ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2025-37159: Authenticated Session Hijacking Allows Unauthorized Access in Network Switching Software
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.
CVSS v3.1: 5.8
GHSA-c9gh-426m-j894: Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify action.
GHSA-33fq-qm4m-cjw3: baserCMS Access Control Bypass
baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
CVSS v3.0: 5.3
CVE-2023-5177: Vrm 360 3D Model Viewer <= 1.2.1 - Full Path Disclosure
The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode.
CVSS v3.1: 5.3
CVE-2024-57990: wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7925: fix off by one in mt7925_load_clc()

This comparison should be >= instead of > to prevent an out of bounds
read and write.
CVSS v3.1: 7.8
CVE-1999-0819: NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.
CVSS v2.0: 5
GHSA-4wqw-j3vx-3hwj: There is a multiple threads race condition vulnerability in Huawei product. A race condition exists for concurrent I/O read by multiple threads. An attacker with the root permission can exploit this vulnerability by performing some operations. Successful exploitation of this vulnerability may cause the system to crash. Affected product versions include: ManageOne 6.5.1.SPC200, 8.0.0,8.0.0-LCND81, 8.0.0.SPC100, 8.0.1,8.0.RC2, 8.0.RC3, 8.0.RC3.SPC100;SMC2.0 V600R019C10SPC700,V600R019C10SPC702, V600R019C10SPC703,V600R019C10SPC800, V600R019C10SPC900, V600R019C10SPC910, V600R019C10SPC920, V600R019C10SPC921, V600R019C10SPC922, V600R019C10SPC930, V600R019C10SPC931
GHSA-fhv8-m4j4-cww2: Gitea allowed assignment of private issues
In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
CVSS v3.1: 6.5
CVE-2022-48336: Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buffer overflow.
CVSS v3.1: 9.8
GHSA-w7f5-jrpr-5c2m: Apache Calcite Avatica JDBC driver arbitrary code execution
Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.
CVSS v3.1: 8.8
GHSA-9958-5776-jcp6: A vulnerability was found in SourceCodester Online Medicine Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /view_category.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVE-2008-2517: The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.
CVSS v2.0: 2.1
GHSA-w6ww-5j2q-3f3c: In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-68217699.
CVSS v3.0: 7.8
GHSA-fpx2-725v-hxc2: Video Insight VMS 7.5 and earlier allows remote attackers to conduct code injection attacks via unspecified vectors.
CVSS v3.1: 9.8
GHSA-c59p-8p3r-xcm3: Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). Supported versions that are affected are 8.5.4 and 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).
GHSA-6vvc-45wx-gh3g: Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.
CVSS v3.1: 5.4
GHSA-r4g2-wc92-p3r9: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley MicroStation CONNECT 10.16.0.80. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15409.
CVE-2025-31893: WordPress Botnet Attack Blocker plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
CVSS v3.1: 6.5
GHSA-6rvj-pw9w-jcvc: Information disclosure vulnerability in OnionShare
An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
CVE-2025-58135: Zoom Workplace Clients for Windows - Improper Action Enforcement
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access.
CVSS v3.1: 5.3
GHSA-692c-fcwq-76xf: In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 6.8
GHSA-j53j-3fvf-64m5: Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-28gc-vvw4-44jg: files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence.
GHSA-66m2-cpmm-mc9x: A vulnerability, which was classified as problematic, has been found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. This issue affects some unknown processing of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\common\js\addDate\date.jsp of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVE-2022-50977: Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.
CVSS v3.1: 7.5
CVE-2016-9288: In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2019-8260: UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1200.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2011-0643: Cross-site request forgery (CSRF) vulnerability in admin/conf_users_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via the N action.
CVSS v2.0: 6.8
GHSA-qxc4-hf32-x4jr: Hummingbird FTP for Connectivity 10.0 uses weak encryption (trivial encoding) to store the user's password in the FTP profile, which allows attackers to gain privileges.
GHSA-9jrh-5pwj-wfmp: The newly introduced  RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c  in
malcontent-timerd allows arbitrary users in the system to slowly fill up disk space
in /var/lib/malcontent-timerd
CVSS v4.0: 5.1
CVE-2022-4573: 

An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code.


