ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-wpqm-xjc6-mj5p: WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message.
CVE-2012-6128: Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.
CVSS v2.0: 5
RHSA-2024:1394: Red Hat Security Advisory: ovn23.03 security update
ovn: insufficient validation of BFD packets may lead to denial of service
CVSS v3.1: 6.5
GHSA-x2pj-g5q5-wh2x: Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to execute arbitrary code via an encrypted file with a crafted header containing long salt data that is not properly handled during decryption.
GHSA-w7hc-w7v9-336m: Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS v3.1: 9.6
RHSA-2020:5526: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.4 security update on RHEL 6
keycloak: Account REST API can update user metadata attributes
CVSS v3.1: 4.2
GHSA-2g49-fr8w-j923: The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to authentication bypass in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
CVSS v3.1: 9.8
GHSA-xhv3-vpp2-g34f: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar allows Stored XSS. This issue affects Floating Social Bar: from n/a through 1.1.7.
CVSS v3.1: 5.9
CVE-2022-33897: A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to arbitrary file deletion. An attacker can send a sequence of requests to trigger this vulnerability.
CVSS v3.0: 4.9
CVE-2021-3726: OS Command Injection in ohmyzsh/ohmyzsh
# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.
CVSS v3.1: 7.5
CVE-2020-21881: Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/admin/content/add.
CVSS v3.1: 6.5
CVE-2007-1872: Cross-site scripting (XSS) vulnerability in toendaCMS 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search id.
CVSS v2.0: 4.3
GHSA-gf27-32fm-84c5: A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is installed.
CVE-2022-4158: Contest Gallery < 19.1.5 - Unauthenticated SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
CVSS v3.1: 7.5
CVE-2024-3192: MailCleaner Admin Interface cross site scripting
A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308.
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
GHSA-248p-gq7w-24rp: Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-0209, CVE-2010-2213, and CVE-2010-2214.
CVE-2022-21389: Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.0.3 and 12.0.0.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. While the vulnerability is in Oracle Communications Billing and Revenue Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS v3.1: 10
GHSA-3v5f-9v4j-m9m3: Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function.
CVSS v3.1: 8.8
GHSA-vcvx-6h5q-fh85: The processor_set_tasks API implementation in Apple iOS before 9 allows local users to bypass an entitlement protection mechanism and obtain access to the task ports of arbitrary processes by leveraging root privileges.
CVE-2014-5993: The MLB Preplay (aka com.preplay.android.mlb) application 5.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS v2.0: 5.4
GHSA-642m-r6qq-xqrv: In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem.
CVSS v3.1: 5.5
PYSEC-2023-104: Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected
CVE-2024-9276: TMsoft MyAuth Gateway index.php cross site scripting
A vulnerability classified as problematic has been found in TMsoft MyAuth Gateway 3. Affected is an unknown function of the file /index.php. The manipulation of the argument console/nocache/cmd leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.3
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2023-27637: An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.
CVSS v3.1: 9.8
GHSA-63mj-hr86-9cpw: Windows Container Manager Service Elevation of Privilege Vulnerability
CVSS v3.1: 6.8
GHSA-fwfv-76hg-43mf: An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.
CVSS v3.1: 5.5
CVE-2022-38877: Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1.
CVSS v3.1: 7.2
CVE-2021-21432: Reject unauthorized access with GitHub PATs
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.
CVSS v3.1: 7.5
CVE-2022-42282: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure.
CVSS v3.1: 6.5
cisco-sa-umbrella-tunnel-gJw5thgE: Cisco Umbrella Virtual Appliance Undocumented Support Tunnel Vulnerability
A vulnerability in the remote support feature of Cisco Umbrella Virtual Appliance could allow an authenticated, remote attacker to obtain full control of an affected device.

This vulnerability is due to an undocumented support mechanism that is present on the product. An attacker could exploit this vulnerability by obtaining privileges sufficient to access the remote support tunnel. A successful exploit could allow the attacker to access the appliance remotely and obtain full control without explicit customer approval.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Cisco Umbrella originally published this advisory in 2017 on a different site that has since been archived.


