ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2017-14739: The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors.
CVSS v3.0: 7.5
CVSS v2.0: 5
CVE-2018-2993: Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS v3.0: 8.2
CVSS v2.0: 5.8
GHSA-c4m8-6h2p-36m8: Internet Explorer 5.0 and 5.01 allows remote attackers to bypass the cross frame security policy and read files via the external.NavigateAndFind function.
GHSA-q2v2-27xw-whh5: An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet.
GHSA-q8qf-8pcx-vfw7: The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkeys file (related to t-testdata.h, t-setup.c, and t-cleanup.c). NOTE: this is applicable to persons who choose to engage in the "A number of self-test programs are included here for unit-testing the library" situation.
GHSA-xgf6-69f9-3847: Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.
CVSS v3.1: 7.8
GHSA-p4cx-wfpq-6ffp: QSAN Storage Manager through directory listing vulnerability in antivirus function allows remote authenticated attackers to list arbitrary directories by injecting file path parameter.
GHSA-2xwr-53m3-98jw: SQL injection vulnerability in calendar.php in Virtual War (VWar) 1.5 allows remote attackers to execute arbitrary SQL commands via the month parameter.
CVE-2020-24641: In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2016-15048: AMTT HiBOS Command Injection RCE via server_ping.php
AMTT Hotel Broadband Operation System (HiBOS) contains an unauthenticated command injection vulnerability in the /manager/radius/server_ping.php endpoint. The application constructs a shell command that includes the user-supplied ip parameter and executes it without proper validation or escaping. An attacker can insert shell metacharacters into the ip parameter to inject and execute arbitrary system commands as the web server user. The initial third-party disclosure in 2016 recommended contacting the vendor for remediation guidance. Additionally, this product may have been rebranded under a different name. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-14 at 04:45:53.510819 UTC.
CVSS v4.0: 10
GHSA-hfqh-vh36-5395: Microsoft Excel Security Feature Bypass Vulnerability
CVSS v3.1: 7.8
CVE-2022-33239: Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS v3.1: 7.5
CVE-2019-17249: IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-28f8-hqmc-7ph8: Malicious Package in ember-power-timepicker
Version 1.0.8 of `ember-power-timepicker` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`RecommendationRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.Users may consider downgrading to version 1.0.7
GHSA-c84c-76xv-wmp8: The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
CVE-2017-11130: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackers can conduct replay attacks.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
CVE-2021-39376: Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
GHSA-4jw8-px7q-p4x9: SQL injection vulnerability in duyuru.asp in MiNT Haber Sistemi 2.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.
GHSA-h2vj-fg7q-7mc4: Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_TP.ASP'.
CVSS v4.0: 5.1
CVSS v3.1: 6.1
CVE-2021-44201: Cross-site scripting (XSS) was possible in notification pop-ups
Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035
CVSS v3.1: 6.1
CVSS v2.0: 4.3
CVE-2020-36547: GE Voluson S8 Service Browser hard-coded credentials
A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attacking locally is a requirement. It is recommended to change the configuration settings.
CVSS v3.1: 5.9
RHSA-2026:4649: Red Hat Security Advisory: grub2 security update
grub2: Missing unregister call for gettext command may lead to use-after-free
CVSS v3.1: 7.8
GHSA-47xw-cmcm-mpqp: MySQL MaxDB 7.5.00 for Windows, and possibly earlier versions and other platforms, allows remote attackers to cause a denial of service (application crash) via invalid parameters to the (1) DBMCli_String::ReallocString, (2) DBMCli_String::operator, (3) DBMCli_Buffer::ForceResize, (4) DBMCli_Wizard::InstallDatabase, (5) DBMCli_Devspaces::Complete, (6) DBMWeb_TemplateWizard::askForWriteCountStep5, or (7) DBMWeb_DBMWeb::wizardDB functions, which triggers a null dereference.
CVE-2023-39250: 



Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3.1.2 contain an information disclosure vulnerability. A local low-privileged malicious user could potentially exploit this vulnerability to retrieve an encryption key that could aid in further attacks. 




CVSS v3.1: 7.8
RHSA-2018:2927: Red Hat Security Advisory: Satellite 6.4 security, bug fix, and enhancement update
bouncycastle: Information disclosure in GCMBlockCipher bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data bouncycastle: Information leak in AESFastEngine class bouncycastle: Carry propagation bug in math.raw.Nat??? class bouncycastle: Information exposure in DSA signature generation via timing attack bouncycastle: ECDSA improper validation of ASN.1 encoding of signature bouncycastle: DSA key pair generator generates a weak private key by default bouncycastle: DHIES implementation allowed the use of ECB mode bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack bouncycastle: Other party DH public keys are not fully validated bouncycastle: ECIES implementation allowed the use of ECB mode logback: Serialization vulnerability in SocketServer and ServerSocketReceiver python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs hibernate-validator: Privilege escalation when running under the security manager puppet: Unpacking of tarballs in tar/mini.rb can create files with insecure permissions puppet: Environment leakage in puppet-agent 6: XSS in discovery rule filter autocomplete functionality jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) foreman: Stored XSS in fact name or value pulp: sensitive credentials revealed through the API foreman: SQL injection due to improper handling of the widget id parameter foreman: Ovirt admin password exposed by foreman API bouncycastle: BKS-V1 keystore files vulnerable to trivial hash collisions django: Information leakage in AuthenticationForm django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc' django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html' guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
CVSS v3.1: 5.1
CVSS v3.0: 5.9
GHSA-j95r-rm3w-f776: The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS v3.1: 5.4
GHSA-c7pv-342r-3gfp: rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows local users to gain privileges and execute arbitrary code via unspecified vectors, possibly involving command line arguments.