CVSS v3.1: 6.7
GHSA-rp9w-3fw7-7cwq: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
If the HTML you give it contains a <template> element, and inside that template there's an element with a shadow DOM attached to it, DOMPurify quietly skips over the shadow contents. Whatever the attacker put in there - an image with an onerror handler, a link with a javascript: URL, even a full script - survives untouched. The moment the application uses that template the way templates are meant to be used (cloning it and inserting the result into the page), the malicious payload comes along and runs as if it had never been sanitized. From there an attacker gets everything XSS normally gets them: session cookies, stored tokens, the ability to act as the user, and the ability to leave persistent payloads behind for the next person who visits.[advisory.pdf](https://github.com/user-attachments/files/28275600/advisory.pdf)[poc.html](https://github.com/user-attachments/files/28275708/poc.html)
CVSS v4.0: 5.1
CVE-2025-31741: WordPress Easy Magazine plugin <= 2.1.13 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filtr8 Easy Magazine filtr8-magazine allows DOM-Based XSS.This issue affects Easy Magazine: from n/a through <= 2.1.13.
CVSS v3.1: 6.5
CVE-2013-1253: Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
CVSS v3.1: 7
CVSS v2.0: 4.9
GHSA-xwgw-jc7m-j3m4: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within heapdumps.jsp. The issue results from the lack of proper validation of a user-supplied string before using it to download heap memory dump. An attacker can leverage this in conjunction with other vulnerabilities to disclose sensitive information in the context of the current process. Was ZDI-CAN-4718.
CVSS v3.0: 7.5
CVE-2023-40472: PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability
PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of strings. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20730.
CVSS v3.0: 7.8
GHSA-xw9v-5wrh-424g: vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code.
GHSA-ghx6-2rmh-c36g: Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the admin screen with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the admin screen.
CVSS v3.0: 4.8
RHSA-2022:6913: Red Hat Security Advisory: .NET 6.0 security and bugfix update
dotnet: Nuget cache poisoning on Linux via world-writable cache directory
CVSS v3.1: 7.8
CVE-2022-25873: Cross-site Scripting (XSS)
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
CVSS v3.1: 4.6
CVE-2025-20021: Arkcompiler Ets Runtime has an out-of-bounds read vulnerability
in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through  out-of-bounds read.
CVSS v3.1: 3.3
CVE-2024-46947: Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.
CVSS v3.1: 6.5
GHSA-82vg-p6h3-hr69: A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.
CVSS v3.1: 8.8
CVE-2016-3369: Microsoft Windows 10 Gold and 1511 allows attackers to cause a denial of service via unspecified vectors, aka "Windows Denial of Service Vulnerability."
CVSS v3.0: 7.5
CVSS v2.0: 7.8
GHSA-j647-j6p7-jhrq: Multiple buffer overflows in (1) the Message Engine and (2) AScore.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2026-24091: Improper Validation of Syntactic Correctness of Input in Display
Memory corruption while processing fastboot commands with improperly formatted input.
CVSS v3.1: 7.2
CVE-2026-44168: MariaDB: wsrep SST unsafe parameter handling on the donor side
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2.
CVSS v3.1: 8
PYSEC-2024-97: ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils.

This issue affects Apache Submarine Commons Utils: from 0.8.0.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


CVSS v3.1: 9.8
CVE-2025-0620: Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
CVSS v3.1: 4.9
GHSA-4f24-3c6c-gh99: The Content Views – Post Grid, Slider, Accordion (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 4.4
GHSA-p3m8-36cj-96jw: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affects Easy Invoice: from n/a through <= 2.0.9.
CVSS v3.1: 7.1
CVE-2017-12587: ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2025-4813: PHPGurukul Human Metapneumovirus Testing Management System edit-phlebotomist.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /edit-phlebotomist.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2026-5217: Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the user-supplied 's' parameter (srcset descriptor) in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint. The endpoint validates requests using an HMAC signature and timestamp, but these values are exposed directly in the frontend HTML making them accessible to any visitor. The plugin uses sanitize_text_field() on the descriptor value of rest.php, which strips HTML tags but does not escape double quotes. The poisoned descriptor is then stored via transients (backed by the WordPress options table) and later retrieved and injected verbatim into the srcset attribute of tag_replacer.php without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
CVSS v3.1: 7.2
GHSA-96pw-chjq-6cfv: Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings allows Cross Site Request Forgery. This issue affects Advanced Settings: from n/a through 3.0.1.
CVSS v3.1: 4.3
GHSA-cr57-r5gm-397j: Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVE-2019-2245: Possible integer underflow can happen when calculating length of elementary stream map from invalid packet length which is later used to read from input buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016
CVSS v3.0: 9.8
CVSS v2.0: 10
GHSA-p84c-pfqc-c27p: An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).On EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) a high volume of traffic destined to the device will cause an FXPC crash and restart, which leads to a complete service outage until the device has automatically restarted.The following reboot reason can be seen in the output of 'show chassis routing-engine' and as a log message:reason=0x4000002 reason_string=0x4000002:watchdog + panic with core dumpThis issue affects Junos OS on EX4000-48T, EX4000-48P and EX4000-48MP:24.4 versions before 24.4R2,25.2 versions before 25.2R1-S2, 25.2R2.This issue does not affect versions before 24.4R1 as the first Junos OS version for the EX4000 models was 24.4R1.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
RHSA-2012:0734: Red Hat Security Advisory: java-1.6.0-sun security update
JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) OpenJDK: improper protection of CORBA data models (CORBA, 7079902) OpenJDK: fontmanager layout lookup code memory corruption (2D, 7143617) OpenJDK: SynthLookAndFeel application context bypass (Swing, 7143614) OpenJDK: insecure temporary file permissions (JRE, 7143606) OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872) OpenJDK: mutable repository identifiers in generated stub code (CORBA, 7143851) JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) JDK: unspecified vulnerability fixed in 6u33 and 7u5 (Deployment) OpenJDK: insufficient field accessibility checks (HotSpot, 7152811) OpenJDK: XML parsing infinite loop (JAXP, 7157609) OpenJDK: insufficient invokespecial <init> verification (HotSpot, 7160757)
GHSA-x574-8pvh-x36m: SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 allows remote attackers to execute arbitrary SQL commands via the userID parameter.
CVE-2025-13670: High Level Synthesis Compiler Security Advisory
The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability
CVSS v4.0: 5.4
CVSS v3.1: 6.7
GHSA-7fcj-73p6-72jw: SQL injection vulnerability in listing_view.php in Web Directory Script 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the name parameter.
CVE-2006-2561: Edimax BR-6104K router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter (possibly within NewInternalClient), which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
CVSS v2.0: 7.5