ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-mmm5-3g4x-qw39: OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
DescriptionSix `confronta_righe.php` files across different modules in OpenSTAManager <= 2.10.1 contain an SQL Injection vulnerability. The `righe` parameter received via `$_GET['righe']` is directly concatenated into an SQL query without any sanitization, parameterization or validation.An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including user credentials, customer information, invoice data and any other stored data.Affected FilesAll 6 vulnerable files share the same code pattern:| # | File | Line | Affected Table |
|---|------|------|----------------|
| 1 | `modules/fatture/modals/confronta_righe.php` | 29 | `co_righe_documenti` |
| 2 | `modules/interventi/modals/confronta_righe.php` | 29 | `in_righe_interventi` |
| 3 | `modules/preventivi/modals/confronta_righe.php` | 28 | `co_righe_preventivi` |
| 4 | `modules/ordini/modals/confronta_righe.php` | 29 | `or_righe_ordini` |
| 5 | `modules/ddt/modals/confronta_righe.php` | 29 | `dt_righe_ddt` |
| 6 | `modules/contratti/modals/confronta_righe.php` | 28 | `co_righe_contratti` |Vulnerable CodeAll files follow the same pattern. Example from `modules/interventi/modals/confronta_righe.php`:The value of `$_GET['righe']` is inserted directly into the SQL `IN()` clause without using `prepare()`, parameterized statements or any sanitization function.ReproductionPrerequisitesAuthenticated session (any user with module access)At least one existing record in the target module (e.g. an intervention with id=1)Step 1: Extract MySQL version**Result:** `XPATH syntax error: '~8.3.0'`Step 2: Extract database user**Result:** `XPATH syntax error: '~root@172.19.0.3'`Step 3: Extract admin credentials**Result:** `XPATH syntax error: '~admin:$2y$10$qAo04wNbhR9cpxjHzr'`EvidenceHTTP RequestResponse (excerpt)Impact**Confidentiality (High):** Full database data extraction including user credentials (bcrypt hashes), customer data, invoices, contracts and any stored information**Integrity (High):** Data modification via injected INSERT/UPDATE/DELETE statements through stacked queries or subqueries**Availability (High):** Deletion of tables or critical data, database corruptionRemediationRecommended FixUse parameterized statements with `prepare()` for the `righe` parameter:This fix must be applied to all **6 files** listed in the "Affected Files" section.CreditsOmar Ramirez
CVSS v3.1: 8.8
CVE-2026-21326: After Effects | Use After Free (CWE-416)
After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
GHSA-hprp-8mpx-26q9: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in webrepdb StatusServlet.
CVE-2014-3056: The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors.
CVSS v2.0: 5
GHSA-p665-f3mv-m9pp: An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because del_action() in admin/model/database.class.php mishandles this parameter.
CVSS v3.0: 7.5
CVE-2023-42105: Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20562.
CVSS v3.0: 7
GHSA-29q8-r6j6-rcv6: HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
CVSS v3.1: 6.3
CVE-2022-3732: seccome Ehoney set sql injection
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to this vulnerability.
CVSS v3.1: 6.3
CVE-2026-43096: mshv: Fix infinite fault loop on permission-denied GPA intercepts
In the Linux kernel, the following vulnerability has been resolved:

mshv: Fix infinite fault loop on permission-denied GPA intercepts

Prevent infinite fault loops when guests access memory regions without
proper permissions. Currently, mshv_handle_gpa_intercept() attempts to
remap pages for all faults on movable memory regions, regardless of
whether the access type is permitted. When a guest writes to a read-only
region, the remap succeeds but the region remains read-only, causing
immediate re-fault and spinning the vCPU indefinitely.

Validate intercept access type against region permissions before
attempting remaps. Reject writes to non-writable regions and executes to
non-executable regions early, returning false to let the VMM handle the
intercept appropriately.

This also closes a potential DoS vector where malicious guests could
intentionally trigger these fault loops to consume host resources.
CVSS v3.1: 5.5
CVE-2024-33514: Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected service.


