ansulev/circl-vulnerability-scores huggingface dataset:
GHSA-8gc2-vq6m-rwjw: Amazon Redshift Python Connector vulnerable to SQL Injection
SummaryA SQL injection in the Amazon Redshift Python Connector in version 2.1.4 allows a user to gain escalated privileges via schema injection in the get_schemas, get_tables, or get_columns Metadata APIs. Users should upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.ImpactA SQL injection is possible in the Amazon Redshift Python Connector, version 2.1.4, when leveraging metadata APIs to retrieve information about database schemas, tables, or columns.**Impacted versions:** Amazon Redshift Python Connector version 2.1.4.PatchesThe issue described above has been addressed in the Amazon Redshift Python Connector, version 2.1.5.The patch implemented in this version ensures that every metadata command input is sent to the Redshift server as part of a parameterized query, using either QUOTE_IDENT(string) or QUOTE_LITERAL(string). After processing all the inputs into quoted identifiers or literals, the metadata command is composed using these inputs and then executed on the server.WorkaroundsUse the previous version of the Amazon Redshift Python Connector, version 2.1.3.ReferencesIf you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page [1] or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.[1] Vulnerability reporting page: https://aws.amazon.com/security/vulnerability-reporting
CVSS v4.0: 8.6
CVSS v3.1: 8
GHSA-76f6-264c-p9gg: SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.
CVE-2026-11183: Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
CVSS v3.1: 6.5
GHSA-mw4x-892q-7j7f: The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144588
CVSS v3.0: 6.1
CVE-2022-21480: Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: User Interface). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Transportation Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Transportation Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Transportation Management accessible data as well as unauthorized read access to a subset of Oracle Transportation Management accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS v3.1: 6.1
ICSA-25-352-03: National Instruments LabView
LabVIEW is vulnerable to an out-of-bounds write vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::RGetMemFileHandle() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResource::DetachResource() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!VisaWriteFromFile() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!DataSizeTDR() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to an out-of-bounds read vulnerability in lvre!ExecPostedProcRecPost() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to an out-of-bounds read vulnerability in LVResFile::FindRsrcListEntry() when opening a corrupted VI, which may allow an attacker to disclose information or to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to a use-after-free vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. LabVIEW is vulnerable to a stack-based buffer overflow vulnerability when opening a corrupted VI, which may allow an attacker to execute arbitrary code. Successful exploitation requires an attacker to get a user to open a specially crafted VI file.
CVSS v3.1: 7.8
GHSA-8x28-7c5h-458j: Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2008-2161.
GHSA-q3j9-2jmp-r96c: Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js.
CVSS v3.1: 7.5
GHSA-23pr-fhrm-f58r: Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.
CVSS v3.1: 4.3
CVE-2006-5091: Unspecified vulnerability in HP-UX B.11.11 and B.11.23 CIFS Server (Samba) allows local users to gain privileges or obtain "unauthorized access" via unspecified vectors.
CVSS v2.0: 7.2
CVE-2024-5648: LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update
The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, wp_ajax_wrld_gutenberg_block_visit, etc..) in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update various plugin settings.
CVSS v3.1: 5.4
GHSA-6f6h-qv9w-h4h4: The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function.
CVSS v3.1: 4.3
GHSA-7r9r-h638-mh75: Multiple cross-site scripting (XSS) vulnerabilities in auraCMS 1.5 allow remote attackers to inject arbitrary web script or HTML via the (1) hits parameter to hits.php, (2) query parameter to index.php, or (3) theCount parameter to counter.php.
CVE-2020-12904: Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004203 may lead to arbitrary information disclosure.
CVSS v3.1: 5.5
CVSS v2.0: 2.1
CVE-2011-4349: Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
CVSS v2.0: 4.6
CVE-2019-20180: The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
CVSS v3.1: 6.8
CVSS v2.0: 6
CVE-2024-9520: UserPlus <= 2.0 - Missing Authorization via Multiple Functions
The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to add, modify, or delete user meta and plugin options.
CVSS v3.1: 6.3
GHSA-h8jr-pqjw-48g2: Tenda AC10 V15.03.06.23 contains a Stack overflow vulnerability via /goform/formWifiWpsStart.
CVSS v3.1: 9.8
GHSA-2476-f5h7-4c25: SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQL commands via the password field.
CVE-2025-64142: A missing permission check in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
CVSS v3.1: 4.3
GHSA-qpm2-6cq5-7pq5: happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
SummaryThe mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.DetailsThe untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).PoCAttackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., "process". In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().ImpactArbitrary code execution via breaking out of the Node.js' vm isolation.Recommended Immediate ActionsUsers can freeze the builtins in the global scope to defend against attacks similar to the PoC above. However, the untrusted code might still be able to retrieve all kind of information available in the global scope and exfiltrate them via fetch(), even without prototype pollution capabilities. Not to mention side channels caused by the shared process/isolate. Migration to [isolated-vm](https://github.com/laverdet/isolated-vm) is suggested instead.Cris from the Endor Labs Security Research Team, who has worked extensively on JavaScript sandboxing in the past, submitted this advisory.
CVSS v4.0: 9.4
CVE-2019-8130: A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates.
CVSS v3.1: 8.8
CVSS v2.0: 6.5
CVE-2026-26928: Lack of Dynamic Library Validation in SzafirHost
SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application.

