ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-jrm8-xgf3-fwqr: MobSF Partial Denial of Service (DoS)
Partial Denial of Service (DoS)**Product:** MobSF
**Version:** v4.2.9
**CWE-ID:** CWE-1287: Improper Validation of Specified Type of Input
**CVSS vector v.4.0:** 6.9 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
**CVSS vector v.3.1:** 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
**Description:**  DoS in the Scans Results and iOS Dynamic Analyzer functionality 
**Impact:** Leveraging this vulnerability would make Scans Results and iOS Dynamic Analyzer pages unavailable.
**Vulnerable component:** urls.py
https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/d1d3b7a9aeb1a8c8c7c229a3455b19ade9fa8fe0/mobsf/MobSF/urls.py#L401
**Exploitation conditions:** A malicious application was uploaded to the MobSF.
**Mitigation:** Check the uploaded bundle IDs against the regex.
**Researcher: Oleg Surnin (Positive Technologies)**ResearchResearcher discovered zero-day vulnerability Partial Denial of Service (DoS) in MobSF in the Scans Results and iOS Dynamic Analyzer functionality.
According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.).
(https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleidentifier)
However, an attacker can manually modify this value in `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value.
In the `urls.py` file URL rules are defined.
https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/d1d3b7a9aeb1a8c8c7c229a3455b19ade9fa8fe0/mobsf/MobSF/urls.py#L401*Listing 3.*When the application parses the wrong characters in the bundle ID, it encounters an error.
As a result, it will not display content and will throw a 500 error instead. The only way to make the pages work again is to manually remove the malicious application from the system.Vulnerability reproductionTo reproduce the vulnerability, follow the steps described below.•	Unzip the IPA file of any iOS application.*Listing 4. Unzipping the file*•	Modify the value of `<key>CFBundleIdentifier</key>` by adding restricted characters in the `Info.plist` file.*Figure 7. Example with `'` character`•	Zip the modified IPA file.*Listing 5. Zipping the file*•	Upload the modified IPA file to Static Analysis and wait until it finished
•	Open the following pages:
`http://mobsf/recent_scans/`
`http://mobsf/ios/dynamic_analysis/`*Figure 8. DoS Example**Figure 9. DoS Example*Please, assign all credits to Oleg Surnin (Positive Technologies)
CVSS v4.0: 7.1
CVSS v3.1: 6.5
GHSA-wmmc-c6rf-h3fc: In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
CVE-2022-41192: Due to lack of proper memory management, when a victim opens manipulated Jupiter Tesselation (.jt, JTReader.x3d) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9, it is possible for the application to crash and becomes temporarily unavailable to the user until restart of the application.
CVSS v3.1: 7.8
GHSA-c5wx-4cqq-ff6w: Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.
CVE-2025-7961: KAP 3.6.0 - TCC Bypass
Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0.
CVSS v4.0: 6.9
CVE-2019-11514: User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens.
CVSS v3.0: 7.5
CVSS v2.0: 5
RHSA-2026:23103: Red Hat Security Advisory: delve security update
crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
CVSS v3.1: 7.5
PYSEC-2024-104: A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
CVSS v3.1: 5.3
GHSA-25fr-pq5j-rg59: This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerable parameter to perform reflected Cross Site Scripting (XSS) attacks on the targeted system.
CVSS v4.0: 6.4
GHSA-r47p-3h3g-wvw7: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 10.9.1 – 11.3 that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high, requiring publisher capabilities.  The impact is low to both confidentiality and integrity while having no impact to availability.
CVSS v3.1: 4.8
CVE-2026-1915: Simple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute
The Simple Plyr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poster' parameter in the 'plyr' shortcode in all versions up to, and including, 0.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2020-28183: SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-r87w-47m8-22w3: Template Injection in jsrender
Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.Proof of ConceptRecommendationUpdate to version 0.9.74 or later.
CVSS v3.1: 6.3
GHSA-gchf-63hm-xhh4: Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. These vulnerabilities are due to insufficient input validation by the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device and then persuading a user to visit specific web pages that include malicious payloads. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Cisco has not released software updates that address these vulnerabilities.
