ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2024-32895: In BCMFASTPATH of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 9.8
GHSA-25g2-qhvf-25wf: In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117496180
CVSS v3.1: 8.8
GHSA-qxcw-cmhq-372v: Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allow an authenticated attacker to run a specially crafted application when the Windows kernel improperly initializes objects in memory, aka "Win32k Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8470, CVE-2017-8471, CVE-2017-8472, CVE-2017-8475, CVE-2017-8477, and CVE-2017-8484.
CVSS v3.0: 5
CVE-2016-5666: Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1.
CVSS v3.0: 9.8
CVSS v2.0: 5
CVE-2023-21318: In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
CVE-2015-4844: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVSS v2.0: 10
CVE-2025-66519: Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Layer Import Functionality
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload can be injected into the “Create new Layer” field during layer import and is later rendered into the DOM without proper sanitization. As a result, the injected script executes when the Layers panel is accessed.
CVSS v3.1: 6.3
CVE-2017-2633: An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.
CVSS v3.0: 5.4
GHSA-f867-jjc5-qx4h: Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RMIServlet.
CVSS v3.0: 8.8
CVE-2009-2310: SQL injection vulnerability in include/get_read.php in Extensible-BioLawCom CMS (X-BLC) 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter.
CVSS v2.0: 7.5
GHSA-w3v6-87v7-hwfq: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.
CVSS v3.1: 7.1
GHSA-62p5-r4jx-884c: A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /intern/admin/delete_admin.php. Such manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS v4.0: 2
CVSS v3.1: 4.7
GHSA-p9ff-j98v-p435: Strapi Server-Side Request Forgery (SSRF)
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request.
CVSS v3.1: 8.6
CVE-2024-38508: A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.
CVSS v3.1: 7.2
GHSA-8mp2-mjh9-w6fj: In the Linux kernel, the following vulnerability has been resolved:ASoC: mediatek: mt8186: Fix use-after-free in driver remove pathWhen devm runs function in the "remove" path for a device it runs them
in the reverse order. That means that if you have parts of your driver
that aren't using devm or are using "roll your own" devm w/
devm_add_action_or_reset() you need to keep that in mind.The mt8186 audio driver didn't quite get this right. Specifically, in
mt8186_init_clock() it called mt8186_audsys_clk_register() and then
went on to call a bunch of other devm function. The caller of
mt8186_init_clock() used devm_add_action_or_reset() to call
mt8186_deinit_clock() but, because of the intervening devm functions,
the order was wrong.Specifically at probe time, the order was:mt8186_audsys_clk_register()afe_priv->clk = devm_kcalloc(...)afe_priv->clk[i] = devm_clk_get(...)At remove time, the order (which should have been 3, 2, 1) was:mt8186_audsys_clk_unregister()Free all of afe_priv->clk[i]Free afe_priv->clkThe above seemed to be causing a use-after-free. Luckily, it's easy to
fix this by simply using devm more correctly. Let's move the
devm_add_action_or_reset() to the right place. In addition to fixing
the use-after-free, code inspection shows that this fixes a leak
(missing call to mt8186_audsys_clk_unregister()) that would have
happened if any of the syscon_regmap_lookup_by_phandle() calls in
mt8186_init_clock() had failed.
GHSA-xm3p-r4jv-jxcf: In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix overflow in dacloffset bounds checkThe dacloffset field was originally typed as int and used in an
unchecked addition, which could overflow and bypass the existing
bounds check in both smb_check_perm_dacl() and smb_inherit_dacl().This could result in out-of-bounds memory access and a kernel crash
when dereferencing the DACL pointer.This patch converts dacloffset to unsigned int and uses
check_add_overflow() to validate access to the DACL.
CVSS v3.1: 7.1
GHSA-7rrj-hqv6-fvpp: Content-Security-Policy protection for user content can be disabled in Jenkins 360 FireLine Plugin
Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts, unless a Resource Root URL is specified.360 FireLine Plugin 1.7.2 and earlier globally disables the `Content-Security-Policy` header for static files served by Jenkins whenever the 'Execute FireLine' build step is executed, if the option 'Open access to HTML with JS or CSS' is checked. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/book/security/user-content/#resource-root-url) configured are unaffected.
CVSS v3.1: 8
CVE-2025-4855: Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
CVSS v3.1: 9.8
CVE-2019-3782: CredHub CLI writes environment variable credentials to disk
Cloud Foundry CredHub CLI, versions prior to 2.2.1, inadvertently writes authentication credentials provided via environment variables to its persistent config file. A local authenticated malicious user with access to the CredHub CLI config file can use these credentials to retrieve and modify credentials stored in CredHub that are authorized to the targeted user.
