ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-m3xj-86rx-cfpw: Multiple cross-site scripting (XSS) vulnerabilities in Mambo Site Server 4.0.11 allow remote attackers to execute arbitrary script on other clients via (1) search.php and (2) the "Your name" field during account registration.
GHSA-3j2j-j29v-24gh: Multiple directory traversal vulnerabilities in iXon CMS 0.30 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme_url parameter to (1) index.php, (2) page.php, (3) search.php, (4) single.php, and (5) archives.php.
GHSA-35g5-fmhj-f29q: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
CVSS v3.1: 7.5
CVE-2017-3485: Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0 and 12.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle FLEXCUBE Universal Banking accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle FLEXCUBE Universal Banking. CVSS 3.0 Base Score 6.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).
CVSS v3.0: 6.8
CVSS v2.0: 4.9
CVE-2022-27801: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of annotations that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.0: 7.8
GHSA-95q2-c52x-vr4p: A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected restart of the SNORT detection engine, resulting in a denial of service (DoS) condition. The vulnerability is due to the incomplete error handling of the SSL or TLS packet header during the connection establishment. An attacker could exploit this vulnerability by sending a crafted SSL or TLS packet during the connection handshake. An exploit could allow the attacker to cause the SNORT detection engine to unexpectedly restart, resulting in a partial DoS condition while the detection engine restarts. Versions prior to 6.2.3.4 are affected.
CVSS v3.1: 5.8
GHSA-9cf6-x23r-2w69: K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe.
CVSS v3.1: 7.8
CVE-2024-35972: bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()

If ulp = kzalloc() fails, the allocated edev will leak because it is
not properly assigned and the cleanup path will not be able to free it.
Fix it by assigning it properly immediately after allocation.
CVSS v3.1: 5.5
CVE-2018-20329: Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
CVSS v3.0: 8.1
CVSS v2.0: 5.5
CVE-2017-4896: Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application. Successful exploitation of this issue may result in an unauthorized disclosure of confidential data.
CVSS v3.0: 3.8
CVSS v2.0: 2.1
CVE-2025-20997: Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuration of Galaxy Watch.
CVSS v3.1: 6.2
CVE-2022-44555: The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable.
CVSS v3.1: 7.5
GHSA-729m-xm3h-4pjq: Use-after-free vulnerability in content/browser/appcache/appcache_dispatcher_host.cc in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect pointer maintenance associated with certain callbacks.
CVE-2018-6634: A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access to an account.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
RHSA-2025:1443: Red Hat Security Advisory: nodejs:20 security update
undici: Undici Uses Insufficiently Random Values nodejs: Node.js Worker Thread Exposure via Diagnostics Channel nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap
CVSS v3.1: 5.3
CVSS v3.0: 7.7
CVE-2023-22124: Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 14.5-14.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Banking Trade Finance.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Banking Trade Finance, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Banking Trade Finance accessible data as well as  unauthorized read access to a subset of Oracle Banking Trade Finance accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 5.4
CVE-2025-2674: PHPGurukul Bank Locker Management System aboutus.php sql injection
A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aboutus.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-w8qw-8xxw-qff9: Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers to grant permission to their own TWA WebApps without user interaction.
CVSS v3.1: 5.3
GHSA-7wv9-7865-836v: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3915.
GHSA-2hpp-qjhq-6j6p: Windows Calendar on Microsoft Windows Vista allows remote attackers to cause a denial of service (NULL dereference and persistent application crash) via a malformed ICS file.
GHSA-hg6q-r8c9-2xj5: OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop apply flow that allows agent tool calls to set apply: true despite approvalPolicy: pending configuration. Attackers can exploit this by reaching the affected apply path to apply workshop changes before the expected approval step, potentially modifying configurations without proper authorization.
CVSS v4.0: 6
CVSS v3.1: 6.5
GHSA-9jxg-hhcv-hg74: Out-of-bounds read in Windows WLAN Auto Config Service allows an authorized attacker to disclose information locally.
CVSS v3.1: 5.5
GHSA-3c2x-g6mp-5gcv: Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.
