ansulev/circl-vulnerability-scores huggingface dataset:
RHSA-2025:19345: Red Hat Security Advisory: redis:7 security update
redis: Lua library commands may lead to integer overflow and potential RCE Redis: Redis: Authenticated users can execute LUA scripts as a different user Redis: Redis is vulnerable to DoS via specially crafted LUA scripts Redis: Redis Lua Use-After-Free may lead to remote code execution
CVSS v3.1: 8.8
GHSA-v5c9-98f7-2h54: Hadoop symlink vulnerability
Hadoop 1.0.3 contains a symlink vulnerability as a result of storing pid files in the shared `/tmp` directory by default.
CVSS v3.1: 7.5
RHSA-2024:9457: Red Hat Security Advisory: python3.12-urllib3 security update
urllib3: proxy-authorization request header is not stripped during cross-origin redirects
CVSS v3.1: 4.4
GHSA-3w63-gvhp-2wgh: Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.
CVSS v3.1: 5.3
CVE-2025-49043: WordPress Magic Responsive Slider and Carousel WordPress plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through <= 1.6.
CVSS v3.1: 7.1
CVE-2023-45875: An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.
CVSS v3.1: 7.5
GHSA-2qvh-cvhr-9qjc: The Microsoft Windows Kernel Mode Driver on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8694.
CVSS v3.0: 7
CVE-2023-5002: Pgadmin4: remote code execution by an authenticated user
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
CVSS v3.1: 6
CVE-2018-6005: SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2010-4905: SQL injection vulnerability in article_details.php in Softbiz Article Directory Script allows remote attackers to execute arbitrary SQL commands via the sbiz_id parameter.
CVSS v2.0: 7.5
CVE-2010-4816: It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-2f47-vffr-pwwf: WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions up to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-jw27-pvq7-h9jv: Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file during the installation progress and could execute a malicious program each time a user installs a program.
CVE-2012-5452: Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en] parameter to fields/group/add/ in admin/manage/; or (7) f[accounts][fullname] or (8) f[accounts][username] parameter to advsearch/.  NOTE: This might overlap CVE-2011-5211.  NOTE: it was later reported that the f[accounts][fullname] and f[accounts][username] vectors might also affect 2.2.2.
CVSS v2.0: 4.3
CVE-2008-5891: Cross-site scripting (XSS) vulnerability in the profile editing functionality in Injader before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 4.3
CVE-2020-9908: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to cause unexpected system termination or read kernel memory.
CVSS v3.1: 7.1
CVSS v2.0: 6.6
RHSA-2016:1850: Red Hat Security Advisory: libarchive security update
libarchive: Stack out of bounds read in ar parser libarchive: Global out of bounds read in mtree parser libarchive: Undefined behavior / invalid shiftleft in TAR parser libarchive: Memory allocate error with symbolic links in cpio archives libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite libarchive: undefined behaviour (integer overflow) in iso parser libarchive: Denial of service using a crafted gzip file
CVSS v3.0: 3.5
GHSA-jq5g-93fw-pqwp: Multiple memory leaks in the IP module in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_109, allow local users to cause a denial of service (memory consumption) via vectors related to (1) M_DATA, (2) M_PROTO, (3) M_PCPROTO, and (4) M_SIG STREAMS messages.
GHSA-hm7r-c7qw-ghp6: fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
Summary`fast-jwt` does not validate the `crit` (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a `crit` array listing extensions that `fast-jwt` does not understand, the library accepts the token instead of rejecting it. This violates the **MUST** requirement in the RFC.RFC RequirementRFC 7515 §4.1.11:If any of the listed extension Header Parameters are **not understood
and supported** by the recipient, then the **JWS is invalid**.Proof of Concept**Expected:** Error — unsupported critical extension
**Actual:** Token accepted.ComparisonImpact**Split-brain verification** in mixed-library environments**Security policy bypass** when `crit` carries enforcement semantics**Token binding bypass** (RFC 7800 `cnf` confirmation)See CVE-2025-59420 for full impact analysisSuggested FixIn `src/verifier.js`, add crit validation after header decoding:
CVSS v3.1: 7.5
GHSA-2h6h-f2x3-xhhh: Mozilla Firefox 33.0 and SeaMonkey before 2.31 include path strings in CSP violation reports, which allows remote attackers to obtain sensitive information via a web site that receives a report after a redirect.
GHSA-qpxg-78gx-9h6x: Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
GHSA-ghrx-ww4x-q83j: Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 4.3
GHSA-fq84-xj97-qcc3: A vulnerability was determined in Campcodes Online Beauty Parlor Management System 1.0. This affects an unknown part of the file /admin/add-services.php. Executing manipulation of the argument sername can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2021-46625: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of JT files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15455.
