ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-pc3p-r5pr-cv9v: Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Agent HTTP header, which is used when composing Forgot Password e-mail messages in HTML format.
GHSA-7v36-pgg4-9j5v: In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_conncount: fix leaked ct in error pathsThere are some situations where ct might be leaked as error paths are
skipping the refcounted check and return immediately. In order to solve
it make sure that the check is always called.
CVSS v3.1: 5.5
CVE-2020-20948: An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-m8wx-qw6g-2vhr: Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
CVSS v3.1: 9.1
CVE-2017-7389: Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2007-3048: GNU screen 4.0.3 allows local users to unlock the screen via a CTRL-C sequence at the password prompt.  NOTE: multiple third parties report inability to reproduce this issue
CVSS v2.0: 7.2
GHSA-7527-8855-9cf8: Incorrect header handling in mod-wsgi
A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.
CVSS v4.0: 8.7
CVSS v3.1: 7.5
CVE-2024-4301: N-Reporter and N-Cloud from N-Partner - Os Command Injection
N-Reporter and N-Cloud, products of the N-Partner, have an OS Command Injection vulnerability. Remote attackers with normal user privilege can execute arbitrary system commands by manipulating user inputs on a specific page.
CVSS v3.1: 8.8
CVE-2021-47799: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation
Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a shell, enabling unauthorized system-level privileges.
CVSS v4.0: 8.5
CVSS v3.1: 6.2
CVE-2020-8588: Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to discover the existence of data on other Storage Virtual Machines (SVMs).
CVSS v3.1: 3.5
CVSS v2.0: 2.7
GHSA-5gxv-52gp-vmhp: Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-5xp5-vccj-mqpw: Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.
CVE-2010-4902: Multiple SQL injection vulnerabilities in the Clantools (com_clantools) component 1.2.3 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) squad or (2) showgame parameter to index.php.
CVSS v2.0: 7.5
GHSA-mh97-hrqp-x8qq: Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: UIF Open UI). Supported versions that are affected are 19.7 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.1: 5.3
CVE-2020-6241: SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of users in the system, leading to SQL Injection.
CVSS v3.0: 8.8
CVE-2024-8892: Uncontrolled Resource Consumption vulnerability on CIRCUTOR TCP2RS+
Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protocol and port 2000, deconfiguring the device and thus disabling its use. This equipment is at the end of its useful life cycle.
CVSS v3.1: 5.3
CVE-2005-2533: OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.
CVSS v2.0: 2.1
CVE-2019-11396: An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are incompatible with the privileged file manipulation performed by the product. Files can be created that can be used by an unprivileged user to obtain SYSTEM privileges. Arbitrary file creation can be achieved by abusing the SwuConfig.json file creation: an unprivileged user can replace these files by pseudo-symbolic links to arbitrary files. When an update occurs, a privileged service creates a file and sets its access rights, offering write access to the Everyone group in any directory.
CVSS v3.0: 7.8
CVSS v2.0: 7.2
GHSA-3mg3-686g-v244: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.
CVSS v3.1: 7.1
ICSA-25-266-02: Mitsubishi Electric MELSEC-Q Series CPU Module
A Denial-of-Service (DoS) vulnerability exists in the MELSEC-Q series CPU module when the user authentication function is enabled, due to improper handling of length parameter inconsistency.
CVSS v3.1: 6.8
GHSA-xm5q-57c6-qx3w: There is a local denial of service vulnerability in DaDa accelerator 5.6.19.816,, attackers can use constructed programs to cause computer crashes (BSOD).
CVE-2026-39087: ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
CVSS v3.1: 6.4
GHSA-ff3m-4h48-qcp9: Buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header.
GHSA-4w24-2qm8-wfcm: In GraphicsMagick 1.3.28, there is a divide-by-zero in the ReadMNGImage function of coders/png.c. Remote attackers could leverage this vulnerability to cause a crash and denial of service via a crafted mng file.
CVSS v3.0: 6.5
GHSA-qcwv-qghh-rpc5: A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to service via the search feature.
