ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-gv9x-4r58-jfcv: The WordPress Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wp_charts' shortcode in versions up to, and including, 0.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2016-3022: IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.
CVSS v3.1: 6.5
CVSS v2.0: 4
GHSA-8hx5-7g7v-wpr9: In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-485p-gmh5-r688: Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This vulnerability allows attackers to execute arbitrary code via supplying a crafted update package to the /#/software/upgrades endpoint.
CVSS v3.1: 9.8
CVE-2023-29479: Ribose RNP before 0.16.3 may hang when the input is malformed.
CVSS v3.1: 5.3
CVE-2022-30469: In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page=grid` leads to SQL injection.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-rf9w-7f29-2cx2: Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
CVSS v3.1: 7.2
GHSA-wmfv-f2cm-4wp3: The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISC_PASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password.
CVE-2018-0531: Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to view or alter an access privilege of a folder and/or notification settings via unspecified vectors.
CVSS v3.0: 4.3
CVSS v2.0: 4
RHSA-2003:119: Red Hat Security Advisory: micq security update
security flaw
CVE-2025-1437: Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2024.5, and later improved in version 2025.3.
CVSS v3.1: 6.4
GHSA-33v4-r73r-584j: The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS v3.1: 5.4
CVE-2026-41157: GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.



The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
CVSS v3.1: 9.8
GHSA-xx68-jfcg-xmmf: Commons FileUpload Denial of service vulnerability
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
GHSA-j6f2-xv6r-9x28: LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp.
CVE-2025-22600: WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `configuracao_doacao.php` parameter `avulso`
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter. This vulnerability is fixed in 3.2.8.
CVSS v4.0: 6.4
CVE-2026-40740: WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.
CVSS v3.1: 5.4
GHSA-q965-2pff-h2w4: A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
CVSS v3.0: 8.1
GHSA-9gx8-7m79-g5p3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS.This issue affects Shopkeeper Extender: from n/a through < 7.0.
CVSS v3.1: 6.5
GHSA-q4cm-g2jm-8qx9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Figoli Quinn & Associates Mobile Kiosk allows Stored XSS.This issue affects Mobile Kiosk: from n/a through 1.3.0.
CVSS v3.1: 6.5
GHSA-3j29-mf87-fv7c: An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33352393. References: QC-CR#1101943.
CVSS v3.0: 4.7
CVE-2018-18548: ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-26jg-rrff-qqvf: FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.
GHSA-h86q-fx34-gfjr: n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
ImpactAn endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL.PatchesThe issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later to remediate the vulnerability.WorkaroundsIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:Limit workflow creation and activation permissions to fully trusted users only.Disable the affected nodes by adding `n8n-nodes-base.facebookTrigger`, `n8n-nodes-base.whatsAppTrigger`, `n8n-nodes-base.facebookLeadAdsTrigger`, and `n8n-nodes-base.microsoftTeamsTrigger` to the `NODES_EXCLUDE` environment variable.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
CVSS v4.0: 6.8
CVSS v3.1: 7.6
GHSA-jwwr-fjgh-cv2x: Improper Restriction of XML External Entity Reference in Castor
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
GHSA-qjgx-x6g2-mq8x: IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user or obtain sensitive information. IBM X-Force ID: 191105.
CVE-2026-39387: BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter
BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
CVSS v3.1: 7.2
CVE-2017-5243: The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.
CVSS v3.0: 8.5
CVSS v2.0: 6.8
CVE-2021-33707: SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
CVSS v3.0: 6.1
CVE-2021-41990: The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example, this can be triggered by an unrelated self-signed CA certificate sent by an initiator. Remote code execution cannot occur.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2014-0125: repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.
CVSS v2.0: 5.8
CVE-2022-26308: Improper Access Control in Configuration (Credential store)
Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role.
CVSS v3.1: 3.7
GHSA-39qv-prmh-x37f: Prototype Pollution in @strikeentco/set
This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821
CVSS v3.1: 7.5
CVE-2023-40463: Use of Hard-Coded Credentials










When configured in
debugging mode by an authenticated user with



administrative
privileges, ALEOS 4.16 and earlier store the SHA512



hash of the common
root password for that version in a directory



accessible to a user
with root privileges or equivalent access.