CVSS v3.0: 7.8
CVE-2025-62894: WordPress ACF Recent Posts Widget plugin <= 5.9.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magicoders ACF Recent Posts Widget acf-recent-posts-widget allows Stored XSS.This issue affects ACF Recent Posts Widget: from n/a through <= 5.9.3.
CVSS v3.1: 6.5
GHSA-9x5r-xhjr-w765: Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An authenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
GHSA-xf8h-2jhw-rgxq: Server-Side Request Forgery (SSRF) vulnerability in _nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helper: from n/a through <= 1.7.9.
CVSS v3.1: 9.1
GHSA-m4wf-gf4j-873f: Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.
CVSS v3.1: 6.5
GHSA-8r99-h8j2-rw64: Twisted vulnerable to HTTP Request Smuggling Attacks
ImpactTwisted Web is vulnerable to request smuggling attacks:"When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security)" When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security)~"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)~ _closed in 9646_"Two CL header with different values is also not allowed." (ZeddYu Lu)"Only accept identity and chunked Transport-Encoding." (ZeddYu Lu)Patcheshttps://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081
https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281WorkaroundsN/AReferenceshttps://portswigger.net/web-security/request-smuggling
CVE-2026-32841: Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients
Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any user authenticates, enabling unauthorized password changes, firmware uploads, and configuration modifications.
CVSS v4.0: 9.2
CVSS v3.1: 8.1
GHSA-c4xj-x7p8-3x7q: AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
SummaryThe AVideo endpoint `objects/emailAllUsers.json.php` allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets `SameSite=None` on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address.The endpoint does not call `save()` on any ORM object, which means the Referer/Origin domain validation implemented in `ObjectYPT::save()` is never triggered, leaving CSRF as the only required protection - and it is absent.DetailsThe endpoint performs an admin check at line 10 but has no CSRF token validation:The message body is taken directly from POST data at line 41:The message is rendered as HTML in the email at line 48:When the `email` POST parameter is omitted, the endpoint defaults to sending to all registered users by calling `User::getAllUsers()`. This means the attacker does not need to know any email addresses.The emails are sent through the platform's configured SMTP server, so they originate from the legitimate platform email address and pass SPF/DKIM validation. This makes the phishing emails highly convincing.Proof of ConceptHost the following HTML on an attacker-controlled domain and lure an AVideo administrator to visit it:**Verification steps:**Set up a test AVideo instance with at least two registered user accounts.Log in as an admin in one browser tab.Open the attacker HTML page in another tab in the same browser.Check the email inboxes of all registered users. Each will have received the phishing email from the platform's legitimate SMTP address.Alternatively, test with curl using an admin session cookie:ImpactAn attacker can send attacker-controlled HTML emails to every registered user on an AVideo platform by exploiting the admin's session via CSRF. The emails originate from the platform's legitimate SMTP address, pass email authentication checks (SPF, DKIM, DMARC), and appear indistinguishable from genuine platform communications. This enables:Mass phishing campaigns targeting all platform users with highly credible emailsCredential harvesting by directing users to attacker-controlled login pagesMalware distribution via HTML email payloadsReputation damage to the platform operatorThe attack requires only a single click from an authenticated admin (visiting an attacker-controlled page). No user enumeration or email address knowledge is needed.**CWE-352**: Cross-Site Request ForgeryRecommended FixAdd CSRF token validation at `objects/emailAllUsers.json.php:13`, after the admin check:*Found by [aisafe.io](https://aisafe.io)*
CVSS v3.1: 6.5
GHSA-hxh4-c2q3-hhx4: ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.
CVSS v3.0: 7.2
CVE-2025-64600: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2008-1959: Stack-based buffer overflow in the get_remote_video_port_media function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SIP message.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 7.5
GHSA-2424-q483-wgpq: Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v3.1: 7.5
CVE-2021-20414: IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM X-Force ID: 196216.
CVSS v3.0: 4.4
GHSA-rx4x-qmmx-qc5f: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev
CVSS v3.1: 5.3
CVE-2023-5856: Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 8.8
GHSA-8jmv-f4p4-24wg: The CmpWebServer.dll module in the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to cause a denial of service (NULL pointer dereference) via (1) a crafted Content-Length in an HTTP POST or (2) an invalid HTTP request method.
GHSA-qxcg-58f3-9fmx: SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the cat parameter.  NOTE: the i and th vectors are already covered by CVE-2009-0646.