CVSS v3.0: 6.3
CVE-2025-9678: Campcodes Online Loan Management System ajax.php sql injection
A weakness has been identified in Campcodes Online Loan Management System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_borrower. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
GHSA-xp9j-qc3f-8p8q: Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass (Peripheral Image Loader) PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR#1023638.
CVSS v3.0: 9.8
GHSA-jwfj-m7v6-748m: SQL Injection vulnerability in the Structure for Admin authenticated user
CVSS v3.0: 6
GHSA-5j6q-p97q-j4j4: Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.
CVE-2021-38520: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, and R7000P before 1.3.2.124.
CVSS v3.1: 6.6
GHSA-x68x-wvm2-hqc8: Stored XSS vulnerability in Jenkins Compact Columns Plugin
Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips.This results in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.Compact Columns Plugin 1.12 applies the configured markup formatter to the job description shown in tooltips.
CVSS v3.1: 5.4
GHSA-w9q2-g4fg-c4pw: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 before 5.67.0, from 5.2020.2 before 5.2022.5, from 4.1.2.191.0 before 4.1.2.191.50.
CVSS v4.0: 6.7
CVE-2025-69041: WordPress Dekoro theme <= 1.0.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Dekoro dekoro allows PHP Local File Inclusion.This issue affects Dekoro: from n/a through <= 1.0.7.
CVSS v3.1: 8.1
CVE-2020-3340: Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit these vulnerabilities, an attacker would need valid administrative credentials.
CVSS v3.0: 4.8
GHSA-254p-hhvc-rr9q: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HJYL hmd allows Stored XSS.This issue affects hmd: from n/a through 2.0.
CVSS v3.1: 7.1
CVE-2016-9194: A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the 802.11 WME packet header. An attacker could exploit this vulnerability by sending malformed 802.11 WME frames to a targeted device. A successful exploit could allow the attacker to cause the WLC to reload unexpectedly. The fixed versions are 8.0.140.0, 8.2.130.0, and 8.3.111.0. Cisco Bug IDs: CSCva86353.
CVSS v3.0: 6.5
CVSS v2.0: 6.1
GHSA-9xqc-gh6j-q62h: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.
CVSS v3.1: 4.3
GHSA-j7xv-pq9p-pmgg: A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This issue affects the function deploy_host_vars of the file /apps/api/views/deploy_api.py of the component API Endpoint. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
GHSA-gp5f-cx7h-8q6f: Apache Airflow's create action can upsert existing Pools/Connections/Variables
User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.
CVSS v3.1: 4.6
GHSA-rf5q-8gx3-xqfc: Cross-Site Request Forgery in Jenkins Git Plugin
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.
CVSS v3.0: 7.5
GHSA-x5m4-g2cq-52pq: Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
SummaryThere is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary `id` through the `newAttributes` request parameter. The duplication routine overrides its own `id = null` reset with that value and writes Alice’s attributes into Bob’s existing entry row.Details`ElementsController::beforeAction()` (`src/controllers/ElementsController.php:119-124`) pulls the request body into `$this->_attributes` and rejects requests that ship an `id` or `canonicalId` key at the top level:The check inspects only the top-level payload. `actionBulkDuplicate()` (`src/controllers/ElementsController.php:1708-1749`) reads a separate `newAttributes` array and passes it straight through to the service layer:`Elements::duplicateElement()` (`src/services/Elements.php:1814-1840`) clones the source element, sets `id` to null, and then hands the attacker's array to `Craft::configure()`:`Craft::configure()` overwrites the reset `id` with any numeric value inside `$newAttributes`. Yii's `saveElement()` then performs an UPDATE against the row with that primary key instead of an INSERT. Alice's title, slug, authorId, postDate, and UID land on Bob’s entry.`safeAttributes()` on `Entry` includes `id` because the base element model exposes it, so the `Collection::only()` filter does not strip it.ImpactA low-privileged author overwrites any other element (entries, categories, users that share the Entry element table inheritance) by predicting or enumerating element IDs. Content integrity on the entire install breaks. The attack requires only the ability to duplicate one entry Alice already owns.
CVSS v4.0: 7.1
CVE-2013-0775: Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.