CVSS v3.1: 6.1
GHSA-2xf7-r7hp-r5qc: Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.
CVSS v3.1: 6.6
GHSA-6h22-c5gh-8jx7: In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01128524; Issue ID: MOLY01138453 (MSV-861).
CVSS v3.1: 7.5
GHSA-fpxg-2rm2-vpj4: An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
CVSS v3.0: 7.5
RHSA-2025:20838: Red Hat Security Advisory: zziplib security update
zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c
CVSS v3.0: 5.5
GHSA-8598-8625-m6cq: SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
CVSS v3.0: 9.8
CVE-2019-11170: Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via local access.
CVSS v3.1: 7.8
CVSS v2.0: 7.2
GHSA-j3fq-6cwx-wgx7: Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.
CVSS v3.1: 7.5
CVE-2024-58284: PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings
PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the metadata settings endpoint. Attackers can log in and modify the meta content to create a web shell that executes arbitrary system commands through a GET parameter.
CVSS v4.0: 8.6
GHSA-88h5-6w7m-5w56: jj vulnerable to path traversal via crafted Git repositories
ImpactSpecially crafted Git repositories can cause `jj` to write files outside the clone.PatchesFixed in 0.23.0.WorkaroundsNot much other than to not clone repositories from untrusted sources.ReferencesHere's the original report from @joernchen:When cloning a crafted Git repository it is possible to let `jj` write
into arbitrary directories. This can be achieved by having file objects
which contain path traversals.Reproduction steps:Apply the following patch to Git version v.2.47.0:With this patched `git` binary we can now apply a crafted
patch containing a path traversal to a repository.The patch would look like:Note the traversal `../joernchen_was_here` in the patch. This now can be committed to a repository
using the modified `git` binary:Now, when cloning that repository with `jj git clone` the path traversal will write above the worktree
directory, allowing arbitrary file writes.I've attached a tar.gz with the demo repo so you don't have to mess with the patched Git at all. For
reproduction it should be sufficient to do `jj git clone demo.git` after unpacking the tarball.The demo repository after being cloned with `jj` will create an empty file `joernchen_was_here` right next
to the `demo` directory to demonstrate the traversal.
CVSS v4.0: 9.2
CVSS v3.1: 7.5
GHSA-rvm6-v34w-x4qh: Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Server). Supported versions that are affected are 11.1.1.8.0, 12.2.1.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. CVSS 3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
CVSS v3.0: 8.6
GHSA-fwr6-xpvf-mh7v: Unknown vulnerability in Cisco Catalyst 7.5(1) allows local users to bypass authentication and gain access to the enable mode without a password.
GHSA-2826-w8xh-frpw: Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM.1.6.16.05 allows remote attackers to read arbitrary files via a request to a vendor-supplied CGI script that is used to read HTML text file, but that does not do any URI/path sanitization.
CVSS v3.0: 4.9
GHSA-r29w-mcfc-r8cc: The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for unauthenticated attackers to supply any email through the user_email field and update the password for that user during new order creation. This requires the commerce addon to be enabled in order to exploit.
CVSS v3.1: 9.8
GHSA-pfwj-c5wr-r8pg: ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances.  Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
CVSS v4.0: 5.3
GHSA-mjc9-r93p-f353: Adobe Flash Media Server (FMS) before 3.0.6, and 3.5.x before 3.5.4, allows attackers to cause a denial of service via unspecified vectors, related to a "JS method issue."
GHSA-3463-wfp8-5j89: The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password of admin for the admin account and a default password of password for the medialink account, which allows remote attackers to obtain administrative privileges by leveraging a Wi-Fi session.
CVSS v3.0: 6.8
CVE-2024-57609: An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function.
CVSS v3.1: 8.6
CVE-2026-2475: Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit this vulnerability using a specially crafted request to redirect a victim to arbitrary Web sites.
CVSS v3.1: 3.1
CVE-2023-24515: Server side request forgery in api checker
Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to fetch internal file content. This issue affects Pandora FMS v767 version and prior versions on all platforms.