CVSS v3.0: 6.4
GHSA-cj83-2ww7-mvq7: Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
SummaryA Regular Expression Denial of Service (ReDoS) vulnerability exists in the `Rack::Request::Helpers` module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted `Accept-Encoding` or `Accept-Language` headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS).DetailsThe fix for https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5.
CVSS v3.1: 6.5
GHSA-48xj-hg7f-hx8w: A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33933140.
CVSS v3.0: 5.5
CVE-2019-3929: The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-8c3q-7745-hrhp: A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of the component HTTP POST Request Handler. The manipulation of the argument v33 leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249769 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1: 6.3
GHSA-7mc8-9hgc-6m68: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
CVSS v3.0: 5.3
CVE-2015-1272: Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc.
CVSS v2.0: 7.5
CVE-2024-25143: The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted PNG images.
CVSS v3.1: 6.5
CVE-2022-30923: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTimingtimeWifiAndLed parameter at /goform/aspForm.
CVSS v3.1: 9.8
CVSS v2.0: 10
GHSA-8xq3-w9fx-74rv: webfinger.js Blind SSRF Vulnerability
DescriptionThe lookup function takes a user address for checking accounts as a feature, however, as per
the ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on the
security considerations section at B.3, access to Localhost services should be prevented while
running in production. The library does not prevent Localhost access (neither does it prevent
LAN addresses such as 192.168.x.x) , thus is not safe for use in production by ActivityPub
applications. The only check for localhost is done for selecting between HTTP and HTTPS
protocols, and it is done by testing for a host that starts with the string “localhost” and ends with
a port. Anything else (such as “127.0.0.1” or “localhost:1234/abc”) would not be considered
localhost for this test.In addition, the way that the function determines the host, makes it possible to access any path
in the host, not only “/.well-known/...” paths:If the address is in the format of a user address (user@host.com), the host will be anything
after the first found @ symbol. Since no other test is done, an adversary may pass a specially
crafted address such as user@localhost:7000/admin/restricted_page? and reach pages that
would normally be out of reach. In this example, the code would treat
localhost:7000/admin/restricted_page? as the host, and the created URL would be
https://localhost:7000/admin/restricted_page?/.well-known/webfinger?resource=acct:use
r@localhost:7000/admin/restricted_page?. A server listening on localhost:7000 will then
parse the request as a GET request for the page /admin/restricted_page with the query string
/.well-known/webfinger?resource=acct:user@localhost:7000/admin/restricted_page?.PoC and Steps to reproduceThis PoC assumes that there is a server on the machine listening on port 3000, which receives
requests for WebFinger lookups on the address /api/v1/search_user, and then calls the lookup
function in webfinger.js with the user passed as an argument. For the sake of the example we
assume that the server configured webfinger.js with tls_only=false.Activate a local HTTP server listening to port 1234 with a “secret.txt” file:Run the following command:View the console of the Python’s HTTP server and see that a request for a
“secret.txt?/.well-known/webfinger?resource=acct:user@localhost:1234/secret.txt
?” file was performed.
This proves that we can redirect the URL to any domain and path we choose, including
localhost and the internal LAN.ImpactDue to this issue, any user can cause a server using the library to send GET requests with
controlled host, path and port in an attempt to query services running on the instance’s host or
local network, and attempt to execute a Blind-SSRF gadget in hope of targeting a known
vulnerable local service running on the victim’s machine.ReferencesThe vulnerability was discovered by Ori Hollander of the JFrog Vulnerability Research team.
CVSS v4.0: 6.9
CVE-2025-44010: Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS v4.0: 5.3
GHSA-p7cx-46q5-8xc5: it-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by authenticated users) via the sort parameter of the API interface.
CVSS v3.1: 8.8
GHSA-gf8w-w5qv-q4hp: Cisco IOS 15.2S allows remote attackers to cause a denial of service (interface queue wedge) via malformed UDP traffic on port 465, aka Bug ID CSCts48300.
GHSA-hpc3-qphc-hp5q: A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument search leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
GHSA-ggq6-pw45-47r7: SQL injection vulnerability in subcat.php in AJ Auction 1.0 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
CVE-2025-1314: Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS v3.1: 4.3
CVE-2026-1927: GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including, 12.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve global plugin settings including stored AI API keys and modify plugin settings, including the injection of arbitrary web scripts via the 'custom_css' value (stored XSS). NOTE: This vulnerability was partially patched in version 12.6.
CVSS v3.1: 5.4
CVE-2011-3523: Unspecified vulnerability in the Oracle Web Services Manager component in Oracle Fusion Middleware 10.1.3.5.0 and 10.1.3.5.1 allows remote authenticated users to affect integrity, related to WSM Console, a different vulnerability than CVE-2011-2237.
CVSS v2.0: 3.5
CVE-2022-48891: regulator: da9211: Use irq handler when ready
In the Linux kernel, the following vulnerability has been resolved:

