ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-6f46-45q7-4jx2: This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
CVSS v3.1: 5.3
CVE-2024-36960: drm/vmwgfx: Fix invalid reads in fence signaled events
In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Fix invalid reads in fence signaled events

Correctly set the length of the drm_event to the size of the structure
that's actually used.

The length of the drm_event was set to the parent structure instead of
to the drm_vmw_event_fence which is supposed to be read. drm_read
uses the length parameter to copy the event to the user space thus
resuling in oob reads.
CVSS v3.1: 7.1
CVE-2010-2024: transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
CVSS v2.0: 4.4
CVE-2025-4271: TOTOLINK A720R cstecgi.cgi information disclosure
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2017-12121: An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the rsakey\_name= parm in the "/goform/WebRSAKEYGen" uri to trigger this vulnerability.
CVSS v3.0: 8.8
CVE-2024-53919: An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically proximate attackers or local admins to the webUI to trigger OS-level command execution as root.
CVSS v3.1: 7.6
CVE-2022-27201: Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2024-45170: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, access those functions is restricted via the web application user interface and not checked on the server side. Thus, by sending corresponding HTTP requests to the web server of the C-MOR web interface, low privileged users can also use administrative functionality, for instance downloading backup files or changing configuration settings.
CVSS v3.1: 8.1
CVE-2023-6591: Popup Box Pro < 20.9.0 - Admin+ Stored XSS
The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS v3.1: 4.8
CVE-2018-13043: scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing.
CVSS v3.0: 9.8
CVSS v2.0: 7.5
RHSA-2011:1303: Red Hat Security Advisory: jbossws-common security update
JBossWS remote Denial of Service
CVE-2014-4909: Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.
CVSS v2.0: 6.8
GHSA-v3fm-fc5r-4rrq: The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVE-2022-4053: Student Attendance Management System createClass.php cross site scripting
A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213846 is the identifier assigned to this vulnerability.
CVSS v3.1: 2.4
GHSA-w64j-9mwf-4v77: The default configuration of Microsoft Windows uses the Web Proxy Autodiscovery Protocol (WPAD) without static WPAD entries, which might allow remote attackers to intercept web traffic by registering a proxy server using WINS or DNS, then responding to WPAD requests, as demonstrated using Internet Explorer.  NOTE: it could be argued that if an attacker already has control over WINS/DNS, then web traffic could already be intercepted by modifying WINS or DNS records, so this would not cross privilege boundaries and would not be a vulnerability.  It has also been reported that DHCP is an alternate attack vector.
GHSA-pfh4-23j7-m7vx: Belkin F5D6130 Wireless Network Access Point running firmware AP14G8 allows remote attackers to cause a denial of service (connection loss) by sending several SNMP GetNextRequest requests.
CVE-2019-5480: A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.
CVSS v3.0: 5.3
CVSS v2.0: 5
RHSA-2015:0675: Red Hat Security Advisory: Red Hat JBoss Data Virtualization 6.1.0 update
CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix OpenJDK: XML parsing Denial of Service (JAXP, 8017298) Java: Java XML Signature DoS Attack JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions JBossSX/PicketBox: World readable audit.log file Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs Tomcat/JBossWeb: Request smuggling via malicious content length header Tomcat/JBossWeb: XML parser hijack by malicious web application netty: DoS via memory exhaustion during data aggregation Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter JAX-RS: Information disclosure via XML eXternal Entity (XXE) RESTEasy: XXE via parameter entities PicketLink: XXE via insecure DocumentBuilderFactory usage CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix Framework: Directory traversal CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods RESTeasy: External entities expanded by DocumentProvider Weld: Limited information disclosure via stale thread state
CVSS v3.0: 4.8
CVE-2023-28583: Double Free in Data Network Stack & Connectivity
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
CVSS v3.1: 6.7
GHSA-j92c-7v7g-gj3f: HtmlSanitizer has a bypass via template tag