CVSS v2.0: 9.3
GHSA-827r-w4gx-p8pp: An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
GHSA-v6g5-6xwg-4mm9: Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)
CVSS v3.1: 8.8
CVE-2019-17368: S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
RHSA-2008:0562: Red Hat Security Advisory: ruby security update
ruby's cgi.rb vulnerable infinite loop DoS ruby: integer overflows in rb_ary_fill() / Array#fill ruby: Integer overflows in rb_ary_store() ruby: Unsafe use of alloca in rb_str_format() ruby: integer overflow in rb_ary_splice/update/replace() - REALLOC_N ruby: integer overflow in rb_ary_splice/update/replace() - beg + rlen
CVE-2021-40617: An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
GHSA-pq7q-m4p8-r3wp: An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. In the function agg::cell_aa::not_equal, dx is assigned to (x2 - x1). If dx >= dx_limit, which is (16384 << poly_subpixel_shift), this function will call itself recursively. There can be a situation where (x2 - x1) is always bigger than dx_limit during the recursion, leading to continual stack consumption.
CVSS v3.1: 8.8
GHSA-chqv-vrj7-qffp: NocoDB: Shared-base link access can invite arbitrary users as persistent base members
SummaryShared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only the shared-base UUID (`xc-shared-base-id`), an attacker could enumerate base members and invite an arbitrary email into the base as a real member. The invited user could then redeem the invite via the normal signup flow and retain authenticated access even after the owner revoked the shared link.DetailsShared-base sessions were mapped to `ProjectRoles.VIEWER` in `packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts`, and `packages/nocodb/src/utils/acl.ts` granted `baseUserList` and `userInvite` to that role. The shared frontend (`packages/nc-gui/composables/useApi/interceptors.ts`) deliberately removed auth headers in favour of the shared-base header, but the ACL middleware did not distinguish shared sessions from genuine viewers.The end-to-end chain:`GET /api/v2/meta/bases/:baseId/users` returned the member list to shared-base callers (`@Acl('baseUserList')`).`POST /api/v2/meta/bases/:baseId/users` accepted an invite from shared-base callers (`@Acl('userInvite')`); `base-users.service.ts` inserted a real `nc_users_v2` row with `invite_token` and a `nc_base_users_v2` row for the target base, with `invited_by = null`.The invited account redeemed the invite through the normal signup path (`users.service.ts`), gaining a persistent JWT scoped to the base.Revoking the shared link did not affect the redeemed account.ImpactConfidentiality: shared-base link exposes member email addresses.Integrity: shared-base link can mutate base ACL state by creating new members.Persistence: link-based access converts into durable authenticated access that survives revocation of the share.CreditThis issue was reported by [@0xmrma](https://github.com/0xmrma).
CVSS v3.1: 5.8
CVE-2007-0852: Cross-site scripting (XSS) vulnerability in DevTrack 6.x allows remote attackers to inject arbitrary web script or HTML via the "Keyword search" form field and unspecified other form fields that populate a public saved query.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 6.8
CVE-2025-30718: Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data as well as  unauthorized read access to a subset of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CVSS v3.1: 5.4
CVE-2024-0337: Travelpayouts <= 1.1.15 - Open Redirect
The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS v3.1: 6.1
GHSA-8wx3-8m4x-g5h4: FOSUserBundle User Identity Validation Vulnerability
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing.
CVE-2025-29421: PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
CVSS v3.1: 7.5
GHSA-3fj9-rv52-g5r6: In the Linux kernel, the following vulnerability has been resolved:udf: Fix preallocation discarding at indirect extent boundaryWhen preallocation extent is the first one in the extent block, the
code would corrupt extent tree header instead. Fix the problem and use
udf_delete_aext() for deleting extent to avoid some code duplication.
CVSS v3.1: 5.5
GHSA-27g3-m3gg-vg7x: negotiator before 0.6.1 is vulnerable to a regular expression DoS
CVE-2025-46655: CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted JavaScript content, but the selected architecture within AWS does not have components that are able to insert Content-Security-Policy headers.
CVSS v3.1: 4.9
GHSA-j6w9-fv6q-3q52: Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.
CVSS v3.1: 7.5
CVE-2013-5305: Cross-site scripting (XSS) vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v2.0: 4.3
GHSA-6vfv-7m2p-3fcv: Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."
GHSA-64wg-mr8j-c94j: Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a malformed URL.
GHSA-w79f-5j5f-hxqj: Racoon before 20040408a allows remote attackers to cause a denial of service (memory consumption) via an ISAKMP packet with a large length field.