CVSS v3.1: 5.3
CVE-2026-42825: Windows Telephony Service Elevation of Privilege Vulnerability
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7
CVE-2024-26128: baserCMS Cross-site Scripting vulnerability in Content Management
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability.
CVSS v3.1: 5.4
CVE-2008-2923: Cross-site scripting (XSS) vulnerability in read/search/results in Lyris ListManager 8.8, 8.95, and 9.3d allows remote attackers to inject arbitrary web script or HTML via the words parameter.
CVSS v2.0: 4.3
GHSA-6xvj-44vj-vq8r: tcptraceroute 1.4 and earlier does not fully drop privileges after obtaining a file descriptor for capturing packets, which may allow local users to gain access to the descriptor via a separate vulnerability in tcptraceroute.
CVE-2014-5410: Rockwell Automation Micrologix 1400 Improper Input Validation
The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.
CVSS v2.0: 7.1
GHSA-r3m8-7h2r-2mp6: The Crypt::Random::Source package before 0.13 for Perl has a fallback to the built-in rand() function, which is not a secure source of random bits.
CVSS v3.1: 7.5
CVE-2013-5419: Multiple buffer overflows in (1) mkque and (2) mkquedev in bos.rte.printers in IBM AIX 6.1 and 7.1 allow local users to gain privileges by leveraging printq group membership.
CVSS v2.0: 6.9
GHSA-3xqf-mvhg-35j8: Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment
CVSS v3.1: 9.1
RHSA-2022:6042: Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.24.0
golang: net/http: improper sanitization of Transfer-Encoding header golang: go/parser: stack exhaustion in all Parse* functions go-restful: Authorization Bypass Through User-Controlled Key prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: encoding/pem: fix stack overflow in Decode golang: regexp: stack exhaustion via a deeply nested expression golang: encoding/xml: stack exhaustion in Decoder.Skip golang: crypto/elliptic: panic caused by oversized scalar golang: crypto/tls: session tickets lack random ticket_age_add golang: io/fs: stack exhaustion in Glob golang: compress/gzip: stack exhaustion in Reader.Read golang: path/filepath: stack exhaustion in Glob golang: encoding/xml: stack exhaustion in Unmarshal golang: encoding/gob: stack exhaustion in Decoder.Decode golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
CVSS v3.1: 6.5
GHSA-4g66-jgh8-2mhv: A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /endpoint/update-computer.php. The manipulation of the argument model leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255383.
CVSS v3.1: 3.5
RHSA-2026:19061: Red Hat Security Advisory: glibc security update
glibc: glibc: Incorrect DNS response parsing via crafted DNS server response glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions
CVSS v3.1: 4
GHSA-c4qc-mjg8-qg72: drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors.
CVE-2021-39528: An issue was discovered in libredwg through v0.10.1.3751. dwg_free_MATERIAL_private() in dwg.spec has a double free.
CVSS v3.1: 8.8
CVSS v2.0: 6.8
GHSA-8v8j-3hxp-93wr: Spring Boot's default security filter chain has no authorization rule with Actuator but without Health
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable.Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
CVSS v3.1: 9.1
GHSA-rvvh-j26c-f7mv: Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe executable file. An attacker can obtain admin privileges by placing a malicious .exe file in the application and renaming it ScadaAgentSvc.exe, which would result in executing the binary as NT AUTHORITY\SYSTEM in a Windows operating system. For example, an attacker can plant a reverse shell from a low privileged user account and by restarting the computer, the malicious service will be started as NT AUTHORITY\SYSTEM by giving the attacker full system access to the remote PC.
CVE-2020-15589: A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the client to skip TLS certificate validation, leading to a man-in-the-middle attack against HTTPS and unauthenticated remote code execution.
CVSS v3.1: 8.1
CVSS v2.0: 6.8
CVE-2025-66222: DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)
DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid diagram renderer allows an attacker to execute arbitrary JavaScript within the application context. By leveraging the exposed Electron IPC bridge, this XSS can be escalated to Remote Code Execution (RCE) by registering and starting a malicious MCP (Model Context Protocol) server.
CVSS v3.1: 9.7
CVE-2025-3475: WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030
Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.
CVSS v3.1: 6.5
GHSA-h529-w228-f427: The Upload method in the RealPage Module Upload ActiveX control in Realpage.dll 1.0.0.9 in RealPage Module ActiveX Controls does not properly restrict certain property values, which allows remote attackers to read arbitrary files via a filename in the SourceFile property in conjunction with an http URL in the DestURL property.
CVE-2018-18820: A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any malicious HTTP client can send a request for that specific resource including a crafted header, leading to denial of service and potentially remote code execution.
CVSS v3.0: 8.1
CVSS v2.0: 6.8
GHSA-58gm-g38v-xch5: Directory traversal vulnerability in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to read arbitrary files via unspecified vectors.
GHSA-v2j8-2q45-8jcq: A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.
CVSS v3.1: 5.3
GHSA-2h5w-3h6g-pgqq: The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form.
GHSA-2q86-m3cg-h2f9: A vulnerability has been identified in PADS Standard/Plus Viewer (All versions). The affected application is vulnerable to an out of bounds read past the end of an allocated buffer when parsing PCB files. An attacker could leverage this vulnerability to leak information in the context of the current process. (FG-VD-22-053)
CVSS v3.1: 5.5
CVE-2020-28210: A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser.
CVSS v3.1: 6.1
CVSS v2.0: 4.3
GHSA-3cx4-92cq-xmpp: Buffer overflows in the cifslogin command for HP CIFS/9000 Client A.01.06 and earlier, based on the Sharity package, allows local users to gain root privileges via long (1) -U, (2) -D, (3) -P, (4) -S, (5) -N, or (6) -u parameters.
CVE-2025-20719: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418955; Issue ID: MSV-3570.
CVSS v3.1: 8.8
GHSA-fwm5-c4jq-p4wv: foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.
RHSA-2020:4295: Red Hat Security Advisory: rh-postgresql96-postgresql security update
postgresql: Selectivity estimators bypass row security policies postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks postgresql: Uncontrolled search path element in CREATE EXTENSION
CVSS v3.1: 7.1
CVSS v3.0: 7.5
CVE-2005-1890: Unknown vulnerability in Mortiforo before 0.9.1 allows users to access private forums via unknown attack vectors.
CVSS v2.0: 5
GHSA-2g8g-jgx2-36mh: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /panel/schedule-staff.php. The manipulation of the argument staff_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
CVE-2018-8397: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code Execution Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.
CVSS v3.0: 8.8
CVSS v2.0: 9.3
CVE-2023-5387: Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable the dark mode plugin setting.
CVSS v3.1: 4.3
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()
In the Linux kernel, the following vulnerability has been resolved:

