ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-vwxf-mg49-37v4: On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
CVSS v4.0: 9.3
CVSS v3.1: 9.1
RHSA-2009:0015: Red Hat Security Advisory: java-1.6.0-ibm security update
Java Web Start File Inclusion via System Properties Override JavaWebStart allows unauthorized network connections Java WebStart unprivileged local file and network access JRE allows unauthorized file access and connections to localhost OpenJDK applet privilege escalation via JAX package access (6592792) OpenJDK Denial-Of-Service in kerberos authentication (6588160) OpenJDK allows to list files within the user home directory (6484091) OpenJDK Jar200 Decompression buffer overflow (6755943) OpenJDK calendar object deserialization allows privilege escalation (6734167) OpenJDK Privilege escalation in command line applications (6733959) OpenJDK Buffer overflow in image processing (6726779) OpenJDK temporary files have guessable file names (6721753)
CVE-2018-19349: In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVSS v3.0: 7.2
CVSS v2.0: 6.5
CVE-2017-18914: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
CVSS v3.1: 5.3
CVSS v2.0: 5
GHSA-7g57-m97c-4jc7: iPlanet Calendar Server 5.0p2 and earlier allows a local attacker to gain access to the Netscape Admin Server (NAS) LDAP database and read arbitrary files by obtaining the cleartext administrator username and password from the configuration file, which has insecure permissions.
CVE-2020-1552: Windows Work Folder Service Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
An attacker could exploit this vulnerability by running a specially crafted application on the victim system.
The update addresses the vulnerability by correcting the way the Windows Work Folder Service handles file operations.
CVSS v3.1: 8
CVE-2026-55793: Craft CMS: Stored XSS via Structure entry title in table view
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-level control panel user can store a malicious JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session. The issue is exploitable because the title is escaped into data-title by the server, decoded again by the browser, read with jQuery .data('title'), and then concatenated into a new HTML string without attribute escaping. To exploit, an attacker must have an existing control panel account (Author role minimum), the victim must perform a drag operation (not just visit the page), and the victim’s session needs to be elevated at trigger time. This issue has been fixed in version 5.9.23.
CVSS v4.0: 5.9
GHSA-32ph-p8jx-rv5r: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter.
CVSS v3.0: 4.8
GHSA-fhpr-ppv9-3j72: Buffer overflow in ftpd in IBM AIX 4.3 and 5.1 allows attackers to gain privileges.
CVE-2019-2406: Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vulnerability allows high privileged attacker having Create Session, Execute Catalog Role privilege with network access via Oracle Net to compromise Core RDBMS. Successful attacks of this vulnerability can result in takeover of Core RDBMS. CVSS 3.0 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 7.2
CVSS v2.0: 6.5
GHSA-h25c-q8jq-gr57: Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo."
CVE-2006-2827: SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN."  NOTE: the vendor disputed this issue in a comment on the original researcher's blog, saying "the bug does not impose any security threat and remote attackers can't add, modify, or delete information in the back-end database by sending specially-crafted SQL statements to the search.php script using various search parameters." As of 20060605, the original blog entry is unavailable, although ISS also reports the same dispute.  CVE has not been able to investigate this issue further, although the researcher sometimes makes inaccurate claims
CVSS v3.1: 9.8
CVSS v2.0: 6.4
GHSA-jm3w-jvxp-mxw2: A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary location.
CVSS v3.1: 7.5
GHSA-5vgw-w2rf-gwww: In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must control the SCEP server for a valid certificate. This affects mikrotik-vm-6.46, mikrotik-vm-6.46.8, mikrotik-tile-6.46.8, mikrotik-6.47.9, and mikrotik-6.47.10.
CVSS v3.1: 8.1
CVE-2008-6193: Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS v2.0: 5
GHSA-fc2r-q5xw-m9fm: In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field.
CVSS v3.1: 5.5
GHSA-r228-rjcp-r9q9: In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: Validate TA binary sizeAdd TA binary size validation to avoid OOB write.(cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442)
CVSS v3.1: 7.8
GHSA-gj5g-pprq-vcm2: In aee, there is a possible memory corruption due to a stack buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05457070.
CVE-2024-46544: Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service.

This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected.

Users are recommended to upgrade to version 1.2.50, which fixes the issue.
CVSS v3.1: 5.9
CVE-2023-35710: Ashlar-Vellum Cobalt Stack-based Buffer Overflow Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-19956.
