deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-25181
Published: 2025-12-29
Description: A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de; https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de
CVE: CVE-2024-30855
Published: 2025-12-29
Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/Limingqian123/e90a1b86c02bd83d4ab07c08cad9a629; https://github.com/Limingqian123/cms/blob/main/1.md; https://github.com/Limingqian123/cms/blob/main/1.md
CVE: CVE-2025-14175
Published: 2025-12-29
Description: A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://www.tp-link.com/en/support/download/tl-wr820n/#Firmware; https://www.tp-link.com/in/support/download/tl-wr820n/#Firmware; https://www.tp-link.com/us/support/faq/4861/
CVE: CVE-2025-15202
Published: 2025-12-29
Description: A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/cache/web/controller/TaskController.java. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/374; https://vuldb.com/?ctiid.338589; https://vuldb.com/?id.338589
CVE: CVE-2025-15203
Published: 2025-12-29
Description: A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/controller/ResourceController.java. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/375; https://vuldb.com/?ctiid.338590; https://vuldb.com/?id.338590
CVE: CVE-2025-69202
Published: 2025-12-29
Description: Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignoring request headers like `Authorization`. When the server responds with `Vary: Authorization` (indicating the response varies by auth token), the library ignores this, causing all requests to share the same cache regardless of authorization. Server-side applications (APIs, proxies, backend services) that use axios-cache-interceptor to cache requests to upstream services, handle requests from multiple users with different auth tokens, and upstream services replies on `Vary` to differentiate caches are affected. Browser/client-side applications (single user per browser session) are not affected. Services using different auth tokens to call upstream services will return incorrect cached data, bypassing authorization checks and leaking user data across different authenticated sessions. After `v1.11.1`, automatic `Vary` header support is now enabled by default. When server responds with `Vary: Authorization`, cache keys now include the authorization header value. Each user gets their own cache.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-524, CWE-573, CWE-639, CWE-639
References: https://github.com/arthurfiorette/axios-cache-interceptor/commit/49a808059dfc081b9cc23d48f243d55dfce15f01; https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44; https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44
CVE: CVE-2024-25182
Published: 2025-12-29
Description: givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://gist.github.com/joaoviictorti/ff6220d8ed6df77a0420f4413a1d9b8d
CVE: CVE-2024-25183
Published: 2025-12-29
Description: givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/joaoviictorti/db387ef5ea3d35482c5ad4598d945b2f
CVE: CVE-2024-27480
Published: 2025-12-29
Description: givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://gist.github.com/joaoviictorti/abb2d1929c29d09c13c60bb45f28a8ff; https://gist.github.com/joaoviictorti/abb2d1929c29d09c13c60bb45f28a8ff
CVE: CVE-2025-15204
Published: 2025-12-29
Description: A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/cache/web/controller/QuartzManageController.java. Executing manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/sohutv/cachecloud/issues/376; https://vuldb.com/?ctiid.338591; https://vuldb.com/?id.338591
CVE: CVE-2025-15205
Published: 2025-12-29
Description: A vulnerability was identified in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /download.php. The manipulation of the argument istore_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Bai-public/CVE/issues/4; https://vuldb.com/?ctiid.338592
CVE: CVE-2025-69205
Published: 2025-12-29
Description: Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the `Dial( )` application due to improper input validation. This allows an attacker to redirect calls on both of the federating instances. If the attack succeeds, the impact is very high. However, the requires that an admin accept the federation requests. As of time of publication, a known patched version of µURU is not available.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://docs.asterisk.org/Latest_API/API_Documentation/Dialplan_Applications/Dial; https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4
CVE: CVE-2025-15206
Published: 2025-12-29
Description: A flaw has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /admin/add_area.php. Executing a manipulation of the argument txtAreaCode can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/IMZGforever/CVEs/issues/5; https://vuldb.com/?ctiid.338579; https://vuldb.com/?id.338579
CVE: CVE-2025-15207
Published: 2025-12-29
Description: A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/view_products.php. The manipulation of the argument chkId[] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/IMZGforever/CVEs/issues/6; https://vuldb.com/?ctiid.338580; https://vuldb.com/?id.338580
CVE: CVE-2025-68502
Published: 2025-12-29
Description: Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/jet-popup/vulnerability/wordpress-jetpopup-plugin-2-0-20-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-68503
Published: 2025-12-29
Description: Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetBlog: from n/a through <= 2.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-68504
Published: 2025-12-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68562
Published: 2025-12-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.7.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-7-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-68607
Published: 2025-12-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Stored XSS.This issue affects Custom Field Template: from n/a through <= 2.7.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-field-template/vulnerability/wordpress-custom-field-template-plugin-2-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68860
Published: 2025-12-29
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/mobile-builder/vulnerability/wordpress-mobile-builder-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-15208
Published: 2025-12-29
Description: A security flaw has been discovered in code-projects Refugee Food Management System 1.0. Affected by this issue is some unknown functionality of the file /home/editrefugee.php. The manipulation of the argument rfid results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/11alert/CVE/issues/1; https://vuldb.com/?ctiid.338593
CVE: CVE-2025-15209
Published: 2025-12-29
Description: A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulation of the argument a/b/c/d causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/YZS17/CVE/blob/main/Refugee%20Food_Management_System/sqli_editfood.php.md; https://vuldb.com/?ctiid.338594
CVE: CVE-2025-15284
Published: 2025-12-29
Description: Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.