ImpactIf the `template` tag is allowed, its contents are not sanitized. The `template` tag is a special tag that does not usually render its contents, unless the `shadowrootmode` attribute is set to `open` or `closed`.The lack of sanitization of the template tag brings up two bypasses:it is still possible to forcibly render the contents of a `<template>` tag through mutation XSS. The DOM parsers in browsers such as Chromium have a node depth limit of 512 and tags which are beyond that depth are flattened. This in turn allows elements within `<template>` (which are not sanitized) to be effectively 'popped out'. An example would look like this: `<div>[...]<template><script>alert('xss')</script>` where `[...]` denotes at least another 509 opening `<div>` tags.If in addition to the template tag, the `shadowrootmode` attribute is allowed through `sanitizer.AllowedAttributes.Add("shadowrootmode");`, the simple payload of `<div><template shadowrootmode="open"><script>alert('xss')</script>` would bypass the sanitizer. This is because such usage of `<template>` attaches a shadow root to its parent: `<div>`, and its contents will be rendered.Note that the default configuration is not affected because the `template` tag is disallowed by default.PatchesThe problem has been patched in versions [9.0.892](https://www.nuget.org/packages/HtmlSanitizer/9.0.892) and [9.1.893-beta](https://www.nuget.org/packages/HtmlSanitizer/9.1.893-beta).WorkaroundsDisallow the `template` tag. It is disallowed by default.Resourceshttps://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/template
CVSS v4.0: 6.3
RHSA-2019:2336: Red Hat Security Advisory: unixODBC security update
unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c
CVSS v3.0: 6.8
CVE-2018-7212: An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
CVSS v3.0: 5.3
CVSS v2.0: 5
CVE-2022-1626: Sharebar <= 1.4.1 - Arbitrary Settings Update to Stored XSS via CSRF
The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them
CVSS v3.1: 5.4
CVSS v2.0: 3.5
GHSA-64p5-xg8g-w3m2: When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may occur within a specific object.
CVSS v3.0: 7.8
CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
CVSS v3.1: 5.9
GHSA-m787-cgv8-8rf3: Multiple stack-based buffer overflows in the IMAP module (MEIMAPS.EXE) in MailEnable Professional 1.6 through 1.82 and 2.0 through 2.33, and MailEnable Enterprise 1.1 through 1.30 and 2.0 through 2.33 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a long argument to the (1) EXAMINE or (2) SELECT command.
CVE-2026-32623: xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.
CVSS v4.0: 7.7
GHSA-4mpw-x48v-q2m5: Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVSS v3.1: 8.8
GHSA-c4cv-pfh7-2cx8: Multiple PHP remote file inclusion vulnerabilities in Johannes Erdfelt Kawf 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config parameter in (1) main.php or (2) user/account/main.php.
GHSA-rj59-cf5w-pg45: Multiple stack-based buffer overflows in ACDSee FotoSlate 4.0 Build 146 allow remote attackers to execute arbitrary code via a long id parameter in a (1) String or (2) Int tag in a FotoSlate Project (aka PLP) file.
CVE-2023-28637: DataEase AWS redshift data source exists for remote code execution vulnerability
DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS v3.1: 8
CVE-2024-7024: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVSS v3.1: 9.3
CVE-2013-4575: Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via unspecified vectors.
CVSS v2.0: 7.9
CVE-2024-12021: Stored Cross-Site Scripting
Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard impacts resulting from cross-site scripting.
CVSS v4.0: 8.5
GHSA-cj77-6gwx-x43r: A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.
CVSS v3.1: 7.8
CVE-2006-5388: SQL injection vulnerability in index.php in WebSPELL 4.01.01 and earlier allows remote attackers to execute arbitrary SQL commands via the getsquad parameter, a different vector than CVE-2006-4783.
CVSS v2.0: 7.5
CVE-2018-3194: Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Activity Guide). Supported versions that are affected are 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.0: 6.1
CVSS v2.0: 5.8
GHSA-jpwh-x42h-8gm2: A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /edit_staff.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2021-22750: A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or remote code execution due to missing length checks, when a malicious CGF file is imported to IGSS Definition.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-962q-94q9-2gc5: ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
CVSS v3.1: 7.5
CVE-2003-1097: Buffer overflow in rexec on HP-UX B.10.20, B.11.00, and B.11.04, when setuid root, may allow local users to gain privileges via a long -l option.
CVSS v2.0: 7.2
GHSA-rf74-v2fm-23pw: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
Summary`JSONTaggedDecoder.decode_obj()` in `nltk/jsontags.py` calls itself 
recursively without any depth limit. A deeply nested JSON structure 
exceeding `sys.getrecursionlimit()` (default: 1000) will raise an 
unhandled `RecursionError`, crashing the Python process.Affected codeFile: `nltk/jsontags.py`, lines 47–52Proof of ConceptImpactAny code path that passes externally-supplied JSON to 
`JSONTaggedDecoder` is vulnerable to denial of service.
