ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-40901: HTML injection in Credentials Manager in Guardian/CMC before 26.1.0
A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags. When a victim attempts to delete the affected identity, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.
CVSS v4.0: 4.8
CVSS v3.1: 5.9
GHSA-c547-5m3r-v2p8: Extproc in Oracle 9i and 10g does not require authentication to load a library or execute a function, which allows local users to execute arbitrary commands as the Oracle user.
GHSA-rw2q-pc53-f59p: A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_comment.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
RHSA-2025:0825: Red Hat Security Advisory: git-lfs security update
git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs
CVSS v3.1: 8.1
CVE-2025-26885: WordPress Assistant Plugin <= 1.5.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through <= 1.5.1.
CVSS v3.1: 7.2
CVE-2020-24827: A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2024-36428: OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.
CVSS v3.1: 8.1
GHSA-9f3p-wx72-xq6p: The HAPPY (aka com.tw.knowhowdesign.sinfonghuei) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
GHSA-qrph-cv25-g33q: Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel.
CVSS v3.0: 5.4
CVE-2024-38703: WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.
CVSS v3.1: 6.5
CVE-2005-3986: Multiple SQL injection vulnerabilities in Instant Photo Gallery 1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter in portfolio.php and (2) cid parameter in content.php.
CVSS v2.0: 7.5
CVE-2018-0594: Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2014-6848: The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-r6wg-6486-p79w: MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs.
CVSS v3.1: 9.8
CVE-2024-4671: Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 9.6
GHSA-hc3h-5vwc-r8f4: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function bit_read_B at bits.c.
CVSS v3.0: 9.1
CVE-2024-8315: Improper Handling of Insufficient Permissions or Privileges in B&R APROL
An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker to read credential information.
CVSS v4.0: 6.8
CVE-2023-2961: A segmentation fault flaw was found in the Advancecomp package. This may lead to decreased availability.
CVSS v3.1: 3.3
CVE-2012-4104: Absolute path traversal vulnerability in the image-download process in the fabric-interconnect component in Cisco Unified Computing System (UCS) allows local users to overwrite or delete arbitrary files via a full pathname in an image header, aka Bug ID CSCtq02706.
CVSS v2.0: 6.6
GHSA-7vg3-f99h-353x: This issue was addressed with improved file handling. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to overwrite arbitrary files.
CVSS v3.1: 7.1
GHSA-5v97-p7p8-r448: MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can be bypassed. An authorized, low-privileged attacker can upload files with arbitrary types to the server.Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.
CVSS v4.0: 5.3
CVE-2020-28022: Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-8v66-q974-wq26: In the Linux kernel, the following vulnerability has been resolved:s390/boot: Avoid possible physmem_info segment corruptionWhen physical memory for the kernel image is allocated it does not
consider extra memory required for offsetting the image start to
match it with the lower 20 bits of KASLR virtual base address. That
might lead to kernel access beyond its memory range.
CVSS v3.1: 5.5
GHSA-3hc7-w9rg-6mh4: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting). The supported version that is affected is Java SE: 8u131. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVSS v3.0: 8.1
GHSA-cpx3-wwj7-w2wq: SQL injection vulnerability in ubbthreads.php in Groupee UBB.threads 6.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the C parameter.
GHSA-8mrm-5f5v-g6v4: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /model/approve_petty_cash.php. The manipulation of the argument admin_index leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263798 is the identifier assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-xxj5-3284-f7m3: Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement for specific features and for access to log files that contain confidential information. An attacker could exploit these vulnerabilities either by submitting crafted HTTP messages to an affected system and performing unauthorized actions with the privileges of an administrator, or by retrieving sensitive data from the logs and using it to impersonate a legitimate privileged user. A successful exploit could allow the attacker to elevate privileges to Administrator.
CVSS v3.1: 8.8
CVE-2018-10078: Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description.
CVSS v3.1: 4.8
CVSS v2.0: 3.5
CVE-2024-11585: WP Hide & Security Enhancer <= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion
The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file path validation in the file-process.php in all versions up to, and including, 2.5.1. This makes it possible for unauthenticated attackers to delete the contents of arbitrary files on the server, which can break the site or lead to data loss.
CVSS v3.1: 7.5
GHSA-3m48-2pc8-qvj4: An insecure deserialization vulnerability has been identified in ROS2 Humble Hawksbill in ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows attackers to execute arbitrary code and obtain sensitive information via crafted input to the Data Serialization and Deserialization Components, Inter-Process Communication Mechanisms, and Network Communication Interfaces.
CVE-2023-29767: An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause a persistent denial of service via the database files.
CVSS v3.1: 5.5
CVE-2002-1432: MidiCart stores the midicart.mdb database file under the Web document root, which allows remote attackers to steal sensitive information by directly requesting the database.
CVSS v2.0: 5
CVE-2016-4142: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
CVSS v3.1: 8.8
CVSS v2.0: 9.3
GHSA-q678-8gfc-r58r: An exploitable out-of-bounds write exists in the PCX parsing functionality of Canvas Draw version 4.0.0. A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution. A different vulnerability than CVE-2018-3870.
CVSS v3.0: 7.8
CVE-2022-33002: The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-96qx-7wjx-crxw: Stack-based buffer overflow in INMATRIX Zoom Player before 8.7 beta 11 allows remote attackers to execute arbitrary code via a large biClrUsed value in a BMP file.
CVE-2017-14405: The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_device/index.php.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
GHSA-2xv7-fwh6-x7fc: Subrion Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.
CVSS v3.0: 6.1
GHSA-xvgc-j98h-3v9x: Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory structure of the root file system during the Pre-Boot Authorization (PBA) process. This can be exploited by a physical attacker who is able to manipulate the contents of the system's hard disk.
