ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-996x-56fr-67x6: Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
RHSA-2023:5474: Red Hat Security Advisory: bind security update
bind: stack exhaustion in control channel code may lead to DoS
CVSS v3.1: 7.5
GHSA-p8qq-75v8-px25: The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user role.
CVSS v3.1: 8.8
CVE-2014-5675: The Phonegram - Instagram Download (aka com.pinssible.padgram) application 1.9.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
RHSA-2026:33731: Red Hat Security Advisory: rrdtool security update
rrdtool: rrdtool: Stack buffer overflow allows local code execution or denial of service
CVSS v3.1: 7.8
GHSA-6645-5w8p-3ww5: Cross-site scripting (XSS) vulnerability in inc_header.php in EJ3 TOPo 2.2.178 allows remote attackers to inject arbitrary web script or HTML via the gTopNombre parameter.
CVE-2024-47175: libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
CUPS is a standards-based, open-source printing system, and `libppd` can be used for legacy PPD file support. The `libppd` function `ppdCreatePPDFromIPP2` does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. This vulnerability can be part of an exploit chain leading to remote code execution (RCE), as described in CVE-2024-47176.
CVSS v3.1: 8.6
GHSA-mgm9-mwp5-9w5r: BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
CVE-2021-24869: WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection
The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber
CVSS v3.1: 8.8
CVE-2013-6020: passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the (1) Assessor, (2) Recorder, or (3) Treasurer application.
CVSS v2.0: 5.8
GHSA-5fpx-mqj4-mr33: A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.
CVSS v3.1: 5.4
GHSA-4c9c-3725-v3v6: A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker with administrative privileges to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web UI. An exploit could allow the attacker to read arbitrary files from the underlying operating system's filesystem.
CVSS v3.1: 4.9
CVE-2016-0135: The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
CVSS v3.0: 8.4
CVSS v2.0: 7.2
GHSA-q5qp-pg7v-4wp3: An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call, resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.
CVSS v3.1: 8.8
GHSA-mxf2-xjp5-4w4p: Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
GHSA-v5r3-jpr8-77vx: Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.
CVSS v3.0: 8.8
CVE-2025-22763: WordPress Brizy Pro Plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.
CVSS v3.1: 7.1
CVE-2022-49743: ovl: Use "buf" flexible array for memcpy() destination
In the Linux kernel, the following vulnerability has been resolved:

ovl: Use "buf" flexible array for memcpy() destination

The "buf" flexible array needs to be the memcpy() destination to avoid
false positive run-time warning from the recent FORTIFY_SOURCE
hardening:

  memcpy: detected field-spanning write (size 93) of single field "&fh->fb"
  at fs/overlayfs/export.c:799 (size 21)
CVSS v3.1: 5.5
GHSA-wf69-r4mx-43rr: AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration
Vulnerability Details**CWE**: CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or DirectoryThe official `docker-compose.yml` (line 61) mounts the entire project root directory as the Apache document root:This causes the `.env` file — which contains database credentials, admin passwords, and infrastructure configuration — to be served as a static file at `/.env`. No `.htaccess` rule or Apache configuration blocks access to dotfiles.Exposed InformationAn unauthenticated request to `GET /.env` returns:Steps to ReproducePrerequisitesAVideo deployed using the official `docker-compose.yml`No modifications to the default configurationStepsDeploy AVideo using `docker compose up -d`Send: `curl http://target/.env`The full `.env` file contents are returned, including database credentials and admin passwordImpact**Attacker**: Unauthenticated (any remote user)**Victim**: AVideo server and database**Specific damage**: Attacker obtains database credentials (`DB_MYSQL_USER`, `DB_MYSQL_PASSWORD`), admin password (`SYSTEM_ADMIN_PASSWORD`), and internal network topology (`NETWORK_SUBNET`). This enables direct database access, admin panel takeover, and further lateral movement within the Docker network.Proposed FixAdd a `.htaccess` rule to block access to dotfiles:Or configure Apache to deny dotfile access in the virtual host configuration.
CVSS v3.1: 7.5
CVE-2024-8096: OCSP stapling bypass with GnuTLS
When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate.