CVSS v3.0: 7.8
CVE-2011-0118: WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1.
CVSS v2.0: 7.6
CVE-2020-19668: Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
CVE-2020-5383: Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component. A remote unauthenticated malicious attacker may potentially exploit this vulnerability to cause a process restart.
CVSS v3.1: 5.3
CVE-2024-13308: Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.
CVSS v3.1: 3.8
GHSA-hhjm-mpmf-cxg9: Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header
microweber/microweber prior to 1.3.3 is vulnerable to stored cross-site scripting (XSS) via the `X-Forwarded-For` header. This was fixed in version 1.3.3.
CVSS v3.1: 7.4
GHSA-6727-mj2x-7w6w: In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component.
CVSS v3.1: 7.2
GHSA-w9c7-9h56-43mw: Readymade Job Site Script has CSRF via the /job URI.
CVSS v3.0: 8.8
GHSA-jv9c-3q58-cmgw: The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read baseband files or disable cellular connectivity.
CVSS v4.0: 8.5
CVSS v3.1: 7.8
GHSA-8h24-cwhj-2xgm: A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
CVSS v3.1: 8.8
CVE-2025-37149: A potential 

out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware.
CVSS v3.1: 6
CVE-2026-41051: csync2 uses insecure temporary directories when compiled with C99 or later
csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.
CVSS v4.0: 5.1
CVSS v3.1: 5
PYSEC-2023-168: Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.
CVSS v3.1: 5.3
GHSA-9jxf-24g6-463j: An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to cause a denial of service (DoS) via the Threat To Process Correlation threat prevention module.
CVSS v3.1: 9.1
CVE-2024-21376: Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
CVSS v3.1: 9
CVE-2009-2124: Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter.
CVSS v2.0: 7.5
CVE-2013-5304: SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS v2.0: 7.5
GHSA-qm5v-pj64-852j: Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"
DescriptionA user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object.Impact of issueThe newly opened malicious page can for example change the window.opener.location to redirect the user to a phishing page, or call a JavaScript function served by the AppJS on the user behalf for example to try to affect the integrity of the data.FixThe code that opens a new window via window.open(); now open the tab with the noopener attribute.
CVSS v3.1: 5.5
CVE-2018-25172: Pedidos 1.0 SQL Injection via load_proveedores.php
Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to the ajax/load_proveedores.php endpoint with crafted SQL payloads to extract sensitive database information including schema names and table structures.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
CVE-2022-32377: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/get_exam_timetable.php?id=.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2006-6525: SQL injection vulnerability in vdateUsr.asp in EzHRS HR Assist 1.05 and earlier allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
CVSS v2.0: 7.5
RHSA-2020:4288: Red Hat Security Advisory: kernel security update
kernel: net: bluetooth: type confusion while processing AMP packets kernel: net: bluetooth: information leak when processing certain AMP packets
CVSS v3.1: 5.3
GHSA-54pf-77jh-g9mf: Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network based attackers to gain unauthorized access to services.
CVSS v3.0: 9.8
CVE-2012-1366: Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.
CVSS v2.0: 6.1
CVE-2025-1363: easy-broken-link-checker <= 9.0.2 - Admin+ Stored XSS
The URL Shortener | Conversion Tracking  | AB Testing  | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS v3.1: 3.5
RHSA-2021:1881: Red Hat Security Advisory: poppler and evince security, bug fix, and enhancement update
poppler: pdftohtml: access to uninitialized pointer could lead to DoS
CVSS v3.1: 7.5
CVE-2026-40133: Missing Authorization check in SAP S/4HANA Condition Maintenance
Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability.
CVSS v3.1: 6.3
CVE-2007-5958: X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in the -sp option to the X program, which produces different error messages depending on whether the filename exists.
CVSS v2.0: 5
GHSA-pj9h-fmxg-jwmr: Incorrect security UI in Digital Credentials in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 9.8
GHSA-mhvq-4787-px9g: Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt system or terminate service.
CVSS v3.1: 9.8
CVE-2021-24521: Side Menu Lite < 2.2.1 - Authenticated SQL Injection
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
CVSS v3.1: 7.2
CVSS v2.0: 6.5
CVE-2021-20835: Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App' (Japan version) versions prior to 4.49.1 allows a remote attacker to lead a user to access an arbitrary website and the website launches an arbitrary Activity of the app via the vulnerable App, which may result in Mercari account's access token being obtained.
CVSS v3.1: 7.5
CVSS v2.0: 5
CVE-2024-10720: Stored Cross-site Scripting (XSS) in phpipam/phpipam
A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0.