CVSS v4.0: 6.9
GHSA-jx2m-gmwq-m9qr: Acrobat Reader versions 20.005.30539, 23.008.20470 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-796w-m2r4-c726: The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects the Posts Timeline widget as well as the Posts Carousel widget across its default, Banner, and Modern skins, all of which omit the whitelist validation that is correctly applied in the Posts List widget.
CVSS v3.1: 6.4
GHSA-7frv-63r4-2q6x: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome and Placeholders allows Stored XSS. This issue affects Gravity Forms CSS Themes with Fontawesome and Placeholders: from n/a through 8.5.
CVSS v3.1: 5.9
CVE-2020-10669: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the latest version.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2021-35402: PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status).
CVSS v3.1: 10
CVE-2018-12633: An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage.
CVSS v3.0: 6.3
CVSS v2.0: 6.3
GHSA-6x5h-m5fm-7333: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/set_sys_time/` API is affected by a command injection vulnerability.
CVSS v3.1: 9.8
CVE-2016-7940: The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
GHSA-7hqv-35wh-6m2v: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BjornW File Icons allows Reflected XSS. This issue affects File Icons: from n/a through 2.1.
CVSS v3.1: 7.1
CVE-2018-20913: cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364).
CVSS v3.0: 4.9
CVSS v2.0: 3.5
GHSA-3rpq-2xpx-53c4: Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
GHSA-cwr2-xmc3-hmrc: Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
CVE-2024-23908: Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS v4.0: 5.4
CVSS v3.1: 6.7
RHSA-2025:13267: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
cpython: python: Bypass extraction filter to modify file metadata outside extraction directory cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory cpython: python: Extraction filter bypass for linking outside extraction directory cpython: Tarfile extracts filtered members when errorlevel=0 python: cpython: Arbitrary writes via tarfile realpath overflow libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 sqlite: Integer Truncation in SQLite libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr perl: Perl threads have a working directory race condition where file operations may target unintended paths libxml: Type confusion leads to Denial of service (DoS)
CVSS v3.1: 9.1
GHSA-x6p6-q78g-6q5q: Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.
CVSS v3.1: 7.5
CVE-2016-7247: Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow physically proximate attackers to bypass the Secure Boot protection mechanism via a crafted boot policy, aka "Secure Boot Component Vulnerability."
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2009-2572: Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.
CVSS v2.0: 6.8
GHSA-mrqg-mwh7-q94j: Host header injection in the password reset
SummaryThe password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password.The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password.
This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password.It was identified during the audit that the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset.This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control.
If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover.DetailsThis attack required the server to serve Pimcore on arbitrary "Host". This configuration would be plausible if the attacker is already behind the reverse proxy.
During the assessment of my client, their instance was accepting any Host header, and they did not received security recommendations that they should restrict this while installing Pimcore.From what I understood of Pimcore, the vulnerability is in the "admin-ui-classic-bundle", in the file src/Controller/Admin/UserController.php.The following screenshots provide evidences of the vulnerability. The environment of the test is : dockerized Pimcore v11.1.1 on default configuration (https://pimcore.com/docs/platform/Pimcore/Getting_Started/Installation/Docker_Based_Installation/).PoC![image](https://user-images.githubusercontent.com/1197252/286258644-a3ad6993-babc-4673-bed3-ffeefe2e7f92.png)
![image](https://user-images.githubusercontent.com/1197252/286258657-bc0075b9-e62c-4f29-bb5f-95227b3f53c0.png)RemediationCreate a variable that sets the server host.
Don't enable password reset functionality while this variable is not set ; or make sure that the administrator knows what they are doing.I believe that just documenting that the server should not serve on any Host would not be enough to enforce a remediation to this vulnerability.The Snipe-IT project managed this same issue by creating a "APP_ALLOW_INSECURE_HOSTS" variable, and retrieving the app absolute URL from a config file :[ https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc](https://github.com/snipe/snipe-it/commit/0c4768fd2a11ac26a61814cef23a71061bfd8bcc)ImpactCould lead to a 1-click account takeover
CVSS v3.1: 8.8
GHSA-vvwc-gw3f-hjhm: In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
CVE-2023-51625: D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability
D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the implementation of the ONVIF API, which listens on TCP port 80. When parsing the sch:TZ XML element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21319.