CVSS v3.1: 6.5
CVE-2024-21820: Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS v4.0: 8.5
CVSS v3.1: 7.2
GHSA-jcjw-279r-m433: Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CVSS v4.0: 5.9
GHSA-rc42-jghf-vr8f: Integer overflow in publify_core
Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10 due to an unlimited length user name field.
CVSS v3.1: 9.8
CVE-2018-1715: IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 147003.
CVSS v3.0: 5.4
CVE-2006-6669: Cross-site scripting (XSS) vulnerability in export_handler.php in WebCalendar 1.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter.
CVSS v2.0: 6.8
CVE-2009-2591: SQL injection vulnerability in the MyAnnonces module for E-Xoopport 3.1 allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewannonces action to index.php.
CVSS v2.0: 7.5
GHSA-fh32-5f73-8pwm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: from n/a through 2.6.7.
CVSS v3.1: 6.5
GHSA-wj24-m2m7-q8x2: A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the remote code execution on the device.
CVSS v3.0: 6.5
CVE-2023-49330: Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.
CVSS v3.1: 8.3
RHSA-2008:0005: Red Hat Security Advisory: httpd security update
httpd: out of bounds read mod_autoindex XSS httpd: mod_imagemap XSS apache mod_status cross-site scripting mod_proxy_ftp XSS
GHSA-gccr-pgwc-7hq4: Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS v3.1: 6.5
GHSA-94p4-4m9q-5m8x: In the Linux kernel, the following vulnerability has been resolved:drm/xe/tracing: Fix a potential TP_printk UAFThe commit
afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format")
exposes potential UAFs in the xe_bo_move trace event.Fix those by avoiding dereferencing the
xe_mem_type_to_name[] array at TP_printk time.Since some code refactoring has taken place, explicit backporting may
be needed for kernels older than 6.10.
CVSS v3.1: 7.8
CVE-2016-10459: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 800, SD 810, and SD 820, during a call, memory exhaustion can occur.
CVSS v3.0: 7.5
CVSS v2.0: 7.8
CVE-2025-24861: Outback Power Mojave Inverter Command Injection
An attacker may inject commands via specially-crafted post requests.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
GHSA-rgc3-g75g-jr7f: The nsDocShell::OnRedirectStateChange function in docshell/base/nsDocShell.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to spoof the SSL security status of a document via vectors involving multiple requests, a redirect, and the history.back and history.forward JavaScript functions.
GHSA-vgf3-fpxc-h968: openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details from modules/messaging/SentMail.php by supplying an arbitrary mail_id value.
CVSS v4.0: 7.1
CVE-2021-43509: SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-hpx2-94g6-74r5: Vulnerability in iPlanet Web Server Enterprise Edition 4.x.
CVE-2007-0734: fsck, as used by the AirPort Disk feature of the AirPort Extreme Base Station with 802.11n before Firmware Update 7.1, and by Apple Mac OS X 10.3.9 through 10.4.9, does not properly enforce password protection of a USB hard drive, which allows context-dependent attackers to list arbitrary directories or execute arbitrary code, resulting from memory corruption.
CVSS v2.0: 5.4
CVE-2022-36472: H3C B5 Mini B5MiniV100R005 was discovered to contain a stack overflow via the function SetMobileAPInfoById.
CVSS v3.1: 7.8
CVE-2024-21351: Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVSS v3.1: 7.6
CVE-2019-12118: An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-47qg-3w6c-7g7q: OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
CVSS v3.1: 3.3
GHSA-v52j-76fx-xfcf: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.
QuTScloud, QVR, QES are not affected.We have already fixed the vulnerability in the following versions:
QTS 4.5.4.2790 build 20240605 and later
QuTS hero h4.5.4.2626 build 20231225 and later
CVSS v3.1: 8.8
CVE-2021-44854: An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis.
CVSS v3.1: 5.3
GHSA-5g4h-3xj2-7jr8: Missing Authorization vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.
CVSS v3.1: 4.3
CVE-2023-34408: DokuWiki before 2023-04-04a allows XSS via RSS titles.
CVSS v3.1: 5.4
GHSA-pc3r-489c-2frh: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests.
CVSS v3.1: 5.3
GHSA-7xh5-rwr6-4qv9: Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS v3.1: 6.5
CVE-2020-28026: Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary commands as root.