Summary

The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.

Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.

Details

The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).

Vulnerable code (lib/parse.js:159-162):

if (root === '[]' && options.parseArrays) {
    obj = utils.combine([], leaf);  // No arrayLimit check
}





Working code (lib/parse.js:175):

else if (index <= options.arrayLimit) {  // Limit checked here
    obj = [];
    obj[index] = leaf;
}





The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.



PoC

const qs = require('qs');
const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
console.log(result.a.length);  // Output: 6 (should be max 5)





Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.

Impact

Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.
CVSS Score: 3.7 (LOW)
CWE: CWE-20
References: https://github.com/ljharb/qs/commit/3086902ecf7f088d0d[PII_REDACTED]ac6c03d415b9; https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p
CVE: CVE-2023-32238
Published: 2025-12-30
Description: Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://vdp.patchstack.com/database/wordpress/theme/thegem-elementor/vulnerability/wordpress-thegem-elementor-theme-5-7-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-41656
Published: 2025-12-30
Description: Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://vdp.patchstack.com/database/wordpress/plugin/better-elementor-addons/vulnerability/wordpress-better-elementor-addons-plugin-1-3-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-15210
Published: 2025-12-30
Description: A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This vulnerability affects unknown code of the file /home/editrefugee.php. Such manipulation of the argument a/b/c/sex/d/e/nationality_nid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/YZS17/CVE/blob/main/Refugee%20Food_Management_System/sqli_editrefugee.php.md; https://vuldb.com/?ctiid.338595
CVE: CVE-2025-23458
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rakessh Ads24 Lite wp-ad-management allows Reflected XSS.This issue affects Ads24 Lite: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-ad-management/vulnerability/wordpress-ads24-lite-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23469
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sleekplan Sleekplan sleekplan allows Reflected XSS.This issue affects Sleekplan: from n/a through <= 0.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sleekplan/vulnerability/wordpress-sleekplan-plugin-0-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23550
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemal YAZICI Product Puller product-puller allows Reflected XSS.This issue affects Product Puller: from n/a through <= 1.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/product-puller/vulnerability/wordpress-product-puller-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23554
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Off Page SEO off-page-seo allows Reflected XSS.This issue affects Off Page SEO: from n/a through <= 3.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/off-page-seo/vulnerability/wordpress-off-page-seo-plugin-3-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-68036
Published: 2025-12-30
Description: Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CubeWP: from n/a through <= 1.1.27.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cubewp-framework/vulnerability/wordpress-cubewp-plugin-1-1-27-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-68040
Published: 2025-12-30
Description: Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/wedevs-project-manager/vulnerability/wordpress-wp-project-manager-plugin-2-6-29-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-68120
Published: 2025-12-30
Description: To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.
CVSS Score: 5.4 (MEDIUM)
References: https://groups.google.com/g/golang-dev/c/CHG4qfcicBU/m/4tanFUymDQAJ; https://nvd.nist.gov/vuln/detail/CVE-2025-68120; https://pkg.go.dev/vuln/GO-2025-4249
CVE: CVE-2025-68498
Published: 2025-12-30
Description: Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-68499
Published: 2025-12-30
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-15211
Published: 2025-12-30
Description: A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/YZS17/CVE/blob/main/Refugee%20Food_Management_System/sqli_refugee.php.md; https://vuldb.com/?ctiid.338597
CVE: CVE-2025-15212
Published: 2025-12-30
Description: A vulnerability was detected in code-projects Refugee Food Management System 1.0. This issue affects some unknown processing of the file /home/regfood.php. Performing manipulation of the argument a results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/YZS17/CVE/blob/main/Refugee%20Food_Management_System/sqli_regfood.php.md; https://vuldb.com/?ctiid.338596
CVE: CVE-2025-15213
Published: 2025-12-30
Description: A vulnerability has been found in code-projects Student File Management System 1.0. The affected element is an unknown function of the file /download.php of the component File Download Handler. The manipulation of the argument store_id leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://code-projects.org/; https://github.com/Bai-public/CVE/issues/5; https://vuldb.com/?ctiid.338598
CVE: CVE-2025-69217
Published: 2025-12-30
Description: coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.
CVSS Score: 7.7 (HIGH)
CWE: CWE-338
References: https://github.com/coturn/coturn/commit/11fc465f4bba70bb0ad8aae17d6c4a63a29917d9; https://github.com/coturn/coturn/commit/88ced471385869d7e7fbbc4766e78ef521b36af6; https://github.com/coturn/coturn/security/advisories/GHSA-fvj6-9jhg-9j84
CVE: CVE-2025-15214
Published: 2025-12-30
Description: A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/dobkill/CVE/issues/2; https://vuldb.com/?ctiid.338599; https://vuldb.com/?id.338599