ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2026-27678: Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)
Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.
CVSS v3.1: 6.5
CVE-2022-21482: Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
CVSS v3.1: 6.3
CVE-2022-47517: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
CVSS v3.1: 7.5
CVE-2022-23317: CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-h2w7-2v8j-jgm7: In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by unauthorized users.
CVSS v3.1: 4.3
CVE-2020-12638: An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption.
CVSS v3.1: 6.8
CVSS v2.0: 4.3
CVE-2021-20415: IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 196217.
CVSS v3.0: 5.9
GHSA-pg49-wc5j-qh8j: GetRelativePath in ACD Incorporated CwpAPI 1.1 only verifies if the server root is somewhere within the path, which could allow remote attackers to read or write files outside of the web root, in other directories whose path includes the web root.
GHSA-4fv3-v4jw-2q2p: A Reliance on Untrusted Inputs in a Security Decision vulnerability has been identified in the Lexmark Print Management Client.
CVSS v3.1: 9.3
GHSA-w25q-2c3c-rj7f: CA ERwin Data Model Validator (formerly AllFusion Data Model Validator) allows remote attackers to (1) cause a denial of service (application hang) via a malformed .EXP database file and (2) cause a denial of service (aaplication crash) via a crafted .EXP database file, which triggers a NULL dereference.
GHSA-mr96-w44w-whmw: IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3.0: 8.1
CVE-2023-41908: Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
CVSS v3.1: 5.3
GHSA-r2cj-jqqc-j833: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.
CVSS v3.1: 3.3
CVE-2025-13419: Guest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion
The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bfe/v1/revert' REST API endpoint in all versions up to, and including, 5.0.0. This makes it possible for unauthenticated attackers to delete arbitrary media attachments.
CVSS v3.1: 5.3
CVE-2018-15415: Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2025-3981: wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization
A vulnerability, which was classified as problematic, has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0. This issue affects some unknown processing of the file /v1/prescription/details/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 4
CVE-2017-2646: It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.
CVSS v3.0: 7.5
CVE-2022-30925: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm.
CVSS v3.1: 9.8
CVSS v2.0: 10
CVE-2025-32298: WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case-Themes CTUsers ctuser allows PHP Local File Inclusion.This issue affects CTUsers: from n/a through <= 1.0.0.
CVSS v3.1: 7.5
CVE-2018-21155: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.34, DM200 before 1.0.0.52, R6100 before 1.0.1.22, R7500 before 1.0.0.122, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1.0.4.2, R9000 before 1.0.3.16, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.54, WNDR4500v3 before 1.0.0.54, and WNR2000v5 before 1.0.0.64.
CVSS v3.0: 6.3
GHSA-cr22-8jcc-7rcq: Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the ssdt.sys kernel driver. The bug is caused by failure to properly validate the length of the user-supplied data. An attacker can leverage this vulnerability to execute arbitrary code in the context of the kernel, which could lead to privilege escalation. A failed exploit could lead to denial of service.
CVSS v3.0: 7.8
CVE-2024-12812: WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
CVSS v3.1: 7.5
CVE-2026-56338: Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint
Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for two-factor authentication due to captcha validation failures. Authenticated users cannot complete 2FA enrollment as the backend consistently returns HTTP 500 errors with captcha verification process failed messages, blocking access to security controls.
CVSS v4.0: 6.9
CVSS v3.1: 5.3
GHSA-pw4w-pqwh-w2gw: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the defaultValue property of ComboBox objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7253.
CVSS v3.0: 8.8
CVE-2019-16465: Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-f7gq-h8jv-h3cq: ash_authentication_phoenix has Insufficient Session Expiration
ImpactSession tokens remain valid on the server after user logout, creating a security gap where:Compromised tokens (via XSS, network interception, or device theft) continue to work even after the user logs outThe sessions stored in the database still expire, limiting the duration during which this could be exploitedUsers cannot fully invalidate their sessions when logging out from shared or potentially compromised devicesby default, changing one's password *does* invalidate all other sessions, so changing your password as a security measure would have been effectiveMay cause compliance issues with security frameworks requiring complete sessionPatchesUpgrade to version 2.10.0. After upgrading, users must update their AuthController implementation to use the new `clear_session/2` function with their OTP app name. You will be prompted to do so with a compile-time error.If you do not have the setting `require_token_presence_for_authentication?` set to `true` in the `tokens` section, you will see a separate error:In order to revoke sessions on log out when not storing tokens directly in the session, we must have some unique identifier with which to do so. You should prefer to enable `require_token_presence_for_authentication?` if possible, instead of setting this to `:jti`. Note that whatever you do here, if you did not previously have `require_token_presence_for_authentication?` set to `true`, setting it to `true` *or* setting `authentication.session_identifier` to `:jti` will log out all of your currently authenticated users.WorkaroundsYou can manually revoke tokens in your `logout/2` handler in your auth controller.
