ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-24mc-xgf8-3534: The B1.lt plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.2.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 6.5
CVE-2016-0930: Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.
CVSS v3.0: 9.8
CVSS v2.0: 5
CVE-2024-1560: Path Traversal Vulnerability in mlflow/mlflow
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the `_delete_artifact_mlflow_artifacts` handler and `local_file_uri_to_path` function, allowing for the deletion of arbitrary directories on the server's filesystem. This vulnerability is due to an extra unquote operation in the `delete_artifacts` function of `local_artifact_repo.py`, which fails to properly sanitize user-supplied paths. The issue is present up to version 2.9.2, despite attempts to fix a similar issue in CVE-2023-6831.
CVSS v3.0: 8.1
GHSA-5fqp-63w2-x62m: A vulnerability has been found in itsourcecode Gym Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=delete_trainer. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVE-2023-3239: OTCMS path traversal
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 2.7
CVE-2025-22081: fs/ntfs3: Fix a couple integer overflows on 32bit systems
In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix a couple integer overflows on 32bit systems

On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can
have an integer wrapping issue.  Fix it by using size_add().
CVSS v3.1: 5.5
GHSA-85c5-xq3r-f3vw: Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.
CVE-2024-51837: WordPress WP Contest plugin <= 1.0.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sophia M Williams WP Contest wp-contest allows SQL Injection.This issue affects WP Contest: from n/a through <= 1.0.0.
CVSS v3.1: 8.5
CVE-2023-48909: An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function.
CVSS v3.1: 8.8
CVE-2004-0616: The BT Voyager 2000 Wireless ADSL Router has a default public SNMP community name, which allows remote attackers to obtain sensitive information such as the password, which is stored in plaintext.
CVSS v2.0: 5
PYSEC-2026-505: OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
CVSS v4.0: 9.2
CVSS v3.1: 8.1
CVE-2014-8009: The Management subsystem in Cisco Unified Computing System 2.1(3f) and earlier allows remote attackers to obtain sensitive information by reading log files, aka Bug ID CSCur99239.
CVSS v2.0: 5
CVE-2008-7068: The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key with the NULL byte.  NOTE: this might only be a vulnerability in limited circumstances in which the attacker can modify or add database entries but does not have permissions to truncate the file.
CVSS v2.0: 6.4
CVE-2008-2654: Off-by-one error in the read_client function in webhttpd.c in Motion 3.2.10 and earlier might allow remote attackers to execute arbitrary code via a long request to a Motion HTTP Control interface, which triggers a stack-based buffer overflow with some combinations of processor architecture and compiler.
CVSS v2.0: 10
CVE-2019-13707: Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted application.
CVSS v3.1: 5.5
CVSS v2.0: 4.3
CVE-2022-26837: Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.5
GHSA-p9p9-hfpr-fx4f: dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to obtain sensitive author credentials by making a request with an editauthor action, then reading the value of the newlocalpassword password input field in the HTML source of the resulting page.
GHSA-2j44-59r4-mjvh: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVSS v3.1: 7.8
GHSA-47wq-mxqc-399h: A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platforms could allow an unauthenticated, remote attacker to log in to an affected system by using the root account, which has default, static user credentials. The vulnerability is due to the presence of undocumented, default, static user credentials for the root account of the affected software on certain systems. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.
CVSS v3.0: 9.8
GHSA-vq63-h845-wgm6: In the Linux kernel, the following vulnerability has been resolved:md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetimeAfter commit ec6bb299c7c3 ("md/md-bitmap: add 'sync_size' into struct
md_bitmap_stats"), following panic is reported:Oops: general protection fault, probably for non-canonical address
RIP: 0010:bitmap_get_stats+0x2b/0xa0
Call Trace:
 <TASK>
 md_seq_show+0x2d2/0x5b0
 seq_read_iter+0x2b9/0x470
 seq_read+0x12f/0x180
 proc_reg_read+0x57/0xb0
 vfs_read+0xf6/0x380
 ksys_read+0x6c/0xf0
 do_syscall_64+0x82/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7eRoot cause is that bitmap_get_stats() can be called at anytime if mddev
is still there, even if bitmap is destroyed, or not fully initialized.
Deferenceing bitmap in this case can crash the kernel. Meanwhile, the
above commit start to deferencing bitmap->storage, make the problem
easier to trigger.Fix the problem by protecting bitmap_get_stats() with bitmap_info.mutex.
CVSS v3.1: 5.5
GHSA-q4qq-c3qm-82jj: An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
CVSS v3.1: 3.7
CVE-2022-28667: Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1: 6.5
CVE-2024-42021: An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
CVSS v3.0: 7.5
CVE-2021-38351: OSD Subscribe <= 1.2.3 Reflected Cross-Site Scripting
The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3.
CVSS v3.1: 6.1
GHSA-r3q3-7r4r-xv74: Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
CVSS v3.1: 8.8
CVE-2009-3801: SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmpass (aka Password) parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
GHSA-7vgw-qf5j-7533: Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
CVSS v3.0: 6.5
GHSA-mpvw-2236-fjgg: Memory leak in the vrend_renderer_init_blit_ctx function in vrend_blitter.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_CCMD_BLIT commands.
CVSS v3.0: 6.5
GHSA-436q-6h4x-h2hj: A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.
CVSS v3.1: 5.4
CVE-2025-20147: Cisco SD-WAN vManage Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack (XSS) on an affected system.&nbsp;