This issue was fixed in version 1.1.0.
CVSS v4.0: 8.7
RHSA-2010:0165: Red Hat Security Advisory: nss security update
TLS: MITM attacks via session renegotiation
CVE-2022-26866: Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVSS v3.1: 5.5
GHSA-vf4v-jx55-rc4w: SQL injection vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.3 IFIX027, 7.5.0.4 before IFIX011, and 7.5.0.5 before IFIX006; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140207-1801, and 7.1.1.12 before IFIX.20140218-1510 allows remote authenticated users to execute arbitrary SQL commands via a Birt report with a WHERE clause in plain text.
CVE-2013-1469: Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
CVSS v2.0: 4
CVE-2025-2061: code-projects Online Ticket Reservation System passenger.php cross site scripting
A vulnerability was found in code-projects Online Ticket Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /passenger.php. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.3
CVSS v3.1: 4.3
CVSS v3.0: 4.3
CVSS v2.0: 5
GHSA-c3qp-2ggw-xjg7: Shopper: Authorization bypass and RBAC privilege escalation in team settings
ImpactTwo distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system:`Settings/Team/Index` had no `mount()` authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators.`Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission. Any user holding `view_users` could grant themselves or any other user arbitrary permissions, including `manage_users` and `edit_orders`, effectively escalating to full panel administrator from a read-only account.Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel.PatchesFixed in `v2.8.0`:`Settings/Team/Index::mount()` now authorizes against `manage_users`.`Settings/Team/RolePermission` write actions now require `manage_users` instead of `view_users`.Upgrade via:WorkaroundsNone. Upgrade to `v2.8.0`.
CVSS v3.1: 9.9
GHSA-3x34-pw7w-x2p5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Stored XSS. This issue affects JetBlocks For Elementor: from n/a through 1.3.19.
CVSS v3.1: 6.5
GHSA-wxcf-x5jm-fgqv: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.
CVSS v3.1: 7.1
GHSA-h2hf-mx7w-fhwm: In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
CVSS v3.1: 8.1
RHSA-2015:1139: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
Kernel: fs: isofs: infinite loop in CE record entries kernel: use-after-free during key garbage collection kernel: isofs: unchecked printing of ER records kernel: panic while flushing nftables rules that reference deleted chains. kernel: Linux stack ASLR implementation Integer overflow kernel: pipe: iovec overrun leading to memory corruption kernel: int80 fork from 64-bit tasks mishandling
CVE-2019-25526: Inout EasyRooms Ultimate Edition v1.0 SQL Injection via search
Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the location parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads in the location field to extract sensitive data or modify database contents.
CVSS v4.0: 8.8
CVSS v3.1: 8.2
GHSA-fvrw-43j5-v43w: A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.
CVE-2025-8511: Portabilis i-Diario Observações diario-de-observacoes cross site scripting
A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ of the component Observações. The manipulation of the argument Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v4.0: 5.1
CVSS v3.1: 3.5
CVSS v3.0: 3.5
CVSS v2.0: 4
CVE-2024-50220: fork: do not invoke uffd on fork if error occurs
In the Linux kernel, the following vulnerability has been resolved:

fork: do not invoke uffd on fork if error occurs

Patch series "fork: do not expose incomplete mm on fork".