CVSS v4.0: 2.3
GHSA-7gc4-r5jr-9hxv: Gin-vue-admin subject to Remote Code Execution via file upload vulnerability
ImpactGin-vue-admin < 2.5.4 has File upload vulnerabilities。
File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution.Patcheshttps://github.com/flipped-aurora/gin-vue-admin/pull/1264Workaroundshttps://github.com/flipped-aurora/gin-vue-admin/pull/1264References#1263For more informationThe plugin installation function of Gin-Vue-Admin allows users to download zip packages from the plugin market and upload them for installation. This function has an arbitrary file upload vulnerability. A malicious attacker can upload a constructed zip package to traverse the directory and upload or overwrite arbitrary files on the server side.The affected code https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go line 880 called the `utils.Unzip` methodThe https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/utils/zip.go code defines the `utils.Unzip` methodIt can be analyzed that after uploading a zip compressed file, the `Unzip` method will be called to decompress the compressed file, and then judge whether the compressed file contains the fixed directory structure of server, web, and plugin.Whether the zip file is correct or not, it will be decompressed first. If the directory does not exist, it will be created automatically. Therefore, malicious zip packages can be constructed, and directory traversal can be performed during automatic decompression to upload or overwrite any file.Use the Zip Slip vulnerability to construct a malicious zip package with `../../../../` filenames, and upload the malicious zip package to trigger the vulnerability.![1](https://user-images.githubusercontent.com/113822259/197387942-e40c188d-cff0-4da3-84ba-7ca670d9bf72.png)
![2](https://user-images.githubusercontent.com/113822259/197387956-cef8fd0d-978a-47ae-a65e-e28367f6a0b8.png)
CVSS v3.1: 9.8
CVE-2016-0217: IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS v3.0: 5.4
CVSS v2.0: 3.5
CVE-2017-11399: Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
CVE-2026-21837: HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.
CVSS v4.0: 8.7
CVE-2018-4010: An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause a privilege escalation, resulting in the ability to execute arbitrary commands with the system's privileges.
CVSS v3.0: 8.8
CVE-2022-0950: Unrestricted Upload of File with Dangerous Type in star7th/showdoc
Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
CVSS v3.0: 6.5
RHSA-2003:060: Red Hat Security Advisory: : Updated NetPBM packages fix multiple vulnerabilities
security flaw
GHSA-9695-8fr9-hw5q: Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
SummaryA stored Cross-Site Scripting (XSS) vulnerability in `getgrav/grav` allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the `detectXss()` function when handling unquoted HTML event attributes.DetailsThe `detectXss()` function relies on a blacklist pattern to filter malicious attributes. The specific regex pattern used to match `on*` events is flawed:This pattern fails to properly identify `on*` event handlers that are constructed without quotation marks. This allows an attacker to completely bypass the filter. *Note: It is highly recommended to replace this blacklist approach with a robust, established HTML sanitization library.*PoCAn attacker with publisher-level access can reproduce this by injecting the following payload into any vulnerable content field:**Execution Details:**
The `onerror` event is written without quotes to bypass the regex. Because unquoted attributes are restricted in their character usage (e.g., the `=` symbol cannot be used easily), the payload leverages `atob()` and regex `.source` to decode the base64 string `YWxlcnQoZG9jdW1lbnQuY29va2llKQ` (which translates to `alert(document.cookie)`). The `atob()` function conveniently auto-completes the necessary `=` padding for the base64 string.Impact**Vulnerability Type:** Stored Cross-Site Scripting (XSS)**Impacted Parties:** Any user (including administrators) who views the compromised content published by the attacker.