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate
over 'cqe->len_list[]' using only a zero-length terminator as
the stopping condition. If the terminator was missing or
malformed, the loop could run past the end of the fixed-size array.

Add an explicit bound check using ARRAY_SIZE() in both loops to prevent
a potential out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
GHSA-m563-373q-885c: Duplicate Advisory: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup
Duplicate AdvisoryThis advisory has been withdrawn because it is a duplicate of GHSA-42mx-vp8m-j7qh. This link is maintained to preserve external references.Original DescriptionOpenShell before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks. Attackers with mirror mode access can execute arbitrary code on the host during gateway startup by exploiting enabled workspace hooks.
CVSS v4.0: 5.4
CVSS v3.1: 7.3
CVE-2016-0136: Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS v3.0: 7.8
CVSS v2.0: 9.3
CVE-2018-17466: Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS v3.0: 8.8
CVSS v2.0: 6.8
CVE-2025-31165: Cross Site Scripting in NightWolf Penetration Platform
Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through the markdown editor feature.
CVSS v4.0: 6.9
CVE-2021-28586: Adobe After Effects PDF file parsing out-of-bounds write could lead to remote code execution vulnerability
After Effects version 18.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.0: 8.8
CVE-2025-11035: Jinher OA text xml external entity reference
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
CVE-2025-63226: The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper session management on the /UserManagement.html endpoint. Attackers who are on the same network as the victim and have access to the target's logged-in session can access the endpoint and add new users without any authentication. This allows attackers to gain unauthorized access to the system and perform malicious activities.
CVSS v3.1: 5.7
CVE-2022-4353: LinZhaoguan pb-cms IpUtil.getIpAddr cross site scripting
A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this vulnerability is the function IpUtil.getIpAddr. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215113 was assigned to this vulnerability.
CVSS v3.1: 3.5
GHSA-2wwc-pmg9-2f8m: An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS v3.0: 7.8
GHSA-chfj-qfhf-hwhh: Cross-site scripting (XSS) vulnerability in spell-check-savedicts.php in the htmlarea SpellChecker module, as used in Serendipity before 1.7.3 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the to_r_list parameter.
RHSA-2024:0386: Red Hat Security Advisory: kpatch-patch security update
kernel: net/sched: sch_hfsc UAF kernel: use after free in nvmet_tcp_free_crypto in NVMe kernel: IGB driver inadequate buffer size for frames larger than MTU
CVSS v3.1: 7.5
CVE-2012-3817: ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries.
CVSS v2.0: 7.8
CVE-2025-22421: In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS v3.1: 5.5
RHSA-2024:7551: Red Hat Security Advisory: cups-filters security update
cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes cups: libppd: remote command injection via attacker controlled data in PPD file cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source cups-browsed: cups-filters: cups-browsed vulnerable to DDoS amplification attack
CVSS v3.1: 7.5
CVE-2024-0675: Improper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machines
Vulnerability of improper checking for unusual or exceptional conditions

in Lamassu Bitcoin ATM Douro machines, in its 7.1 version,

 the exploitation of which could allow an attacker with physical access to the ATM to escape kiosk mode, access the underlying Xwindow interface and execute arbitrary commands as an unprivileged user.

CVSS v3.1: 6.3