CVSS v3.1: 8.1
GHSA-c538-9356-xgvr: Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an authenticated user could change the ID parameter to retrieve all the stored information of other registered users.
CVSS v3.1: 5.3
RHSA-2013:0907: Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update
vdsm: unfiltered guestInfo dictionary DoS kernel: kvm: pv_eoi guest updates with interrupts disabled
GHSA-f846-m55f-g9fw: A vulnerability has been identified in Simcenter Femap (All versions < V2401.0000), Simcenter Femap (All versions < V2306.0001). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted Catia MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22055)
CVSS v3.1: 7.8
CVE-2024-28923: Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
CVSS v3.1: 6.4
GHSA-vvr9-4v54-jx9g: In the Linux kernel, the following vulnerability has been resolved:dmaengine: apple-admac: Fix 'current_tx' not getting freedIn terminate_all we should queue up all submitted descriptors to be
freed. We do that for the content of the 'issued' and 'submitted' lists,
but the 'current_tx' descriptor falls through the cracks as it's
removed from the 'issued' list once it gets assigned to be the current
descriptor. Explicitly queue up freeing of the 'current_tx' descriptor
to address a memory leak that is otherwise present.
GHSA-q722-mhcx-9m8w: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions.
CVSS v3.1: 5.5
CVE-2017-17653: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NVBUBackupOptionSet Get method requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the underlying database. Was ZDI-CAN-4286.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-jmr9-w49w-87vw: Multiple directory traversal vulnerabilities in SG Real Estate Portal 2.0 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) mod, (2) page, or (3) lang parameter to index.php; or the (4) action or (5) folder parameter in a security request to admin/index.php.
CVE-2025-60661: Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function.
CVSS v3.1: 5.3
CVE-2021-44138: There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-g3p6-qm7w-r5mq: Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVSS v3.0: 8.6
GHSA-mrpf-pxxj-fmc7: index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability
GHSA-g8x8-9hp6-3ppj: iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal Key in world-readable %PROGRAMDATA% log files. The encryption is done using a hard-coded static key and is therefore reversible by an attacker.
CVSS v3.1: 3.3
GHSA-qjpw-c5xf-g33j: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS v3.1: 8.8
CVE-2014-5591: The Frankly Chat (aka com.chatfrankly.android) application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
CVE-2022-44699: Azure Network Watcher Agent Security Feature Bypass Vulnerability
Azure Network Watcher Agent Security Feature Bypass Vulnerability
CVSS v3.1: 5.5
CVE-2024-12661: IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E024 null pointer dereference
A vulnerability was found in IObit Advanced SystemCare Utimate up to 17.0.0. It has been rated as problematic. Affected by this issue is the function 0x8001E024 in the library AscRegistryFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 6.8
CVSS v3.1: 5.5
CVSS v3.0: 5.5
CVSS v2.0: 4.6
GHSA-74m4-g2cc-pm5f: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, race condition in diag_dbgfs_read_dcistats(), while accessing diag_dbgfs_dci_data_index, causes potential heap overflow.
CVSS v3.0: 7
GHSA-7x5x-2w9j-9v7x: The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v3.0: 5.9
CVE-2019-8837: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. A malicious application may be able to access restricted files.
CVSS v3.1: 7.8
CVSS v2.0: 9.3
CVE-2026-7865: Hidden Console Command
A hidden console command is vulnerable to command injection
flaw when control characters are passed to its second argument. 

A third party researcher Eugene Lim had discovered vulnerability
in the way console command passes to a popen function call. Attackers with
authenticated access to SSH console of Crestron devices may use to run
underlying OS commands.
CVSS v4.0: 7.4
CVE-2023-1483: XiaoBingBy TeaCMS getallarticleinfo sql injection
A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-5j3v-wvv7-9rvc: In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: fix double free err_addr pointer warningsIn amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages
will be run many times so that double free err_addr in some special case.
So set the err_addr to NULL to avoid the warnings.
CVSS v3.1: 5.5
RHSA-2020:0006: Red Hat Security Advisory: java-1.8.0-ibm security update
OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) JDK: unspecified vulnerability fixed in 8u221 (Deployment) OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) JDK: Unrestricted access to diagnostic operations
CVSS v3.0: 8.4
CVE-2021-3063: PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.
CVSS v3.1: 7.5
GHSA-jrgc-m5wf-7pch: A heap out-of-bounds read/write vulnerability in the Linux Kernel traffic control (QoS) subsystem can be exploited to achieve local privilege escalation.The qfq_change_class function does not properly limit the lmax variable which can lead to out-of-bounds read/write. If the TCA_QFQ_LMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1 and as a result, it is possible to have an lmax value that exceeds QFQ_MIN_LMAX.We recommend upgrading past commit 3037933448f60f9acb705997eae62013ecb81e0d.
CVSS v3.1: 7.8
CVE-2025-11571: Command Execution vulnerability in Simplicity Installer
Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to execute can open executables. However, the commands cannot pass parameters or arguments. 
To successfully execute this attack, the attacker needs to be on the same network.
CVSS v4.0: 2.1
GHSA-cqcc-3gx2-8vg9: SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.
CVSS v4.0: 8.7
CVE-2017-10169: Vulnerability in the Oracle Hospitality 9700 component of Oracle Hospitality Applications (subcomponent: Operation Security). The supported version that is affected is 4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality 9700 executes to compromise Oracle Hospitality 9700. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality 9700 accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVSS v3.0: 5.5
CVSS v2.0: 2.1
GHSA-hf5g-2885-9hqq: Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom.