ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-v47q-jxvr-p68x: Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
SummaryAn authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the `craft.app.fs.write()` method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands.Proof of ConceptAttack PrerequisitesAuthenticated administrator account with `allowAdminChanges` enabled, or access to the System Messages utilitySteps to ReproduceNavigate to **Utilities → System Messages** (`/admin/utilities/system-messages`)Edit any email template (e.g., "Test Email") and inject the following in the body (or the Subject):To exploit it by writing to a file system:**Note:** Replace the filesystem handle (e.g., `hardDisk`) with a valid handle configured in the target installation.To exploit it by writing to a volume:**Note:** Replace the volume handle (e.g., `images`) with a valid handle configured in the target installation.Save & go to **Settings → Email** (`/admin/settings/email`)Click **"Test"** at the bottom of the page to trigger template renderingThe webshell is now written to the filesystem/volume. Access it via curl or directly from the browser:
 **Note:** The path might be different on your end depending on the filesystem or volume configuration.Additional ImpactThe same `craft.app` exposure without any security measures enables additional attack vectors:Database Credential DisclosureDatabase credentials are stored in `.env` outside the webroot and are not accessible to admins through the UI. This bypasses that protection.Security Key DisclosureCraft explicitly redacts the security key from phpinfo and error logs, indicating it should be protected. However, `craft.app.config.general.securityKey` bypasses this protection.Recommended Fix**Add Twig sandbox rules** to block `write`, `writeFileFromStream`, `deleteFile`, and similar destructive methods**Consider allowlist approach** for `craft.app` properties accessible in templates rather than exposing the entire applicationResourceshttps://github.com/craftcms/cms/commit/9dc2a4a3ec8e9cd5e8c0d1129f36371437519197
https://github.com/craftcms/cms/pull/18219
https://github.com/craftcms/cms/pull/18216
CVSS v4.0: 9.4
GHSA-8v57-3pf3-74jp: xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session.
GHSA-7rmf-rfc4-c6r2: A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
GHSA-qr9w-4vx5-7gf3: Cross-site request forgery (CSRF) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
GHSA-6qf4-hfvh-m8h3: Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_fee.
CVSS v3.1: 9.8
CVE-2017-18146: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, in some corner cases, ECDSA signature verification can fail.
CVSS v3.0: 9.8
CVSS v2.0: 10
CVE-2025-21557: Vulnerability in Oracle Application Express (component: General).  Supported versions that are affected are 23.2 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as  unauthorized read access to a subset of Oracle Application Express accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 5.4
CVE-2024-30147: HCL Leap is affected by a cross-site scripting (XSS) vulnerability
Multiple vectors in HCL Leap allow client-side
script injection in the authoring environment and deployed applications.
CVSS v3.1: 6.5
GHSA-wvj7-c7wg-38hc: The Angel Browser application 1.47b and earlier for Android 1.6 through 2.1, 1.62b and earlier for Android 2.2 through 2.3.4, 1.68b and earlier for Android 3.0 through 4.0.3, and 1.76b and earlier for Android 4.1 through 4.2 does not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.
GHSA-56hc-wf49-2h96: Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin
Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file `de.codecentric.jenkins.dashboard.DashboardView.xml` on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system.
CVSS v3.1: 3.3
CVE-2017-9476: The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices makes it easy for remote attackers to determine the hidden SSID and passphrase for a Home Security Wi-Fi network.
CVSS v3.1: 6.5
CVSS v2.0: 3.3
GHSA-m4hq-98c3-4xmx: A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user.
CVSS v3.1: 8.2
GHSA-m4h9-hcv2-hw6h: Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
CVE-2019-8737: A denial of service issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. An attacker in a privileged position may be able to perform a denial of service attack.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2024-7933: itsourcecode Project Expense Monitoring System Backend Login login1.php sql injection
A vulnerability was found in itsourcecode Project Expense Monitoring System 1.0. It has been classified as critical. Affected is an unknown function of the file login1.php of the component Backend Login. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2003-1501: Directory traversal vulnerability in the file upload CGI of Gast Arbeiter 1.3 allows remote attackers to write arbitrary files via a .. (dot dot) in the req_file parameter.
CVSS v2.0: 6.4
CVE-2026-43256: media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
In the Linux kernel, the following vulnerability has been resolved:

media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()

vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop
bound and passes the index to vfe_isr_reg_update(). However,
vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):

    struct vfe_line line[VFE_LINE_NUM_MAX];

When index is 4, 5, 6, the access to vfe->line[line_id] exceeds
the array bounds and resulting in out-of-bounds memory access.

Fix this by using separate loops for output lines and write masters.
CVSS v3.1: 7.8
CVE-2026-8209: Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.
CVSS v4.0: 6.9
CVE-2014-9881: drivers/media/radio/radio-iris.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices uses an incorrect integer data type, which allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application, aka Android internal bug 28769368 and Qualcomm internal bug CR539008.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2009-2242: SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS v2.0: 6.8
CVE-2025-24678: WordPress Listamester Plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.4.
CVSS v3.1: 6.5
CVE-2008-1911: SQL injection vulnerability in includes/system.php in 1024 CMS 1.4.2 beta and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a cookpass cookie.
CVSS v2.0: 6.8
CVE-2024-32673: Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.

