ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2005-0897: PHP remote file inclusion vulnerability in catalog.php in E-Store Kit-2 PayPal Edition allows remote attackers to execute arbitrary PHP code by modifying the menu and main parameters to reference a URL on a remote web server that contains the code.
CVSS v2.0: 7.5
GHSA-9ffx-f77r-756w: Sylius has an Open Redirect via Referer Header
Impact`CurrencySwitchController::switchAction()`, `ImpersonateUserController::impersonateAction()` and `StorageBasedLocaleSwitcher::handle()` use the HTTP Referer header directly when redirecting.The attack requires the victim to click a legitimate application link placed on an attacker-controlled page. The browser automatically sends the attacker's site as the Referer, and the application redirects back to it. This can be used for phishing or credential theft, as the redirect originates from a trusted domain.The severity varies by endpoint; public endpoints require no authentication and are trivially exploitable, while admin-only endpoints require an authenticated session but remain vulnerable if an admin follows a link from an external source such as email or chat.Affected classes:`CurrencySwitchController::switchAction()` - public`StorageBasedLocaleSwitcher::handle()` - public, used in locale switching without having locale in the `url``ImpersonateUserController::impersonateAction()` - admin-onlyPatchesThe issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.WorkaroundsIf you cannot update Sylius immediately, copy the affected classes from vendor to your project's `src/` directory, apply the fix, and override the service definitions.Step 1 - CurrencySwitchControllerCopy from `vendor/sylius/sylius/src/Sylius/Bundle/ShopBundle/Controller/CurrencySwitchController.php` to `src/Controller/CurrencySwitchController.php` and apply the following changes:Step 2 - ImpersonateUserControllerCopy from `vendor/sylius/sylius/src/Sylius/Bundle/AdminBundle/Controller/ImpersonateUserController.php` to `src/Controller/Admin/ImpersonateUserController.php` and apply the following changes:Step 3 - StorageBasedLocaleSwitcher (only if you use `locale_switcher: storage`)**Note:** Skip this step if you use the default `locale_switcher: url` mode.Copy from `vendor/sylius/sylius/src/Sylius/Bundle/ShopBundle/Locale/StorageBasedLocaleSwitcher.php` to `src/Locale/StorageBasedLocaleSwitcher.php` and apply the following changes:**For Sylius 1.9 – 2.1.2:****For Sylius 2.1.3 and later:**In Sylius 2.1.3 the class was refactored to use `UrlMatcherInterface`. While this adds partial validation, it still passes the full referer URL to `RedirectResponse`, so the open redirect remains exploitable.Step 4 - Override the servicesAdd to `config/services.yaml`.**Sylius 1.x (1.9 – 1.14):****Sylius 2.x (2.0 – 2.1):**Step 5 - Clear cacheCustomizing the redirect targetIf you need a different redirect target, override the route definition with the `_sylius.redirect` attribute:ReportersWe would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:Bartłomiej Nowiński (@bnBart)For more informationIf you have any questions or comments about this advisory:Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen)Email us at [security@sylius.com](mailto:security@sylius.com)
CVSS v4.0: 6.9
GHSA-jqv9-2w7w-rccv: On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
GHSA-v62p-cjv8-35xh: Tahoe-LAFS fails to ensure integrity
Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.
CVE-2021-20857: Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS v3.1: 5.4
CVSS v2.0: 3.5
CVE-2025-30184: CyberData 011209 SIP Emergency Intercom Authentication Bypass Using an Alternate Path or Channel
CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2025-2210: aitangbao springboot-manager add cross site scripting
A vulnerability has been found in aitangbao springboot-manager 3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /sysJob/add. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 4.8
CVSS v3.1: 2.4
CVSS v3.0: 2.4
CVSS v2.0: 3.3
GHSA-qg98-f7q6-8623: Improper control of framework service permissions with possibility of some sensitive device information leakage.
CVSS v4.0: 4.8
GHSA-82cr-2m7c-fq92: A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 4.3
CVE-2020-20225: Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. An authenticated remote attacker can cause a Denial of Service due to an assertion failure via a crafted packet.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-mfg4-w44m-wr4g: GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
CVSS v3.1: 7.5
CVE-2015-5531: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
CVSS v2.0: 5
GHSA-cqph-p8m6-m58v: The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS v3.1: 7.1
GHSA-w7jm-9x4m-8qc3: User account enumeration in Serenity
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.
CVSS v3.1: 5.3
GHSA-qg29-4gg5-8r2w: In the Linux kernel, the following vulnerability has been resolved:powerpc/64s: Fix crashes when toggling entry flush barrierThe entry flush mitigation can be enabled/disabled at runtime via a
debugfs file (entry_flush), which causes the kernel to patch itself to
enable/disable the relevant mitigations.However depending on which mitigation we're using, it may not be safe to
do that patching while other CPUs are active. For example the following
crash:sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20Shows that we returned to userspace with a corrupted LR that points into
the kernel, due to executing the partially patched call to the fallback
entry flush (ie. we missed the LR restore).Fix it by doing the patching under stop machine. The CPUs that aren't
doing the patching will be spinning in the core of the stop machine
logic. That is currently sufficient for our purposes, because none of
the patching we do is to that code or anywhere in the vicinity.
CVSS v3.1: 5.5
GHSA-q3r7-7jgj-hp9p: Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dependent attackers to execute arbitrary code via certain maxsize values, as demonstrated by 0xffffffff.
CVE-2022-28346: An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2015-10089: flame.js cross site scripting
A vulnerability classified as problematic has been found in flame.js. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named e6c49b5f6179e31a534b7c3264e1d36aa99728ac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222291.
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2014-9187: Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2014-9456: Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Event element in an XML file.  NOTE: this issue was originally incorrectly mapped to CVE-2014-1004; see CVE-2014-1004 for more information.
CVSS v2.0: 10
CVE-2026-46256: NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages
In the Linux kernel, the following vulnerability has been resolved:

NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

LOCALIO is an NFS loopback mount optimization that avoids using the
network for READ, WRITE and COMMIT if the NFS client and server are
determined to be on the same system. But because LOCALIO is still
fundamentally "just NFS loopback mount" it is susceptible to recursion
deadlock via direct reclaim, e.g.: NFS LOCALIO down to XFS and then
back into NFS via nfs_writepages.

Fix LOCALIO's potential for direct reclaim deadlock by ensuring that
all its page cache allocations are done from GFP_NOFS context.

Thanks to Ben Coddington for pointing out commit ad22c7a043c2 ("xfs:
prevent stack overflows from page cache allocation").
CVSS v3.1: 5.5
CVE-2022-41202: Due to lack of proper memory management, when a victim opens a manipulated Visual Design Stream (.vds, vds.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible that a Remote Code Execution can be triggered when payload forces a stack-based overflow or a re-use of dangling pointer which refers to overwritten space in memory.


CVSS v3.1: 7.8
GHSA-f2cw-h779-q8jh: Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests.
CVSS v3.1: 6.1
CVE-2021-1759: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2025-2983: Legrand SMS PowerView os command injection
A vulnerability has been found in Legrand SMS PowerView 1.x and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument redirect leads to os command injection. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 5.2
GHSA-mmq2-mq7r-x3wg: In mPreference of DefaultUsbConfigurationPreferenceController.java, there is a possible way to enable file transfer mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-205996517
CVSS v3.1: 7.8
GHSA-9f49-q57w-cw53: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation Manager (BSM) before 1.3.2-65648 and Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS v3.1: 9.8
CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
CVSS v3.1: 9.3
GHSA-xmc2-gfmw-wmhg: Buffer overflow in the (1) oracle and (2) oracleO programs in Oracle 9i Database 9.0.x and 9.2.x before 9.2.0.4 allows local users to execute arbitrary code via a long command line argument.
CVE-2016-8741: The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-fwqw-7mg9-4qh9: A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/orders/create. The manipulation of the argument Client Note leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 1.9
CVSS v3.1: 2.4
GHSA-wv2q-ghh7-v3v5: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: don't unregister hook when table is dormantWhen nf_tables_updchain encounters an error, hook registration needs to
be rolled back.This should only be done if the hook has been registered, which won't
happen when the table is flagged as dormant (inactive).Just move the assignment into the registration block.
CVSS v3.1: 5.5
GHSA-qrw5-qx4c-jfc7: The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVSS v3.1: 5.4
CVE-2015-7222: Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
CVSS v2.0: 6.8
CVE-2019-8156: A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
GHSA-xmjj-3c76-5w84: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
ImpactUnauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS.PatchesThis was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0WorkaroundsYou can disable the live embed in the WYSIWYG by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.Referenceshttps://github.com/directus/directus/pull/12020For more informationIf you have any questions or comments about this advisory:Open an issue in [directus/directus](https://github.com/directus/directus)Email us at [security@directus.io](mailto:security@directus.io)