CVSS v3.0: 8
CVE-2026-41574: Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The vulnerability is that several provider adapters do not correctly populate this field they either silently drop a verified field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified. The result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session. This issue has been patched in version 0.49.1.
CVSS v4.0: 9.3
GHSA-j42w-vpmm-467m: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) allows SQL Injection.This issue affects Docket (WooCommerce Collections / Wishlist / Watchlist): from n/a before 1.7.0.
CVSS v3.1: 9.3
GHSA-32rr-g2cq-v328: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Reflected XSS.This issue affects Survey Maker: from n/a through 4.0.6.
CVSS v3.1: 7.1
CVE-2025-39798: NFS: Fix the setting of capabilities when automounting a new filesystem
In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix the setting of capabilities when automounting a new filesystem

Capabilities cannot be inherited when we cross into a new filesystem.
They need to be reset to the minimal defaults, and then probed for
again.
CVSS v3.1: 5.5
CVE-2026-4091: OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery
The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing nonce verification on the settings form in the func_page_main() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 6.1
GHSA-3f8h-c4rw-wc8f: A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
CVSS v3.1: 7.8
GHSA-xwpv-8x3r-cvm2: A vulnerability in Cisco Meraki Systems Manager (SM) Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges.&nbsp;This vulnerability is due to incorrect handling of directory search paths at runtime. A low-privileged attacker could exploit this vulnerability by placing both malicious configuration files and malicious DLL files on an affected system, which would read and execute the files when Cisco Meraki SM launches on startup. A successful exploit could allow the attacker to execute arbitrary code on the affected system with SYSTEM privileges.&nbsp;
CVSS v3.1: 7.3
GHSA-68m3-82mw-x7j5: Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.
CVSS v4.0: 4.8
CVSS v3.1: 3.3
GHSA-4xh9-5vh8-3p58: Yii Framework Reflected XSS
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
CVSS v3.0: 6.1
CVE-2020-25614: xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-9675-xcv9-rmg8: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.
CVSS v3.0: 6.1
GHSA-23qv-956x-w2hr: Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request.
GHSA-hw85-hfvh-5cgr: In the Linux kernel, the following vulnerability has been resolved:rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and
CONFIG_RCU_LAZY=y, the following scenarios will trigger WARN_ON_ONCE()
in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions:kthread
rcu_nocb_cb_kthread                                       ksys_write
rcu_do_batch                                              vfs_write
rcu_torture_timer_cb                                      proc_sys_write
__kmem_cache_free                                         proc_sys_call_handler
kmemleak_free                                             drop_caches_sysctl_handler
delete_object_full                                        drop_slab
__delete_object                                           shrink_slab
put_object                                                lazy_rcu_shrink_scan
call_rcu                                                  rcu_nocb_flush_bypass
__call_rcu_commn                                            rcu_nocb_bypass_lock
                                                            raw_spin_trylock(&rdp->nocb_bypass_lock) fail
                                                            atomic_inc(&rdp->nocb_lock_contended);
rcu_nocb_wait_contended                                     WARN_ON_ONCE(smp_processor_id() != rdp->cpu);
 WARN_ON_ONCE(atomic_read(&rdp->nocb_lock_contended))                                          |
                            |_ _ _ _ _ _ _ _ _ _same rdp and rdp->cpu != 11_ _ _ _ _ _ _ _ _ __|Reproduce this bug with "echo 3 > /proc/sys/vm/drop_caches".This commit therefore uses rcu_nocb_try_flush_bypass() instead of
rcu_nocb_flush_bypass() in lazy_rcu_shrink_scan().  If the nocb_bypass
queue is being flushed, then rcu_nocb_try_flush_bypass will return
directly.
CVSS v3.1: 7.8
CVE-2022-1928: Cross-site Scripting (XSS) - Stored in go-gitea/gitea
Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.
CVSS v3.0: 4.4
CVE-2024-29994: Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
CVSS v3.1: 7.8
CVE-2019-10024: An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters.
CVSS v3.0: 5.5
CVSS v2.0: 4.3
CVE-2019-3847: A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
CVSS v3.0: 5.4