This vulnerability is due to improper sanitization of user input to the web-based management interface. An attacker could exploit this vulnerability by submitting a malicious script through the interface. A successful exploit could allow the attacker to conduct a stored XSS attack on the affected system.
CVSS v3.1: 5.4
CVE-2016-4069: Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2019-0348: SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality of protection should be encrypted.
CVSS v3.0: 6.5
CVSS v2.0: 4
CVE-2006-4396: The Apple Type Services (ATS) server in Mac OS X 10.4.8 and earlier does not securely create log files, which allows local users to create and modify arbitrary files via unspecified vectors, possibly relating to a symlink attack.
CVSS v2.0: 4.6
GHSA-r893-9m69-jch8: The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-cwrh-575j-8vr3: Karmada Tar Slips in CRDs archive extraction
Impact_What kind of vulnerability is it? Who is impacted?_Both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a karmada initialization could write arbitrary files in arbitrary paths of the filesystem.Patches_Has the problem been patched? What versions should users upgrade to?_From karmada version v1.12.0, when processing custom CRDs files, CRDs archive verification is utilized to enhance file system robustness.Workarounds_Is there a way for users to fix or remediate the vulnerability without upgrading?_When using `karmadactl init` to set up Karmada, if you need to set flag `--crd` to customize the CRD files required for karmada initialization, you can manually inspect the CRD files to check whether they contain sequences such as `../` that would alter file paths, to determine if they potentially include malicious files.When using karmada-operator to set up Karmada, you must upgrade your karmada-operator to one of the fixed versions.References_Are there any links users can visit to find out more?_Enhancements made from the Karmada community: https://github.com/karmada-io/karmada/pull/5713, https://github.com/karmada-io/karmada/pull/5703
CVSS v4.0: 5.3
GHSA-w2ph-64jc-cjr4: IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion. IBM Reference #: 1999672.
CVSS v3.0: 8.6
GHSA-7563-75j9-6h5p: Sensitive Information Exposure in Sylius
ImpactAny other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will block further reads. It may, however, lead to a data leak, like for example customer details, payment gateway configuration, etc.- but only if these were pages checked by the administrator.This vulnerability requires full access to the computer to take advantage of it.PatchesThe issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2 and above.WorkaroundsThe application must strictly redirect to the login page even when the browser back button is pressed. Another possibility is to set more strict cache policies for restricted content (like no-store). It can be achieved with the following class:After that register service in the container:The code above requires changes in `ShopUriBasedSectionResolver` in order to work. To backport mentioned logic, you need to replace the `Sylius\Bundle\ShopBundle\SectionResolver\ShopUriBasedSectionResolver` class with:You also need to define a new subsection for the Customer Account that is used in the above services:ReferencesOriginally published at https://huntr.dev/For more informationIf you have any questions or comments about this advisory:Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)Email us at security@sylius.com
CVSS v3.1: 5
CVE-2018-0656: Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
GHSA-h25m-p8vh-j2r3: Multiple cross-site scripting (XSS) vulnerabilities in Oliver (formerly Webshare) 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the (1) login page (index.php) or (2) login form (loginform-inc.php).
CVSS v3.0: 6.1
GHSA-r6jr-62f2-4mw2: Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the showSupportExpiredMessage parameter of handleloginform.do.
CVSS v4.0: 5.1
GHSA-chxg-v5fx-95h2: Secom Co. Dr.ID, a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system.
CVE-2019-19091: ABB eSOMS: HTTP response information leakage
For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack.
CVSS v3.1: 4.3
CVE-2018-13584: The mintToken function of a smart contract implementation for yasudem, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2022-43595: Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .fits files.
CVSS v3.1: 5.9
GHSA-gmqm-9f8r-xv6w: The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.
GHSA-p7c9-5xv3-c4q4: A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Subject page.
CVSS v3.1: 4.8
CVE-2016-7568: Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2025-26570: WordPress Glance That plugin <= 4.9 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery.