CVSS v3.1: 8.8
GHSA-j6gj-9v56-qvqx: The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. An attacker first calls the /quiz/structure endpoint with an arbitrary victim quiz ID to obtain a valid nonce bound to that quiz ID and their own user ID, then presents that nonce to the /quizzes/{id}/emails save endpoint, which accepts it without verifying quiz ownership.
CVSS v3.1: 4.3
GHSA-8m55-37pr-2mgx: The sbuf_getmsg function in BNC incorrectly handles backspace characters, which could allow remote attackers to bypass authentication and gain access to arbitrary scripts.
GHSA-q43m-485x-8692: Stack-based buffer overflow in PS Normalizer in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PostScript document.
CVE-2012-3988: Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
CVSS v2.0: 9.3
GHSA-94fw-9r5j-jcw8: HEVC Video Extensions Remote Code Execution Vulnerability.
CVSS v3.1: 7.8
GHSA-jcmg-5j8j-35mp: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.
CVSS v4.0: 2
CVSS v3.1: 3.5
CVE-2022-28287: In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99.
CVSS v3.1: 6.5
GHSA-79vr-x4wq-mxhp: sccw allows local users to read arbitrary files.
CVE-2016-10567: product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product, including live monitoring, statistics, endpoints, and test results into one place. product-monitor versions below 2.2.5 download JavaScript resources over HTTP, which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.
CVSS v3.0: 8.1
CVSS v2.0: 9.3
CVE-2011-4363: ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS.
CVSS v2.0: 2.6
CVE-2014-7241: The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document.
CVSS v2.0: 6.8
CVE-2005-4881: The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.13-rc1 does not initialize certain padding fields in structures, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors, related to the (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23) cbq_dump_ovl functions.
CVSS v2.0: 4.9
CVE-2024-54318: WordPress NiceJob plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through <= 3.6.5.
CVSS v3.1: 6.5
CVE-2021-40895: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-4947-wvv9-2q59: Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the yr parameter in a bmonth action.
GHSA-9c82-jpgp-p5fv: Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttd_main function.  NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.
GHSA-3vgg-3q9m-cx36: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 144747.
CVSS v3.0: 6.1
CVE-2024-40618: Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.
CVSS v3.1: 9.6
ICSA-23-157-02: Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update C)
An authentication bypass vulnerability in FTP function in the EtherNet/IP module caused by weak password requirements may allow a remote unauthenticated attacker to access to the module via FTP by a dictionary attack or password sniffing.  An authentication bypass vulnerability in the FTP function in the EtherNet/IP module caused by the use of hard-coded credentials may allow a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP. The EtherNet/IP configuration tool displays an unmasked password due to the lack of password field masking may allow a remote unauthenticated attacker to access the module via FTP. An information disclosure, tampering, deletion, destruction vulnerability exists in the FTP function in the EtherNet/IP module via a file upload/download due to unrestricted upload of file with dangerous type. 
CVSS v3.1: 6.3
GHSA-9cfq-rc8q-2wxp: Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.