CVSS v3.1: 6.8
GHSA-f7w4-79f7-fhp3: An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security headers, it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.
CVSS v3.0: 9.8
RHSA-2025:8631: Red Hat Security Advisory: thunderbird security update
firefox: thunderbird: Out-of-bounds access when resolving Promise objects firefox: thunderbird: Out-of-bounds access when optimizing linear sums firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content firefox: thunderbird: Potential local code execution in “Copy as cURL” command firefox: thunderbird: Script element events leaked cross-origin resource status firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details firefox: thunderbird: Memory safety bugs firefox: thunderbird: Memory safety bug libvpx: Double-free in libvpx encoder
CVSS v3.1: 8.1
CVE-2007-3846: Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
CVSS v2.0: 6
GHSA-44x9-p5gj-h8x2: net/ipv4/ip_gre.c in the Linux kernel before 2.6.34, when ip_gre is configured as a module, allows remote attackers to cause a denial of service (OOPS) by sending a packet during module loading.
GHSA-4cj4-8f6r-7v4g: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
CVE-2025-9489: WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS v3.1: 5
GHSA-w2pf-g6r8-pg22: auth0-lock vulnerable to XSS via unsanitized placeholder property
OverviewAuth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the `additionalSignUpFields` customization option to add a checkbox to the sign-up dialog that are passing a `placeholder` property obtained from an untrusted source (e.g. a query parameter) could allow cross-site scripting (XSS) on their signup pages.Am I affected?You are affected by this vulnerability if all of the following conditions apply:You are using Auth0 Lock version 11.20.4 or earlier.You pass `additionalSignUpFields` as options when initializing Lock which includes a field of type `checkbox` whose `placeholder` value is obtained from an untrusted source.An example of a vulnerable snippet is the following where the `placeholder` value is partially user-controlled by the `name` query parameter:How to fix that?Developers using Auth0’s signin solution Lock need to upgrade to version 11.21.0 or later. Version 11.21.0 introduces two changes:The existing `placeholder` property is now treated as plain text to mitigate the problem.A new `placeholderHTML` property is introduced that indicates the level of control it provides and that it should be only supplied from trusted sources.Will this update impact my users?This fix patches the Auth0 Lock widget and may require changes in application code, but it will not impact your users, their current state, or any existing sessions.Developers using the `placeholder` property with HTML content from a trusted source should start using the `placeholderHTML` property to continue providing the same user experience.
CVSS v3.1: 6.1
GHSA-rqvh-hrwh-vv6f: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.
CVSS v3.1: 8.5
CVE-2026-8738: Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error
A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.9
CVSS v3.1: 6.5
CVSS v3.0: 6.5
CVSS v2.0: 6.4
CVE-2025-47373: Out-of-bounds Write in Automotive
Memory Corruption when accessing buffers with invalid length during TA invocation.
CVSS v3.1: 7.8
CVE-2013-0599: IBM Eclipse Help System (IEHS), as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products, allows remote attackers to obtain sensitive information by providing a crafted parameter path and then reading the debug information associated with the 500 HTTP status code.
CVSS v2.0: 5
CVE-2019-18276: An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-v87w-6vcm-6vf3: ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.
CVSS v3.0: 6.1
GHSA-vrwh-33vr-jg7w: The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.
CVSS v3.1: 6.7
CVE-2020-7815: XPLATFORM v9.2.260 and eariler versions contain a vulnerability that could allow remote files to be downloaded by setting the arguments to the vulnerable method. this can be leveraged for code execution. File download vulnerability in ____COMPONENT____ of TOBESOFT XPLATFORM allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: TOBESOFT XPLATFORM 9.2.250 versions prior to 9.2.260 on Windows.
CVSS v3.1: 7.8
GHSA-q445-m72p-x8m3: newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for newsCMS.mdb.
CVE-2021-33882: A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands.
CVSS v3.1: 6.8
GHSA-29g7-g95p-w4ww: Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 11-10-05-BETA-SF1:111005 and earlier allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of a SCRIPT element in the avatar parameter.  NOTE: this may be related to the tracker program in the Janitor package.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-pxw9-25jj-hw97: Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirector versions 1.6x/1.6y and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
GHSA-2p79-p2xq-4xwj: The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.
CVE-2021-35937: A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS v3.1: 6.4
GHSA-vgf8-f9xm-cx7m: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shopperdotcom Shopper allows SQL Injection. This issue affects Shopper: from n/a through 3.2.5.
CVSS v3.1: 9.3
GHSA-qvv9-ff76-h7r8: Senao SI-680H Wireless VoIP Phone Firmware 0.03.0839 leaves the VxWorks debugger UDP port 17185 available without authentication, which allows attackers to access the phone OS, obtain sensitive information, and cause a denial of service.
GHSA-65q8-p76v-6qj6: Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.
CVSS v4.0: 9.3
CVSS v3.1: 5.4
GHSA-vjf8-pc55-p8gm: The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.
CVSS v3.1: 4.3
GHSA-7fj9-687g-h53c: In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 8.8
GHSA-pf22-rv2m-7xj7: A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.
CVSS v3.1: 5.5
RHSA-2024:4336: Red Hat Security Advisory: security update Logging for Red Hat OpenShift - 5.6.21
golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVSS v3.1: 6.7
GHSA-984p-xq9m-4rjw: Rate Limiting Bypass in express-brute
All versions of `express-brute` are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting.RecommendationNo fix is currently available. Consider using an alternative module until a fix is made available.
CVSS v3.1: 5.6