CVSS v3.0: 8.2
GHSA-8xqm-h8vp-397q: IRIX startmidi program allows local users to modify arbitrary files via a symlink attack.
GHSA-q792-xxc2-jx5c: MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious 
HTTP request crafted by an authenticated user could allow the execution of arbitrary commands on the 
underlying operating system.
CVSS v3.1: 8.8
CVE-2024-43022: An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal.
CVSS v3.1: 7.5
CVE-2021-30344: Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS v3.1: 7.5
RHSA-2008:0616: Red Hat Security Advisory: thunderbird security update
mozilla: CSS reference counter overflow (ZDI-CAN-349) Firefox malformed web content flaws Firefox javascript arbitrary code execution Firefox XSS attacks Firefox arbitrary signed JAR code execution Firefox arbitrary JavaScript code execution Firefox javascript arbitrary code execution Firefox arbitrary file disclosure Firefox .properties memory leak Firefox file location escaping flaw Firefox self signed certificate flaw Firefox arbitrary file disclosure Firefox block reflow flaw
GHSA-vvfx-pqjc-f597: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eniture Technology Distance Based Shipping Calculator allows Reflected XSS.This issue affects Distance Based Shipping Calculator: from n/a through 2.0.21.
CVSS v3.1: 7.1
CVE-2017-4983: EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 is affected by a privilege escalation vulnerability that may potentially be exploited by attackers to compromise the affected system.
CVSS v3.0: 6.7
CVSS v2.0: 4.6
CVE-2005-4593: PHP remote file inclusion vulnerability in phpDocumentor 1.3.0 rc4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary code via a URL in the (1) FORUM[LIB] parameter in Documentation/tests/bug-559668.php and (2) the root_dir parameter in docbuilder/file_dialog.php.
CVSS v2.0: 7.5
CVE-2006-3564: Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php.
CVSS v2.0: 4.3
GHSA-7vp7-2c88-3j3x: In the Linux kernel, the following vulnerability has been resolved:wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()Robert Morris reported:|If a malicious USB device pretends to be an Intersil p54 wifi
|interface and generates an eeprom_readback message with a large
|eeprom->v1.len, p54_rx_eeprom_readback() will copy data from the
|message beyond the end of priv->eeprom.
|
|static void p54_rx_eeprom_readback(struct p54_common *priv,
|                                   struct sk_buff *skb)
|{
|        struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
|        struct p54_eeprom_lm86 *eeprom = (struct p54_eeprom_lm86 *) hdr->data;
|
|        if (priv->fw_var >= 0x509) {
|                memcpy(priv->eeprom, eeprom->v2.data,
|                       le16_to_cpu(eeprom->v2.len));
|        } else {
|                memcpy(priv->eeprom, eeprom->v1.data,
|                       le16_to_cpu(eeprom->v1.len));
|        }
| [...]The eeprom->v{1,2}.len is set by the driver in p54_download_eeprom().
The device is supposed to provide the same length back to the driver.
But yes, it's possible (like shown in the report) to alter the value
to something that causes a crash/panic due to overrun.This patch addresses the issue by adding the size to the common device
context, so p54_rx_eeprom_readback no longer relies on possibly tampered
values... That said, it also checks if the "firmware" altered the value
and no longer copies them.The one, small saving grace is: Before the driver tries to read the eeprom,
it needs to upload >a< firmware. the vendor firmware has a proprietary
license and as a reason, it is not present on most distributions by
default.
CVSS v3.1: 7.8
CVE-2021-28846: A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service due to a logic bug at address 0x40dcd0 when calling fprintf with "%s: key len = %d, too long\n" format. The two variables seem to be put in the wrong order. The vulnerability could be triggered by sending the POST request to apply_cgi with a long and unknown key in the request body.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2025-69140: WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.
CVSS v3.1: 7.1
CVE-2024-7662: SourceCodester Car Driving School Management System manag_package.php save_package cross-site request forgery
A vulnerability was found in SourceCodester Car Driving School Management System 1.0. It has been declared as problematic. This vulnerability affects the function save_package of the file admin/packages/manag_package.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
GHSA-xc62-vv2q-247g: The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to execute arbitrary code via a Trojan horse update.
CVSS v3.1: 8.1
CVE-2009-4310: Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file, leading to many loop iterations, as demonstrated by data in an AVI file.
CVSS v2.0: 9.3