CVE-2014-0632: Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS v2.0: 9
RHSA-2017:2966: Red Hat Security Advisory: ansible security, bug fix, and enhancement update
ansible: jenkins_plugin module exposes passwords in remote host logs
CVSS v3.0: 8.5
GHSA-x9wm-pw72-c8fj: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+) SQL Injection.This issue affects GD Security Headers: from n/a through 1.7.
CVSS v3.1: 7.2
GHSA-gh38-mhw5-8qwc: routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.
GHSA-76ff-vrv6-jfvq: A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka Message Tracking XSS. More Information: CSCvd30805 CSCvd34861. Known Affected Releases: 10.0.0-203 10.1.0-049.
CVSS v3.0: 6.1
CVE-2022-35867: This vulnerability allows local attackers to escalate privileges on affected installations of xhyve. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000 virtual device. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-15056.
CVSS v3.0: 7.5
GHSA-xh87-mx6m-69f3: Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
SummaryWhen using the AWS Lambda adapter (`hono/aws-lambda`) behind an Application Load Balancer (ALB), the `getConnInfo()` function incorrectly selected the first value from the `X-Forwarded-For` header.Because AWS ALB appends the real client IP address to the end of the `X-Forwarded-For` header, the first value can be attacker-controlled.This could allow IP-based access control mechanisms (such as the `ipRestriction` middleware) to be bypassed.DetailsIn ALB environments, AWS appends the actual client IP address to the end of any existing `X-Forwarded-For` header value. However, the previous implementation of `getConnInfo()` extracted the leftmost IP address:If a client sent:ALB would forward:Since the implementation selected the first value, the spoofed IP address was trusted. This affected applications using:or any custom middleware relying on `getConnInfo(c).remote.address` for authorization decisions.The issue only affects deployments using the AWS Lambda adapter behind an ALB. API Gateway (v1/v2) and Lambda Function URLs are not affected, as they use AWS-provided source IP values from `requestContext`.ImpactAn unauthenticated remote attacker could bypass IP-based access restrictions by supplying a crafted `X-Forwarded-For` header. This may allow access to resources that were intended to be restricted by IP address.Only applications deployed behind an ALB and relying on `getConnInfo()` for IP-based authorization are affected.
CVSS v3.1: 8.2
CVE-2024-50356: Press has a potential 2FA bypass
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn't be able to login by bypassing the 2FA. Only users who have enabled 2FA are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug.
CVSS v3.1: 0
CVE-2009-0336: Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request for database/Blog.mdb.  NOTE: some of these details are obtained from third party information.
CVSS v2.0: 5
CVE-2018-3739: https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
CVSS v3.0: 9.1
CVSS v2.0: 6.4
CVE-2013-2186: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
CVSS v2.0: 7.5
CVE-2024-30380: Junos OS and Junos OS Evolved: l2cpd crash upon receipt of a specific TLV
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS), which causes the l2cpd process to crash by sending a specific TLV.

The l2cpd process is responsible for layer 2 control protocols, such as STP, RSTP, MSTP, VSTP, ERP, and LLDP.  The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP, leading to a Denial of Service.  Continued receipt and processing of this specific TLV will create a sustained Denial of Service (DoS) condition.
This issue affects:

Junos OS: all versions before 20.4R3-S9, 
from 21.2 before 21.2R3-S7, 
from 21.3 before 21.3R3-S5, 
from 21.4 before 21.4R3-S4, 
from 22.1 before 22.1R3-S4, 
from 22.2 before 22.2R3-S2, 
from 22.3 before 22.3R2-S2, 22.3R3-S1, 
from 22.4 before 22.4R2-S2, 22.4R3, 
from 23.2 before 23.2R1-S1, 23.2R2;

Junos OS Evolved: all versions before 21.2R3-S7,

 
from 21.3 before 21.3R3-S5-EVO, 
from 21.4 before 21.4R3-S5-EVO, 
from 22.1 before 22.1R3-S4-EVO, 
from 22.2 before 22.2R3-S2-EVO, 
from 22.3 before 22.3R2-S2-EVO, 22.3R3-S1-EVO, 
from 22.4 before 22.4R2-S2-EVO, 22.4R3-EVO, 
from 23.2 before 23.2R1-S1-EVO, 23.2R2-EVO.
CVSS v4.0: 7.1
CVSS v3.1: 6.5
GHSA-hvgm-3m44-563v: In the Linux kernel, the following vulnerability has been resolved:drm: amd: display: Fix memory leakageThis commit fixes memory leakage in dc_construct_ctx() function.
CVSS v3.1: 5.5
CVE-2025-48362: WordPress Hesabfa Accounting plugin <= 2.2.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affects Hesabfa Accounting: from n/a through <= 2.2.5.
CVSS v3.1: 5.4
GHSA-g859-9cjp-r2w8: Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.