The severity depends on whether such a path exists in the 
calling code (e.g. `nltk/data.py`).Suggested FixAdd a depth parameter with a hard limit:
CVSS v4.0: 5.1
CVE-2020-3910: A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Multiple issues in libxml2.
CVSS v3.1: 9.8
CVSS v2.0: 7.5
CVE-2025-7984: Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25700.
CVSS v3.0: 7.8
GHSA-hh5f-w8h8-vh35: In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 7.8
GHSA-qwrq-5c2q-3p3m: A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an&nbsp;authenticated, remote attacker with read-only Administrator privileges to gain unauthorized access to sensitive information on an affected device.This vulnerability is due to improper role-based access control (RBAC) permissions on the RADIUS Policy API endpoints. An attacker could exploit this vulnerability by bypassing the web-based management interface and directly calling an affected endpoint. A successful exploit could allow the attacker to gain unauthorized&nbsp;read access to sensitive RADIUS Policy details that are restricted for their role.
CVSS v3.1: 4.3
GHSA-3p92-886g-qxpq: Remote Memory Exposure in floody
Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure..write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.Proof of Concept:
CVSS v3.1: 5.1
RHSA-2024:3962: Red Hat Security Advisory: flatpak security update
flatpak: sandbox escape via RequestBackground portal
CVSS v3.1: 8.4
GHSA-mjfv-fh2q-85vm: A vulnerability was found in code-projects Job Diary 1.0. It has been classified as critical. This affects an unknown part of the file /view-emp.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.5
CVSS v3.1: 7.3
CVE-2023-32613: Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.
CVSS v3.1: 8.1
CVE-2026-12195: myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.
CVSS v4.0: 8.5
GHSA-3pxp-4jgv-xr88: Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause a denial of service (application crash) via a long argument to the SetFontFace method.
CVE-2007-2303: Directory traversal vulnerability in includes/footer.php in News Manager Deluxe (NMDeluxe) 1.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the template parameter.
CVSS v2.0: 6.8
GHSA-hxw8-4h9j-hq2r: File Browser has an Authentication Bypass in User Password Update
Security Advisory: Authentication Bypass in User Password UpdateSummaryA case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) **without providing the current password**. By using Title Case field name `"Password"` instead of lowercase `"password"` in the API request, the `current_password` verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means.**CVSS Score**: 7.5 (High)  
**CWE**: CWE-178 (Improper Handling of Case Sensitivity)DetailsThe vulnerability exists in `http/users.go` in the `userPutHandler` function (lines 181-200).Vulnerable CodeRoot CauseThe `sensibleFields` map uses **lowercase** keys (e.g., `"password"`)The lookup `sensibleFields[field]` is **case-sensitive**When `req.Which` contains `"Password"` (Title Case), the lookup returns `false`The password verification block is skipped entirelyLater in the code (line 229), field names are converted to Title Case for processing, so `"Password"` is a valid field nameAttack FlowPoCPrerequisitesA valid JWT token for any user accountTarget Filebrowser instance using JSON authentication (default)Reproduction Steps**Step 1: Obtain a valid JWT token****Step 2: Attempt normal password change (should fail)****Step 3: Bypass with Title Case (succeeds without current_password)****Step 4: Verify account takeover**Automated PoC ScriptImpactWho is Impacted**All Filebrowser users** using JSON authentication method (default configuration)Any user whose JWT token can be obtained by an attackerParticularly high-value targets: administrator accountsAttack Scenarios| Scenario | Impact |
|----------|--------|
| XSS + Token Theft | Complete account takeover |
| JWT in Server Logs | Mass account compromise |
| Shared Computer | Session hijacking |
| Malicious Browser Extension | Credential theft |Security Impact| Category | Severity |
|----------|----------|
| Confidentiality | **High** - Attacker gains full account access |
| Integrity | **High** - Attacker can modify all user data |
| Availability | **High** - Legitimate user locked out |ScopeThe vulnerability affects **password modification only**Other sensitive fields (`Username`, `Scope`, `Perm`, etc.) have additional protection via `NonModifiableFieldsForNonAdmin` checkHowever, for **administrators**, all fields can be modified using this bypass techniqueSuggested FixOption 1: Case-insensitive field matching (Recommended)Option 2: Use Title Case in sensibleFieldsReferencesAffected File: `http/users.go`Affected Lines: 181-200Related Code: `NonModifiableFieldsForNonAdmin` (line 17)
CVSS v3.1: 5.4