CVSS v3.1: 9.8
RHSA-2024:4014: Red Hat Security Advisory: ghostscript security update
ghostscript: OPVP device arbitrary code execution via custom Driver library
CVSS v3.1: 8.8
RHSA-2024:4244: Red Hat Security Advisory: python3.11-PyMySQL security update
python-pymysql: SQL injection if used with untrusted JSON input
CVSS v3.1: 6.3
GHSA-m7jm-9gc2-mpf2: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Entity encoding bypass via regex injection in DOCTYPE entity namesSummaryA dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (`&lt;`, `&gt;`, `&amp;`, `&quot;`, `&apos;`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.DetailsThe fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec.In `DocTypeReader.js`, entity names are passed directly to `RegExp()`:An entity named `l.` produces the regex `/&l.;/g` where `.` matches **any character**, including the `t` in `&lt;`. Since DOCTYPE entities are replaced before built-in entities, this shadows `&lt;` entirely.The same issue exists in `OrderedObjParser.js:81` (`addExternalEntities`), and in the v6 codebase - `EntitiesParser.js` has a `validateEntityName` function with a character blacklist, but `.` is not included:Shadowing all 5 built-in entities| Entity name | Regex created | Shadows |
|---|---|---|
| `l.` | `/&l.;/g` | `&lt;` |
| `g.` | `/&g.;/g` | `&gt;` |
| `am.` | `/&am.;/g` | `&amp;` |
| `quo.` | `/&quo.;/g` | `&quot;` |
| `apo.` | `/&apo.;/g` | `&apos;` |PoCNo special parser options needed - `processEntities: true` is the default.When an app renders `result.root.text` in a page (e.g. `innerHTML`, template interpolation, SSR), the injected `<img onerror>` fires.`&amp;` can be shadowed too:ImpactThis is a complete bypass of XML entity encoding. Any application that parses untrusted XML and uses the output in HTML, SQL, or other injection-sensitive contexts is affected.Default config, no special optionsAttacker can replace any `&lt;` / `&gt;` / `&amp;` / `&quot;` / `&apos;` with arbitrary stringsDirect XSS vector when parsed XML content is rendered in a pagev5 and v6 both affectedSuggested fixEscape regex metacharacters before constructing the replacement regex:For v6, add `.` to the blacklist in `validateEntityName`:Severity**CWE-185** (Incorrect Regular Expression)**CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N - 9.3 (CRITICAL)**Entity decoding is a fundamental trust boundary in XML processing. This completely undermines it with no preconditions.
CVSS v3.1: 9.3
GHSA-3x3c-pjw5-pjr2: In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution.
CVSS v3.1: 8.8
CVE-2011-4668: IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
CVSS v2.0: 7.5
CVE-2014-3154: Use-after-free vulnerability in the ChildThread::Shutdown function in content/child/child_thread.cc in the filesystem API in Google Chrome before 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.
CVSS v2.0: 7.5
GHSA-g9x4-hh9q-pj2v: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.5.4.
CVSS v3.1: 6.5
RHSA-2007:0494: Red Hat Security Advisory: kdebase security update
kdebase3 flash-player interaction problem
GHSA-3xq6-2gcp-f92p: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in platcom WP-Asambleas allows Reflected XSS. This issue affects WP-Asambleas: from n/a through 2.85.0.
CVSS v3.1: 7.1
CVE-2026-3807: Tenda FH1202 AdvSetWrlsafeset formWrlsafeset stack-based overflow
A security vulnerability has been detected in Tenda FH1202 1.2.0.14(408). Impacted is the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Such manipulation of the argument mit_ssid/mit_ssid_index leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVSS v3.0: 8.8
CVSS v2.0: 9
CVE-2024-51324: An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnerable Driver) attack.
CVSS v3.1: 3.8
GHSA-vgm6-229w-c435: SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file.
CVSS v3.1: 9.8
GHSA-5rmx-256w-8mj9: WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level
Privilege Escalation to Admin via User Self-Update in wg-portalSummaryAny authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile endpoint with `"IsAdmin": true` in the JSON body. After logging out and back in, the session picks up admin privileges from the database.Tested against wg-portal v2.1.2 (Docker image `wgportal/wg-portal:v2`).Root CauseWhen a user updates their own profile, the server parses the full JSON body into the user model, including the `IsAdmin` boolean field. A function responsible for preserving calculated or protected attributes pins certain fields to their database values (such as base model data, linked peer count, and authentication data), but it does not do this for `IsAdmin`. As a result, whatever value the client sends for `IsAdmin` is written directly to the database.ImpactAfter the exploit, the attacker has full admin access to the WireGuard VPN management portal. They can:Read and modify every user accountCreate, modify, and delete WireGuard peers on any interfaceView WireGuard interface configurationsDisable or lock other user accountsAccess the full user list and their API tokensPatchesThe problem was fixed in the latest release, [v2.1.3](https://github.com/h44z/wg-portal/releases/tag/v2.1.3). The [docker images](https://hub.docker.com/r/wgportal/wg-portal) for the tag 'latest' built from the master branch also include the fix.