regulator: da9211: Use irq handler when ready

If the system does not come from reset (like when it is kexec()), the
regulator might have an IRQ waiting for us.

If we enable the IRQ handler before its structures are ready, we crash.

This patch fixes:

[    1.141839] Unable to handle kernel read from unreadable memory at virtual address 0000000000000078
[    1.316096] Call trace:
[    1.316101]  blocking_notifier_call_chain+0x20/0xa8
[    1.322757] cpu cpu0: dummy supplies not allowed for exclusive requests
[    1.327823]  regulator_notifier_call_chain+0x1c/0x2c
[    1.327825]  da9211_irq_handler+0x68/0xf8
[    1.327829]  irq_thread+0x11c/0x234
[    1.327833]  kthread+0x13c/0x154
CVSS v3.1: 5.5
GHSA-p349-q795-qj4q: ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
CVSS v3.0: 7.5
GHSA-w5m7-j5r6-9wc5: In Advanced SystemCare Ultimate 11.0.1.58, the driver file (Monitor_x86.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c4060cc.
CVSS v3.0: 7.8
GHSA-2p6p-9rc9-62j9: Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
ImpactYou are affected if your php.ini configuration has `register_argc_argv` enabled.PatchesUpdate to 3.9.14, 4.13.2, or 5.5.2.WorkaroundsIf you can't upgrade yet, and `register_argc_argv` is enabled, you can disable it to mitigate the issue.
CVSS v4.0: 9.3
CVSS v3.1: 9.8
CVE-2025-39951: um: virtio_uml: Fix use-after-free after put_device in probe
In the Linux kernel, the following vulnerability has been resolved:

um: virtio_uml: Fix use-after-free after put_device in probe

When register_virtio_device() fails in virtio_uml_probe(),
the code sets vu_dev->registered = 1 even though
the device was not successfully registered.
This can lead to use-after-free or other issues.
CVSS v3.1: 7.8
CVE-2021-43194: In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
CVSS v3.1: 5.3
CVSS v2.0: 5
CVE-2018-0325: A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser of an affected phone. An attacker could exploit this vulnerability by sending a malformed SIP packet to an affected phone. A successful exploit could allow the attacker to cause all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts, resulting in a DoS condition. Cisco Bug IDs: CSCvf40066.
CVSS v3.0: 7.5
CVSS v2.0: 5
GHSA-7v5p-3mqf-qpv9: The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS v3.1: 6.4
RHSA-2012:0071: Red Hat Security Advisory: php security update
php: buffer over-read in Exif extension php: Crash by converting serial day numbers (SDN) into Julian calendar php: file path injection vulnerability in RFC1867 file upload filename php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure php: hash table collisions CPU usage DoS (oCERT-2011-003)
CVE-2026-45278: Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
CVSS v3.1: 3.3
CVE-2017-6878: Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to admin/column/delete.php.
CVSS v3.0: 5.4
CVSS v2.0: 3.5