**Consequences:** Attackers can execute malicious scripts in a victim's browser, leading to session hijacking (cookie theft), unauthorized actions.Maintainer note — fix applied (2026-04-24)Fixed in Grav core on the `2.0` branch: commit [`5a12f9be8`](https://github.com/getgrav/grav/commit/5a12f9be8) — will ship in **2.0.0-beta.2**.**What changed:** the `on_events` regex in `Security::detectXss()` no longer requires quotes or whitespace around `=`. The previous form:required `[\s|'"]` immediately after the `=`, so `<img src=x onerror=alert(1)>` slid past. The new regex drops the value-matching tail entirely and just flags the presence of an `on*=` attribute anywhere inside a tag:Detecting the attribute name + `=` is enough for a tripwire — the trade-off is occasional false positives on legitimate attribute *values* containing `on*=` substrings, which the maintainer can hand-approve.This same regex bypass was the detection-layer half of GHSA-c2q3-p4jr-c55f and GHSA-w8cg-7jcj-4vv2; the fix here knocks both down.**Files:**[`system/src/Grav/Common/Security.php`](https://github.com/getgrav/grav/blob/2.0/system/src/Grav/Common/Security.php).[`tests/unit/Grav/Common/Security/DetectXssTest.php`](https://github.com/getgrav/grav/blob/2.0/tests/unit/Grav/Common/Security/DetectXssTest.php) — 18 cases: unquoted PoCs, quoted-form regression, safe-content negatives.
CVSS v3.1: 8.5
CVE-2019-10240: Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
CVSS v3.1: 8.1
CVSS v2.0: 6.8
CVE-2024-10172: WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode
The WPBakery Visual Composer WHMCS Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's void_wbwhmcse_laouts_search shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
CVE-2022-38378: An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
CVSS v3.1: 4
GHSA-mxc5-wqq4-5j7m: In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVSS v3.1: 6.1
GHSA-cxfr-5q3r-2rc2: Jinja2 template injection in mlflow
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
CVSS v3.1: 8.8
CVE-2019-19895: In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system. An authenticated attacker can, by modifying %SYSTEMDRIVE%\IXP\SW\[PACKAGE_CODE]\EveryLogon.bat, achieve this movement and execute code in the context of other users.
CVSS v3.0: 8.8
GHSA-pq7h-vwm3-fgc2: SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.php
CVSS v3.1: 8.8
GHSA-cgqg-m828-cvpm: Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Advanced Outbound Telephony accessible data as well as unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data. CVSS v3.0 Base Score 8.2 (Confidentiality and Integrity impacts).
CVSS v3.0: 8.2
CVE-2017-8282: XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted .mov file that is mishandled during the opening of a directory in "Browser" mode, because of a "User Mode Write AV near NULL" in XnView.exe.
CVSS v3.0: 7.8
CVSS v2.0: 6.8
GHSA-vhv7-v88p-wrqv: SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.  NOTE: some of these details are obtained from third party information.
GHSA-rxvj-5mv6-j5mc: Cross-site Scripting in Mingsoft MCMS
A Cross-site Scripting vulnerability has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
CVSS v3.0: 3.5
RHSA-2007:0114: Red Hat Security Advisory: xen security update
HVM guest VNC server allows compromise of entire host OS by any VNC console user
CVE-2015-1630: Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability."
CVSS v2.0: 4.3
CVE-2020-25223: A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-pjfh-ccg3-6463: In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby.
CVSS v3.1: 7.5
RHSA-2024:2433: Red Hat Security Advisory: avahi security update
avahi: Reachable assertion in avahi_dns_packet_append_record avahi: Reachable assertion in avahi_escape_label avahi: Reachable assertion in dbus_set_host_name avahi: Reachable assertion in avahi_rdata_parse avahi: Reachable assertion in avahi_alternative_host_name
CVSS v3.1: 6.2
CVE-2013-3825: Unspecified vulnerability in the Oracle Agile Product Collaboration component in Oracle Supply Chain Products Suite 9.3.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Folders & Files Attachment.
CVSS v2.0: 4
RHSA-2017:1364: Red Hat Security Advisory: nss security and bug fix update
nss: Null pointer dereference when handling empty SSLv2 messages
CVSS v3.0: 7.5