CVSS v3.1: 8.8
GHSA-cc9p-jmcf-87w4: An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS v4.0: 8.3
CVSS v3.1: 8.8
CVE-2023-37658: fast-poster v2.15.0 is vulnerable to Cross Site Scripting (XSS). File upload check binary of img, but without strictly check file suffix at /server/fast.py -> ApiUploadHandler.post causes stored XSS
CVSS v3.1: 5.4
GHSA-j2fw-rfr9-pfrh: Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/call.c.
CVSS v3.0: 9.8
RHSA-2021:2391: Red Hat Security Advisory: postgresql:9.6 security update
postgresql: Buffer overrun from integer overflow in array subscripting calculations postgresql: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE
CVSS v3.1: 6.5
RHSA-2019:1907: Red Hat Security Advisory: podman security, bug fix, and enhancement update
podman: Improper symlink resolution allows access to host files when executing `podman cp` on running containers
CVSS v3.0: 7.5
GHSA-vcmc-mvhv-w8c3: CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks.
CVE-2024-23973: Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the handling of HTTP GET requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.
CVSS v3.1: 8.8
GHSA-7wj7-vv48-8jpg: An unspecified function in the JavaScript implementation in Google Chrome creates and exposes a "temporary footprint" when there is a current login to a web site, which makes it easier for remote attackers to trick a user into acting upon a spoofed pop-up message, aka an "in-session phishing attack." NOTE: as of 20090116, the only disclosure is a vague pre-advisory with no actionable information. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.
CVE-2020-37118: P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)
P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user interaction. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted page.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
GHSA-x8v2-79v9-cjv2: Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.
GHSA-2jrw-7rm5-qgh5: IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001eca0."
CVSS v3.0: 7.8
GHSA-8f6f-8jcg-wcxv: VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator level on the Windows operating system having VMware ThinApp installed on it.
CVSS v3.1: 7.8
GHSA-x7hq-3wxf-fwcv: SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
GHSA-r7hw-mhpq-hhjg: Cross-site scripting (XSS) vulnerability in accountlogon.cfm in classifiedZONE 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rtn parameter.
GHSA-967m-rc8p-q3wj: Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.
CVSS v3.1: 4.3
GHSA-qxm8-579x-6fj9: Axis StorPoint CD allows remote attackers to access administrator URLs without authentication via a .. (dot dot) attack.
GHSA-22wj-5rv2-cqf6: An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked.
CVSS v3.1: 8.4
CVE-2010-3151: Untrusted search path vulnerability in Adobe On Location CS4 Build 315 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ibfs32.dll that is located in the same folder as an OLPROJ file.
CVSS v2.0: 9.3
CVE-2008-7167: Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS v2.0: 7.5
CVE-2017-0769: A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37662122.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2025-30909: WordPress Conversios.io plugin <= 7.2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.3.
CVSS v3.1: 4.3
GHSA-r88p-v4gx-g8qr: Adobe Connect versions 12.3 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
CVSS v3.1: 6.1
GHSA-q4cc-gv4m-4q8g: Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
GHSA-4hjq-9h5c-252j: Traefik: HTTP/2 frames can cause a running server to panic
SummaryMore Details:https://nvd.nist.gov/vuln/detail/CVE-2026-27141https://pkg.go.dev/golang.org/x/net/http2?tab=versionsPatcheshttps://github.com/traefik/traefik/releases/tag/v3.6.10https://github.com/traefik/traefik/releases/tag/v2.11.40For more informationIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
CVSS v4.0: 7.7
GHSA-j9vq-h329-795m: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions.
CVSS v3.1: 5.9
GHSA-3q6v-jv77-fpxc: KDE ktvision 0.1.1-271 and earlier allows local attackers to gain root privileges via a symlink attack on a user configuration file.
CVE-2011-0487: ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.
CVSS v2.0: 9.3
CVE-2026-37535: openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame receive handler, where the 4-bit payload length nibble is used directly as the memcpy size without validating it against the actual CAN data length. A malicious CAN frame with an oversized length nibble can cause memory reads beyond the buffer, allowing attackers to cause a denial of service, or gain sensitive information.
CVSS v3.1: 7.1
CVE-2024-11567: IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
IrfanView DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24871.
CVSS v3.0: 7.8