CVSS v3.1: 5.2
GHSA-h38j-6r2q-95r4: A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor explains: "The function referenced in the report currently exists in our deployed system. It is related to a developer mode used during the configuration process for Bluetooth pairing between the blood glucose meter and the SmartLog application. This function is intended for configuration purposes related to device integration and testing. (...) [I]n a future application update, we plan to review measures to either remove the developer mode function or restrict access to it."
CVSS v4.0: 1.9
CVSS v3.1: 5.3
GHSA-8h8q-pcwj-rx99: An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this vulnerability.
CVSS v3.1: 7.5
GHSA-38r2-39vg-rqg7: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.
GHSA-9j75-q276-c2hc: In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
CVSS v3.1: 2.7
CVE-2024-3342: Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS v3.1: 9.9
CVE-2022-0268: Cross-site Scripting (XSS) - Stored in getgrav/grav
Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
CVSS v3.0: 5.7
CVE-2004-0246: Multiple PHP remote file inclusion vulnerabilities in (1) fonctions.lib.php, (2) derniers_commentaires.php, and (3) admin.php in Les Commentaires 2.0 allow remote attackers to execute arbitrary PHP code via the rep parameter.
CVSS v2.0: 10
GHSA-x8v2-49fm-h484: aptlinex before 0.91 allows local users to overwrite arbitrary files via a symlink attack on the gambas-apt.lock temporary file.
GHSA-4c4c-jrm5-x8x5: The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN.
GHSA-5wfj-9rwm-6f4w: The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 8.0. This is due to the plugin not properly verifying the authenticity of the request that updates a orders payment status. This makes it possible for unauthenticated attackers to update order payment statuses to paid bypassing any payment.
CVSS v3.1: 5.3
GHSA-hmx5-qpq5-p643: Prototype pollution in swiper
SummaryA prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2DetailsThe vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.PoCSteps to reproduceInstall latest version of swiper using npm installRun the following code snippet:Expected behaviorPrototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:Actual behaviorObject.prototype is polluted
This is printed on the console:ImpactThis is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.
It could potentially lead to the following problems:Authentication bypassDenial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global `Array.prototype.indexOf` property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service.Remote code execution (if polluted property is passed to sinks like eval or child_process)Related CVEs[CVE-2026-25521](https://github.com/advisories/GHSA-rxrv-835q-v5mh)
[CVE-2026-25047](https://github.com/advisories/GHSA-2733-6c58-pf27)
[CVE-2026-26021](https://github.com/advisories/GHSA-2c4m-g7rx-63q7)
CVSS v4.0: 9.4
GHSA-cwm6-33r5-rmjm: Cross-site scripting (XSS) vulnerability in the default URI in news/ in Twilight CMS before 4.1 allows remote attackers to inject arbitrary web script or HTML via the calendar parameter.  NOTE: some of these details are obtained from third party information.
CVE-2025-48891: Advantech iView SQL Injection
A vulnerability exists in Advantech iView that could allow for SQL 
injection through the CUtils.checkSQLInjection() function. This 
vulnerability can be exploited by an authenticated attacker with at 
least user-level privileges, potentially leading to information 
disclosure or a denial-of-service condition.
CVSS v4.0: 7.2
CVSS v3.1: 7.6
CVE-2023-47123: iTop vulnerable to XSS vulnerability in n:n relations "tagset" widget
iTop is an IT service management platform.  By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
CVSS v3.1: 8.7
GHSA-rr44-rmpx-9h3q: The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.
GHSA-ppwj-j5xp-6rmh: An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
CVSS v3.1: 9.8
CVE-2024-4719: Campcodes Complete Web-Based School Management System delete_record.php cross site scripting
A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /model/delete_record.php. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263797 was assigned to this vulnerability.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
GHSA-x2g3-v8h5-xmcw: A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.
CVSS v3.1: 7.5
CVE-2025-28993: WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through <= 0.1.4.
CVSS v3.1: 8.6
GHSA-993j-5qpw-jw3c: The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and support license key, but it can only be changed to a valid license key.
CVSS v3.1: 4.3