ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-23168: The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. 

Exploitation Status: 

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.  

Workarounds or Mitigation: 

Versa recommends that Director be upgraded to one of the remediated software versions.
CVSS v3.1: 6.3
CVE-2019-16239: process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2021-21973: The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2025-15118: macrozheng mall Member Endpoint update improper authorization
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2021-24943: Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-427h-98c5-gq24: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise.
CVSS v3.1: 9.8
CVE-2025-30361: WeGIA Vulnerable to Broken Authentication - Old Password Validation
WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass authentication and authorization mechanisms to reset the password of any user, including admin accounts. Version 3.2.6 fixes the issue.
CVSS v4.0: 9.3
GHSA-5rvx-29h2-2635: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133263.
CVSS v3.0: 5.4
RHSA-2024:3708: Red Hat Security Advisory: Red Hat Build of Apache Camel 3.20.6 for Spring Boot security update.
OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) jettison: stack overflow in JSONObject() allows attackers to cause a Denial of Service (DoS) via crafted JSON data santuario: Private Key disclosure in debug-log output spring-security: Broken Access Control With Direct Use of AuthenticatedVoter springframework: URL Parsing with Host Validation cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding
CVSS v3.1: 7.4
GHSA-j4v3-wwwx-5gqv: Django Filer Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.
CVSS v3.1: 5.5
GHSA-8rp7-mg54-f432: In the Linux kernel, the following vulnerability has been resolved:drm/radeon: Do not kfree() devres managed rdevSince the allocation of the drivers main structure was changed to
devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling
kfree() on it.This fixes things exploding if the driver probe fails and devres cleans up
the rdev after we already free'd it.(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)
GHSA-m875-mcc5-r6hx: An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220301, and Build Number PlatformVER:K24-2023/05/09-v0.01 allows a remote attacker to execute arbitrary code via the ADB port component.
CVSS v3.1: 7.3
GHSA-x9p3-344r-7wm6: The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
GHSA-3hfp-gqgh-xc5g: Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
ImpactA supply chain attack on the `axios` npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (`plain-crypto-js@4.2.1`) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer's npm account to publish the malicious versions.The malicious versions were live on npm for approximately 3 hours (00:21 UTC to 03:29 UTC on March 31, 2026) before being removed.The `@lightdash/cli` package specified axios as a dependency with a semver range (`^1.12.0`) that permitted resolution to the compromised version. Any user who performed a fresh install of `@lightdash/cli` versions `>= 0.1800.0, < 0.2695.1` (without a pre-existing lockfile) during this window may have installed the malicious axios version.If compromised, the RAT establishes a connection to a command-and-control server (`sfrclak[.]com` / `142.11.206.73:8000`) and provides the attacker with shell access, file system enumeration, and the ability to execute arbitrary commands. All credentials, secrets, and tokens accessible from the affected machine should be considered compromised.Lightdash Cloud is not affected.PatchesThis has been patched in `@lightdash/cli@0.2695.1`. The fix pins axios to a known safe version (1.14.0).Users should upgrade immediately:If users had installed the compromised version, they should check for RAT artifacts before and after upgrading:macOS: `/Library/Caches/com.apple.act.mond`Windows: `%PROGRAMDATA%\wt.exe`Linux: `/tmp/ld.py`If any artifacts are found, assume full compromise of that machine and rotate all accessible credentials (warehouse credentials, API tokens, SSH keys, cloud provider credentials, environment variables).WorkaroundsIf users cannot upgrade immediately, they can force a safe axios resolution after installing the CLI:Alternatively, if users are building a Docker image or using a lockfile, they should ensure their resolved axios version is not 1.14.1 or 0.30.4:Block egress traffic to `sfrclak[.]com` and `142.11.206.73` at the network level to prevent the RAT from reaching its command-and-control server.ResourcesUpstream axios issue: https://github.com/axios/axios/issues/10604StepSecurity analysis: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojanSocket analysis: https://socket.dev/blog/axios-npm-package-compromisedSnyk advisory (axios): https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650Snyk advisory (plain-crypto-js): https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652The Hacker News coverage: https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html
CVSS v3.1: 9.6
GHSA-8859-v9jp-cphf: Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison
Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal.This could potentially allow attackers to use statistical methods to obtain a valid webhook token.As of publication of this advisory, there is no fix.
CVSS v3.1: 3.7
GHSA-v6fm-8984-7m43: In the Linux kernel, the following vulnerability has been resolved:wifi: mwifiex: fix memory leak in mwifiex_histogram_read()Always free the zeroed page on return from 'mwifiex_histogram_read()'.
CVE-1999-0882: Falcon web server allows remote attackers to determine the absolute path of the web root via long file names.
CVSS v2.0: 5
cisco-sa-20180606-prime-bypass: Cisco Prime Collaboration Provisioning Access Control Bypass Vulnerability
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their privileges.

The vulnerability is due to insufficient web portal access control checks. An attacker could exploit this vulnerability by modifying an access request. An exploit could allow the attacker to promote their account to any role defined on the system.


Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-bypass"]
CVSS v3.0: 8.8
CVE-2009-1231: Unspecified vulnerability in the eClient in IBM DB2 Content Manager 8.4.1 before 8.4.1.1 has unknown impact and attack vectors.
CVSS v2.0: 10
GHSA-4v2g-76qr-8gvj: There is a mitigation bypass / (incomplete fix) for CVE-2025-62582 (Unauthenticated Remote Database Access)An unauthenticated remote attacker can access configured databases in a DIAView project.
CVSS v3.1: 9.8
GHSA-q556-g83v-3933: Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 6.5
GHSA-w48w-95mf-vvc4: In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.<br>The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users.
CVSS v3.1: 6.5
GHSA-mpwp-42x6-4wmx: Grafana Fine-grained access control vulnerability
ImpactOn Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.PatchesFixed in 8.2.4WorkaroundsAll installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a [feature flag](https://grafana.com/docs/grafana/latest/enterprise/access-control/#enable-fine-grained-access-control/).Grafana Cloud instances have not been affected by the vulnerability.Reporting security issuesIf you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint isF988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CAThe key is available from keyserver.ubuntu.com.Security announcementsWe maintain a [security category on our blog](https://grafana.com/tags/security/), where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.You can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).
CVSS v3.1: 9.1
GHSA-gc8h-qjvm-5f2g: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and  9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
CVSS v3.1: 5.5
CVE-2021-24754: MainWP Child Reports < 2.0.8 - Admin+ SQL Injection
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2024-2804: Network Summary <= 2.0.11 - Unauthenticated SQL Injection
The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 9.8
GHSA-m7vq-f4cp-vwc4: Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
CVSS v3.0: 5.3
CVE-2018-19881: In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from excessive stack consumption) via a crafted svg file, as demonstrated by mupdf-gl.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2021-37446: In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file reading.
CVSS v3.1: 4.3
CVSS v2.0: 4
CVE-2018-9487: In setVpnForcedLocked of Vpn.java, there is a possible blocking of internet traffic through vpn due to a bad uid check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS v3.1: 6.5
CVE-2014-4107: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-2799, CVE-2014-4059, CVE-2014-4065, CVE-2014-4079, CVE-2014-4081, CVE-2014-4083, CVE-2014-4085, CVE-2014-4088, CVE-2014-4090, CVE-2014-4094, CVE-2014-4097, CVE-2014-4100, CVE-2014-4103, CVE-2014-4104, CVE-2014-4105, CVE-2014-4106, CVE-2014-4108, CVE-2014-4109, CVE-2014-4110, and CVE-2014-4111.
CVSS v2.0: 9.3
GHSA-xr2w-pmx3-6j4j: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS v3.1: 5.4
CVE-2015-0518: The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions.
CVSS v2.0: 9
CVE-2025-20029: BIG-IP iControl REST and tmsh vulnerability
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2002-1025: JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed.
CVSS v2.0: 5
CVE-2024-4324: WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
The WP Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2005-4418: util-vserver before 0.30.208-1 with kernel-patch-vserver before 1.9.5.5 and 2.x before 2.3 for Debian GNU/Linux sets a default policy that trusts unknown capabilities, which could allow local users to conduct unauthorized activities.
CVSS v2.0: 7.5
CVE-2022-28120: Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2014-9036: Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.
CVSS v2.0: 4.3
CVE-2007-6212: Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the layer parameter.
CVSS v2.0: 5
GHSA-7mc2-gx2g-pj8r: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.
CVSS v3.1: 8.8
RHSA-2016:0371: Red Hat Security Advisory: nss security update
nss: Heap buffer overflow vulnerability in ASN1 certificate parsing (MFSA 2016-35)
GHSA-qvcx-wpfr-c8wc: cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
CVSS v3.1: 9.8
CVE-2015-1962: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
CVSS v2.0: 7.8
GHSA-66r7-7rjm-h7pp: SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcCallReceive request, a different vulnerability than CVE-2003-0747.
GHSA-rw3j-574h-mrcq: IDOR vulnerability in account profile page
ImpactInsecure direct object reference allowing an attacker to disable subscriptions and reviews of another customer
CVSS v4.0: 6.9
CVSS v3.0: 5.3
CVE-2019-8675: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. An attacker in a privileged network position may be able to execute arbitrary code.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-cr43-57pq-9qgj: Unrestricted Upload of File with Dangerous Type vulnerability in NgocCode WP Load Gallery allows Upload a Web Shell to a Web Server. This issue affects WP Load Gallery: from n/a through 2.1.6.
CVSS v3.1: 9.1
GHSA-rvpx-3mwh-gfp7: PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with SYSTEM privileges. Affected products include Panda Global Protection 2016, Panda Antivirus Pro 2016, Panda Small Business Protection, and Panda Internet Security 2016 (all versions up to 16.1.2).
CVSS v4.0: 8.5
CVE-2022-47325: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVSS v3.1: 6.4
GHSA-982f-wr97-9jm3: A vulnerability was found in SourceCodester Online Jewelry Store 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file customer.php of the component POST Parameter Handler. The manipulation of the argument Custid leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229820.
CVSS v3.0: 3.5
GHSA-v5rv-9c87-6gww: FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.
GHSA-j87v-mhh9-96qj: A vulnerability was found in Kashipara College Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file submit_admin.php. The manipulation of the argument phone leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263923.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2021-24597: You Shang <= 1.0.1 - Authenticated Stored Cross-Site Scripting
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-c9qv-gcm2-25qg: Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network.
CVSS v3.1: 8.8
GHSA-mj42-rq3r-4p7q: Multiple directory traversal vulnerabilities in cache.php in osCommerce before 2.2 Milestone 2 060817 allow remote attackers to determine existence of arbitrary files and disclose the installation path via a .. (dot dot) in unspecified parameters in the (1) tep_cache_also_purchased, (2) tep_cache_manufacturers_box, and (3) tep_cache_categories_box functions.
RHSA-2025:22753: Red Hat Security Advisory: xorg-x11-server security update
xorg: xmayland: Use-after-free in XPresentNotify structure creation xorg: xwayland: Use-after-free in Xkb client resource removal xorg: xmayland: Value overflow in XkbSetCompatMap()
CVSS v3.1: 7.3
GHSA-5xj4-3cf7-r6mm: An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
CVSS v3.1: 5.5