This issue affects Glance That: from n/a through 4.9.
CVSS v3.1: 7.1
GHSA-w87q-wm5x-4mx9: An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to properly handle objects in memory, aka 'Diagnostic Hub Standard Collector Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1202.
CVE-2023-28172: WordPress WP Google Map Plugin Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versions.
CVSS v3.1: 5.4
CVE-2023-53932: Serendipity 2.4.0 Stored Cross-Site Scripting via Admin Entry Creation
Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through blog entry creation. Attackers can craft entries with JavaScript payloads that will execute when other users view the compromised blog post.
CVSS v4.0: 5.1
CVSS v3.1: 5.4
GHSA-7fgf-gwfr-hp5w: SQL injection vulnerability in lib/user.php in mahara 1.0.4 allows remote attackers to execute arbitrary SQL commands via a username.
CVE-2017-9480: The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows local users (e.g., users who have command access as a consequence of CVE-2017-9479 exploitation) to read arbitrary files via UPnP access to /var/IGD/.
CVSS v3.0: 5.5
CVSS v2.0: 2.1
CVE-2013-7205: Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
CVSS v2.0: 6.4
CVE-2024-30378: Junos OS: MX Series: bbe-smgd process crash upon execution of specific CLI commands
A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.  The process crashes and restarts automatically.

When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.  This process manages and controls the configuration of broadband subscriber sessions and services.  While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.

This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled.
This issue affects Junos OS:


  *  All versions before 20.4R3-S5, 
  *  from 21.1 before 21.1R3-S4, 
  *  from 21.2 before 21.2R3-S3, 
  *  from 21.3 before 21.3R3-S5, 
  *  from 21.4 before 21.4R3-S5, 
  *  from 22.1 before 22.1R3, 
  *  from 22.2 before 22.2R3, 
  *  from 22.3 before 22.3R2;
CVSS v4.0: 6.9
CVSS v3.1: 5.5
GHSA-7vp7-7f27-j6qc: Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS v3.0: 7.8
CVE-2018-11748: Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved as of device_manager 2.7.0.
CVSS v3.0: 7.8
CVSS v2.0: 2.1
CVE-2008-0871: Multiple stack-based buffer overflows in Now SMS/MMS Gateway 2007.06.27 and earlier allow remote attackers to execute arbitrary code via a (1) long password in an Authorization header to the HTTP service or a (2) large packet to the SMPP service.
CVSS v2.0: 6.8
CVE-2019-7747: DbNinja 3.2.7 allows session fixation via the data.php sessid parameter.
CVSS v3.0: 9.6
CVSS v2.0: 6.8
RHSA-2024:2568: Red Hat Security Advisory: grafana security update
grafana: vulnerable to authorization bypass golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads
CVSS v3.1: 7.5
CVE-2024-23866: Cross-Site Scripting (XSS) vulnerability in Cups Easy
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/countrycreate.php, in the countryid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS v3.1: 8.2
GHSA-735f-pg76-fxc4: openssl-src heap memory corruption with RSA private key operation
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.
CVSS v3.1: 9.8
CVE-2017-7049: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2025-10915: Dreamer Blog <= 1.2 - Subscriber+ Arbitrary Plugin Installation
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary  installations due to a missing capability check.
CVSS v3.1: 9.8
CVE-2020-1092: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1062.
CVSS v3.1: 7.5
CVSS v2.0: 7.6
GHSA-jp4p-rf6v-wv5p: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.This vulnerability is associated with program files includes/Parser/Parser.Php.This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
CVSS v4.0: 0
CVE-2021-3989: Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site
CVSS v3.0: 6.5