This issue affects Walrus: before 72c7230f32a0b791355bbdfc78669701024b0956.
CVSS v4.0: 6.7
CVSS v3.1: 5.5
GHSA-cmxf-478f-2982: VMware Studio 2.0 does not properly write to temporary files, which allows local users to gain privileges via unspecified vectors.
CVE-2024-23782: Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier versions. If this vulnerability is exploited, a user with a contributor or higher privilege may execute an arbitrary script on the web browser of the user who accessed the website using the product.
CVSS v3.1: 5.4
GHSA-9mgq-f4gv-5pc6: The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
GHSA-vx84-xvr8-w24c: Apache IoTDB: DoS Vulnerability
A vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.Users are recommended to upgrade to version 2.0.5, which fixes the issue.
CVSS v4.0: 6.6
RHSA-2020:2508: Red Hat Security Advisory: expat security update
expat: Integer overflow leading to buffer overflow in XML_GetBuffer()
CVE-2023-53422: wifi: iwlwifi: fw: fix memory leak in debugfs
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fw: fix memory leak in debugfs

Fix a memory leak that occurs when reading the fw_info
file all the way, since we return NULL indicating no
more data, but don't free the status tracking object.
CVSS v3.1: 5.5
GHSA-vr96-c7gf-6gvh: Cross-Site Request Forgery (CSRF) vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.6.
CVSS v3.1: 4.3
CVE-2023-2314: Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 6.5
GHSA-94p8-9vqv-x9hf: MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with a negative number.
CVE-2026-27221: Acrobat Reader | Improper Certificate Validation (CWE-295)
Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to spoof the identity of a signer. Exploitation of this issue requires user interaction.
CVSS v3.1: 5.5
GHSA-vvj9-853g-mgc8: The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS v3.1: 6.4
RHSA-2023:5195: Red Hat Security Advisory: frr security and bug fix update
frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router
CVSS v3.1: 7.5
GHSA-qwj6-64m3-hwxr: The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.
CVSS v3.0: 7.5
CVE-2023-39641: Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent().
CVSS v3.1: 9.8
CVE-2025-23281: NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker with local unprivileged access that can win a race condition might be able to trigger a use-after-free error. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.
CVSS v3.1: 7
CVE-2015-8835: The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
CVE-2025-64349: ELOG user profile missing authorization
ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration.
CVSS v4.0: 8.7
CVSS v3.1: 8.8
CVE-2014-3937: SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 7.5
GHSA-9cmx-hpfh-2x7m: A maliciously crafted DWFX and SKP files in Autodesk Navisworks 2022 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
CVSS v3.1: 7.8
GHSA-cx99-25hr-5jxf: Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
SummaryAn authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned.DetailsPermissions do not seem to be enforced when reaching the `admin/ecommerceframework/admin-order/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place :<https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98>__Note__ :  Testing this vulnerability requires a fully configured ecommerce website, but it looks vulnerable as when requesting the endpoint the data seem returned (and when looking at the source code nothing seems to validate the permissions on the specified endpoint).PoCIn order to reproduce the issue, the following steps can be followed :As an administrator :
a. Create a role without any permission through Settings → User & Roles → Roles in the administration panel
b. Create an user through Settings → User & Roles → Users and assign it the unprivileged role previously createdLog out the current administrator and log in with this new userAccess to the following endpoint `https://pimcore_instance/admin/ecommerceframework/admin-order/list` and the results will be returned to this unauthorized userImpactAn unauthorized user can access back-office orders without being authorized to.
CVSS v3.1: 4.3
CVE-2007-4631: The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames.
CVSS v2.0: 6.9
CVE-2018-14084: An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-fvrq-c8cv-j77x: A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site scripting. It is possible to launch the attack remotely. VDB-235062 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.0: 3.5
GHSA-5gj6-62g7-vmgf: Hazelcast vulnerable to unmasked password exposure
In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
CVSS v3.1: 4.3
CVE-2010-4835: Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a show_report action.
CVSS v2.0: 4
CVE-2025-60378: Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
CVSS v3.1: 8.1
CVE-2026-32085: Remote Procedure Call Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an authorized attacker to disclose information locally.
CVSS v3.1: 5.5
CVE-2017-6377: When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-67r2-78g2-6xw9: Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
CVSS v3.1: 7.5
CVE-2022-49294: drm/amd/display: Check if modulo is 0 before dividing.
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check if modulo is 0 before dividing.

[How & Why]
If a value of 0 is read, then this will cause a divide-by-0 panic.
CVSS v3.1: 5.5
GHSA-jq67-r98p-22qp: SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain an authentication bypass vulnerability that allows remote attackers to perform unlimited login attempts against the management interface. Attackers can conduct online password guessing attacks without account lockout or rate limiting restrictions to gain unauthorized access to the device management interface.
CVSS v4.0: 6.9
CVSS v3.1: 6.5
GHSA-r6c2-6c2c-g3cg: Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content when installing.
CVSS v3.1: 6.1
CVE-2026-24913: SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained or altered by a user who can log in to the product.
CVSS v4.0: 8.7
CVSS v3.0: 8.8
GHSA-23pj-4543-5g2f: A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain message protocol can be exploited to cause lmadmin to crash.
CVSS v3.1: 7.5
GHSA-3xq3-v83g-gh97: openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2025-27954: An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the usertoken function of default.aspx.
CVSS v3.1: 6.5
RHSA-2003:090: Red Hat Security Advisory: glibc security update
security flaw
CVE-2026-27705: Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch
Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.
CVSS v4.0: 4.9
GHSA-6f7g-9q5v-x6x8: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
CVSS v3.1: 7.5
CVE-2024-42554: Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_added.php.
CVSS v3.1: 8.8
ICSA-23-241-01: PTC Codebeamer
If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
CVSS v3.0: 8.8