CVSS v3.1: 9.8
CVSS v2.0: 9.3
CVE-2020-7993: Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
CVSS v3.1: 4.3
CVSS v2.0: 4
CVE-2019-15247: Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.
CVSS v3.0: 8
CVE-2022-0825: Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
CVSS v3.1: 5.4
CVSS v2.0: 5.5
CVE-2004-1465: Multiple buffer overflows in WinZip 9.0 and earlier may allow attackers to execute arbitrary code via multiple vectors, including the command line.
CVSS v2.0: 3.7
GHSA-wfm5-v35h-vwf4: GitPython untrusted search path on Windows systems leading to arbitrary code execution
SummaryWhen resolving a program, Python/Windows look for the current working directory, and after that the PATH environment (see big warning in https://docs.python.org/3/library/subprocess.html#popen-constructor). GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`.DetailsThis is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo.The execution of the `git` command happens inhttps://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L277https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/cmd.py#L983-L996And there are other commands executed that should probably be aware of this problem.PoCOn a Windows system, create a `git.exe` or `git` executable in any directory, and import or run GitPython from that directoryThe git executable from the current directory will be run.ImpactAn attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands.Possible solutionsDefault to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation).Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems.Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path.Resolve the executable manually by only looking into the `PATH` environment variable (suggested by @Byron)[!NOTE]
This vulnerability was reported via email, and it was decided to publish it here and make it public, so the community is aware of it, and a fix can be provided.
CVSS v4.0: 8.6
CVSS v3.1: 7.8
CVE-2014-7203: libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
CVSS v2.0: 4.3
CVE-2022-29164: Privilege Escalation in argo-workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running. As the script has access to the Argo Server API (as the victim), so may read information about the victim’s workflows, or create and delete workflows. Note the attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. The attacker must have an understanding of the victim’s system. We have seen no evidence of this in the wild. We urge all users to upgrade to the fixed versions.
CVSS v3.1: 7.1
GHSA-w46c-9jvj-8r29: The affected product allows firmware updates to be downloaded from EG4's
 website, transferred via USB dongles, or installed through EG4's 
Monitoring Center (remote, cloud-connected interface) or via a serial 
connection, and can install these files without integrity checks. The 
TTComp archive format used for the firmware is unencrypted and can be 
unpacked and altered without detection.
CVSS v4.0: 8.6
CVSS v3.1: 8.8
GHSA-m462-mqw4-2c8m: Mattermost Server has X.509 Improper Certificate Validation
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
CVSS v3.1: 9.1
CVE-2024-20815: Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackers connect to victim&#39;s mobile hotspot without user awareness.
CVSS v3.1: 8
GHSA-q93p-853g-487m: Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GHSA-34jv-m534-q8qr: mailboxd in Zimbra Collaboration Suite 8.8 before 8.8.8; 8.7 before 8.7.11.Patch3; and 8.6 allows Account Enumeration by leveraging a Discrepancy between the "HTTP 404 - account is not active" and "HTTP 401 - must authenticate" errors.
CVSS v3.0: 5.3
GHSA-46hr-m6rf-q355: Memory corruption while processing data packets in diag received from Unix clients.
CVSS v3.1: 7.8
CVE-2010-2138: Multiple directory traversal vulnerabilities in ProMan 0.1.1 and earlier allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SESSION[userLang] parameter to (1) elisttasks.php, (2) managepmanagers.php, (3) manageusers.php, (4) helpfunc.php, (5) managegroups.php, (6) manageprocess.php, and (7) manageusersgroups.php.
CVSS v2.0: 6.8
CVE-2026-45633: Dokploy: Command Injection in /docker-container-logs Endpoint
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.6 and earlier, Dokploy contains a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.
CVSS v3.1: 9.9
CVE-2017-0935: Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.
CVSS v3.1: 8.8
CVSS v2.0: 9
CVE-2011-1246: Microsoft Internet Explorer 8 does not properly handle content settings in HTTP responses, which allows remote web servers to obtain sensitive information from a different (1) domain or (2) zone via a crafted response, aka "MIME Sniffing Information Disclosure Vulnerability."
CVSS v2.0: 4.3
GHSA-4r48-25qj-vjg2: An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "HFS" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8