortcut.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
CVE-2020-0594: Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Intel(R) ISM versions before 11.8.77, 11.12.77, 11.22.77 and 12.0.64 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
RHSA-2020:5420: Red Hat Security Advisory: net-snmp security and bug fix update
net-snmp: Improper Privilege Management in EXTEND MIB may lead to privileged commands execution
CVSS v3.1: 8.8
GHSA-cwg9-gxcg-x6v2: kb_whois.cgi in K+B-Bestellsystem (aka KB-Bestellsystem) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) domain or (2) tld parameter in a check_owner action.
CVE-2024-2012: vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or 
code to be executed on the UNEM server allowing sensitive data to 
be read or modified or could cause other unintended behavior
CVSS v3.1: 9.1
CVE-2022-38389: IBM Tivoli Workload Scheduler XML external entity injection
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  233975.
CVSS v3.1: 7.1
CVE-2025-8487: Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Image Hub plugin.
CVSS v3.1: 5.4
CVE-2018-21021: img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
PYSEC-2006-3: Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors.
GHSA-7r5x-3969-58xr: A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.0.4 and 3.1.0 is capable of addressing this issue. The patch is named da853fdd8cbe9d42053b45d83f25708ba29b8b27. It is suggested to upgrade the affected component.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2021-35342: The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows users to access the system with their JWT token after logout, because of missing invalidation (if the JWT verification cache is enabled).
CVSS v3.1: 7.5
CVSS v2.0: 4.3
CVE-2002-1594: Buffer overflow in (1) grpck and (2) pwck, if installed setuid on a system as recommended in some AIX documentation, may allow local users to gain privileges via a long command line argument.
CVSS v2.0: 7.2
CVE-2007-0460: Multiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to "improper string length calculations."
CVSS v2.0: 10
CVE-2008-0223: Buffer overflow in JustSystems JSFC.DLL, as used in multiple JustSystems products such as Ichitaro, allows remote attackers to execute arbitrary code via a crafted .JTD file.
CVSS v2.0: 9.3
GHSA-j7gg-x8j3-qgpc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log allows Reflected XSS. This issue affects WP Login Attempt Log: from n/a through 1.3.
CVSS v3.1: 7.1
PYSEC-2021-311: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. This is caused by the MLIR optimization of `L2NormalizeReduceAxis` operator. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/lite/transforms/optimize.cc#L67-L70) unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements. We have patched the issue in GitHub commit d6b57f461b39fd1aa8c1b870f1b974aac3554955. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVE-2014-2749: The HANA ICM process in SAP HANA allows remote attackers to obtain the platform version, host name, instance number, and possibly other sensitive information via a malformed HTTP GET request.
CVSS v2.0: 5
CVE-2025-11839: GNU Binutils prdbg.c tg_tag_type return value
A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
CVSS v3.0: 3.3
CVSS v2.0: 1.7
GHSA-hqq7-2q2v-82xq: Cross-site Scripting in sanitize-url
The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.
CVSS v3.1: 5.4
RHSA-2021:1600: Red Hat Security Advisory: opensc security, bug fix, and enhancement update
opensc: heap-based buffer overflow in sc_oberthur_read_file opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init opensc: stack-based buffer overflow in tcos_decipher
CVSS v3.1: 6.4
CVE-2023-2557: WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher.
CVSS v3.1: 4.3
CVE-2026-47896: Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).

This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017.

Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
CVSS v4.0: 8.9
GHSA-x4pp-356g-v2qr: In the Linux kernel, the following vulnerability has been resolved:drivers: perf: ctr_get_width function for legacy is not definedWith parameters CONFIG_RISCV_PMU_LEGACY=y and CONFIG_RISCV_PMU_SBI=n
linux kernel crashes when you try perf record:$ perf record ls
[ 46.749286] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 46.750199] Oops [#1]
[ 46.750342] Modules linked in:
[ 46.750608] CPU: 0 PID: 107 Comm: perf-exec Not tainted 6.6.0 #2
[ 46.750906] Hardware name: riscv-virtio,qemu (DT)
[ 46.751184] epc : 0x0
[ 46.751430] ra : arch_perf_update_userpage+0x54/0x13e
[ 46.751680] epc : 0000000000000000 ra : ffffffff8072ee52 sp : ff2000000022b8f0
[ 46.751958] gp : ffffffff81505988 tp : ff6000000290d400 t0 : ff2000000022b9c0
[ 46.752229] t1 : 0000000000000001 t2 : 0000000000000003 s0 : ff2000000022b930
[ 46.752451] s1 : ff600000028fb000 a0 : 0000000000000000 a1 : ff600000028fb000
[ 46.752673] a2 : 0000000ae2751268 a3 : 00000000004fb708 a4 : 0000000000000004
[ 46.752895] a5 : 0000000000000000 a6 : 000000000017ffe3 a7 : 00000000000000d2
[ 46.753117] s2 : ff600000028fb000 s3 : 0000000ae2751268 s4 : 0000000000000000
[ 46.753338] s5 : ffffffff8153e290 s6 : ff600000863b9000 s7 : ff60000002961078
[ 46.753562] s8 : ff60000002961048 s9 : ff60000002961058 s10: 0000000000000001
[ 46.753783] s11: 0000000000000018 t3 : ffffffffffffffff t4 : ffffffffffffffff
[ 46.754005] t5 : ff6000000292270c t6 : ff2000000022bb30
[ 46.754179] status: 0000000200000100 badaddr: 0000000000000000 cause: 000000000000000c
[ 46.754653] Code: Unable to access instruction at 0xffffffffffffffec.
[ 46.754939] ---[ end trace 0000000000000000 ]---
[ 46.755131] note: perf-exec[107] exited with irqs disabled
[ 46.755546] note: perf-exec[107] exited with preempt_count 4This happens because in the legacy case the ctr_get_width function was not
defined, but it is used in arch_perf_update_userpage.Also remove extra check in riscv_pmu_ctr_get_width_mask
CVSS v3.1: 5.5
CVE-2016-2496: The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window, aka internal bug 26677796.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-ghjx-f567-jrj4: Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name parameter. Attackers can exploit the vulnerability to execute arbitrary scripts in users and activity log backend modules, potentially leading to session hijacking and persistent phishing attacks.
CVSS v4.0: 5.1
CVSS v3.1: 6.4
CVE-2026-46808: Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
CVSS v3.1: 8.7
CVE-2024-52503: WordPress Tailored Tools plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tailored Media Tailored Tools tailored-tools allows Stored XSS.This issue affects Tailored Tools: from n/a through <= 1.8.4.
CVSS v3.1: 6.5