GHSA-p746-6hcx-p96f: A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), Teamcenter Visualization V14.0 (All versions), Teamcenter Visualization V14.1 (All versions < V14.1.0.11), Teamcenter Visualization V14.2 (All versions < V14.2.0.6), Teamcenter Visualization V14.3 (All versions < V14.3.0.1). The affected application contains a type confusion vulnerability while parsing WRL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-20826)
CVSS v3.1: 7.8
CVE-2021-39139: XStream is vulnerable to an Arbitrary Code Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVSS v3.1: 8.5
CVE-2022-32529: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted log data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170)
CVSS v3.1: 9.8
CVE-2005-0490: Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.
CVSS v3.1: 8.8
CVSS v2.0: 5.1
GHSA-xwhf-r489-w73v: An issue was discovered in TigerGraph Enterprise Free Edition 3.x. Data loading jobs in gsql_server, created by any user with designer permissions, can read sensitive data from arbitrary locations.
CVSS v3.1: 6.5
GHSA-28jq-f9q3-32fc: SQL injection vulnerability in the SetsucoCMS all versions allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v3.0: 8.8
CVE-2016-7658: An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "Audio" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2008-3811: Cisco IOS 12.2 and 12.4, when NAT Skinny Call Control Protocol (SCCP) Fragmentation Support is enabled, allows remote attackers to cause a denial of service (device reload) via segmented SCCP messages, aka Cisco Bug ID CSCsi17020, a different vulnerability than CVE-2008-3810.
CVSS v2.0: 7.8
CVE-2026-10227: raisulislamg4 student_management_system_by_php User Creation add_user_check.php sql injection
A vulnerability has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. The affected element is an unknown function of the file add_user_check.php of the component User Creation Handler. The manipulation of the argument role leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVSS v4.0: 6.9
CVSS v3.1: 7.3
CVSS v3.0: 7.3
CVSS v2.0: 7.5
CVE-2022-48226: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\Windows\Temp. A standard user can create the path file ahead of time and obtain elevated code execution. Permissions need to be modified to prevent manipulation.
CVSS v3.1: 8.4
CVE-2007-1915: Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.
CVSS v2.0: 7.5
CVE-2016-3940: The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 6P and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 30141991.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
GHSA-52mm-4rg6-p426: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-7rx6-4vwv-432g: Missing permission check in Jenkins CloudBees CD Plugin allows scheduling builds
Jenkins CloudBees CD Plugin does not perform a permission check in an HTTP endpoint.This allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.Jenkins CloudBees CD Plugin requires Item/Build permission to schedule builds via its HTTP endpoint.
CVSS v3.1: 4.3
GHSA-xwgc-99jv-crpq: Cross-site scripting (XSS) vulnerability in the URL submission form in YourFreeWorld.com Short Url & Url Tracker Script allows remote attackers to inject arbitrary web script or HTML via an unspecified form for submitting URLs.
GHSA-qqpw-72j3-h9jj: The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS v3.1: 7.3
CVE-2026-9241: FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST['wooc_order_user_roles']` parameter to determine the user's role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user's session object via `$user->roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.
CVSS v3.1: 4.3
CVE-2023-1096: SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to gain access as an admin user.
CVSS v3.1: 9.8
GHSA-f4h3-qhg5-j6mq: Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVE-2018-17666: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the exportData method of a host object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-6520.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2018-20407: An issue was discovered in Bento4 1.5.1-627. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42hls.
CVSS v3.0: 6.5
CVSS v2.0: 4.3
CVE-2020-1787: HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. The system has a logic error under certain scenario, successful exploit could allow the attacker who gains the privilege of guest user to access to the host user's desktop in an instant, without unlocking the screen lock of the host user.
CVSS v3.1: 6.6
CVSS v2.0: 7.2
RHSA-2019:0464: Red Hat Security Advisory: java-1.7.0-openjdk security update
OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290)
CVSS v3.0: 3.1
CVE-2025-11285: samanhappy MCPHub serverController.ts os command injection
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
RHSA-2020:1339: Red Hat Security Advisory: firefox security update
Mozilla: Use-after-free while running the nsDocShell destructor Mozilla: Use-after-free when handling a ReadableStream
CVSS v3.1: 8.8
GHSA-xpwc-9c3w-mmc4: The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of the camera by using HTTP APIs, instead of the web management interface that is provided by the application. This HTTP API receives the credentials as base64 encoded in the Authorization HTTP header. However, a missing length check in the code allows an attacker to send a string of 1024 characters in the password field, and allows an attacker to exploit a memory corruption issue. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 is dissected using the binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that has many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the HTTP API specification. If we open this binary in IDA Pro we will notice that this follows an ARM little-endian format. The function at address 00415364 in IDA Pro starts the HTTP authentication process. This function calls another function at sub_ 0042CCA0 at address 0041549C. This function performs a strchr operation after base64 decoding the credentials, and stores the result on the stack, which results in a stack-based buffer overflow.
CVSS v3.0: 9.8
CVE-2024-8639: Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS v3.1: 8.8
GHSA-4348-9j97-6mhj: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer.
GHSA-cv2q-pmfm-5c4f: In flashc, there is a possible out of bounds write due to lack of valudation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541635; Issue ID: ALPS08541635.
CVSS v3.1: 6