During fork we may place the virtual memory address space into an
inconsistent state before the fork operation is complete.

In addition, we may encounter an error during the fork operation that
indicates that the virtual memory address space is invalidated.

As a result, we should not be exposing it in any way to external machinery
that might interact with the mm or VMAs, machinery that is not designed to
deal with incomplete state.

We specifically update the fork logic to defer khugepaged and ksm to the
end of the operation and only to be invoked if no error arose, and
disallow uffd from observing fork events should an error have occurred.


This patch (of 2):

Currently on fork we expose the virtual address space of a process to
userland unconditionally if uffd is registered in VMAs, regardless of
whether an error arose in the fork.

This is performed in dup_userfaultfd_complete() which is invoked
unconditionally, and performs two duties - invoking registered handlers
for the UFFD_EVENT_FORK event via dup_fctx(), and clearing down
userfaultfd_fork_ctx objects established in dup_userfaultfd().

This is problematic, because the virtual address space may not yet be
correctly initialised if an error arose.

The change in commit d24062914837 ("fork: use __mt_dup() to duplicate
maple tree in dup_mmap()") makes this more pertinent as we may be in a
state where entries in the maple tree are not yet consistent.

We address this by, on fork error, ensuring that we roll back state that
we would otherwise expect to clean up through the event being handled by
userland and perform the memory freeing duty otherwise performed by
dup_userfaultfd_complete().

We do this by implementing a new function, dup_userfaultfd_fail(), which
performs the same loop, only decrementing reference counts.

Note that we perform mmgrab() on the parent and child mm's, however
userfaultfd_ctx_put() will mmdrop() this once the reference count drops to
zero, so we will avoid memory leaks correctly here.
CVSS v3.1: 4.7
CVE-2021-3613: OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe).
CVSS v3.1: 7.8
CVSS v2.0: 4.4
CVE-2020-21687: Buffer Overflow vulnerability in scan function in stdscan.c in nasm 2.15rc0 allows remote attackers to cause a denial of service via crafted asm file.
CVSS v3.1: 5.5
GHSA-5rh4-w9mq-q4mq: Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
GHSA-gq38-75hc-xc85: The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS v3.1: 9.3
RHSA-2021:4517: Red Hat Security Advisory: vim security update
vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c vim: use-after-free in nv_replace() in normal.c
CVSS v3.1: 7.3
CVE-2014-1947: Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.
CVSS v3.1: 7.8
CVSS v2.0: 6.8
GHSA-mhpq-3f55-446g: SGI IRIX 6.5.x through 6.5.20f, and possibly earlier versions, does not follow "-" entries in the /etc/group file, which may cause subsequent group membership entries to be processed inadvertently.
CVE-2019-9961: A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVSS v3.0: 6.1
CVSS v2.0: 4.3
GHSA-jw58-44xh-h2cf: The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write."
CVE-2024-33035: Integer Overflow or Wraparound in Display
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
CVSS v3.1: 8.4
CVE-2025-2090: PHPGurukul Pre-School Enrollment System Sub Admin add-subadmin.php access control
A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php of the component Sub Admin Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS v4.0: 5.1
CVSS v3.1: 4.7
CVSS v3.0: 4.7
CVSS v2.0: 5.8
GHSA-4jw4-4g69-7273: Race condition vulnerability in the Wi-Fi module.
Impact: Successful exploitation of this vulnerability will affect availability.
CVSS v3.1: 7.4
CVE-2019-6338: third-party PEAR Archive_Tar library updates
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
CVSS v3.0: 8
CVSS v2.0: 6
CVE-2022-26300: EOS v2.1.0 was discovered to contain a heap-buffer-overflow via the function txn_test_gen_plugin.
CVSS v3.1: 7.5
CVSS v2.0: 5