deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7125
Published: 2025-07-07
Description: A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/editempeducation.php. The manipulation of the argument coursepg leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/manyufann/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.315037
CVE: CVE-2025-7126
Published: 2025-07-07
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Employee Management System up to 1.0. Affected by this issue is some unknown functionality of the file /admin/adminprofile.php. The manipulation of the argument AdminName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/manyufann/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.315038
CVE: CVE-2025-7127
Published: 2025-07-07
Description: A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown part of the file /admin/changepassword.php. The manipulation of the argument currentpassword leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/manyufann/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.315039
CVE: CVE-2025-6209
Published: 2025-07-07
Description: A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitive system files. The issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory. The vulnerability is fixed in version 0.12.41.
CVSS Score: 7.5 (HIGH)
CWE: CWE-29
References: https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274; https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68; https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68
CVE: CVE-2025-7128
Published: 2025-07-07
Description: A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax.php?action=calculate_payroll. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/15; https://vuldb.com/?ctiid.315040; https://vuldb.com/?id.315040
CVE: CVE-2025-7129
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.php?action=delete_employee_attendance_single. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/16; https://vuldb.com/?ctiid.315041; https://vuldb.com/?id.315041
CVE: CVE-2023-51232
Published: 2025-07-07
Description: Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via crafted request to the /logs endpoint. This may be restricted to certain file names that start with a dot ('.').
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/dagster-io/dagster/pull/18462; https://github.com/dagster-io/dagster/pull/18462
CVE: CVE-2025-7056
Published: 2025-07-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Extension allows Stored XSS.This issue affects Mediawiki - UrlShortener Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UrlShortener/+/1166268; https://phabricator.wikimedia.org/T394869
CVE: CVE-2025-7130
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php?action=delete_payroll. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/17; https://vuldb.com/?ctiid.315042; https://vuldb.com/?id.315042
CVE: CVE-2025-7131
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=save_employee_attendance. The manipulation of the argument employee_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/19; https://vuldb.com/?ctiid.315043; https://vuldb.com/?id.315043
CVE: CVE-2025-43930
Published: 2025-07-07
Description: Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-472
References: https://github.com/hashview/hashview/blob/579a082176279f4af0e128e44c9da5667f82ec5a/hashview/users/routes.py#L198-L218; https://github.com/hashview/hashview/issues/145
CVE: CVE-2025-53486
Published: 2025-07-07
Description: The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escaping. An attacker can inject JavaScript event handlers such as onmouseenter using carefully crafted input via the {{#tag:tagcloud}} parser function, resulting in arbitrary JavaScript execution when a victim hovers over a link in the category cloud.




The vulnerability exists because the linkstyle parameter is only passed through Sanitizer::checkCss() (which does not escape HTML) and is then directly inserted into a style attribute using string concatenation instead of Html::element or Html::openElement.




This issue affects Mediawiki - WikiCategoryTagCloud extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Idd68cf2372aedd916687d30b1bd09ebb48fcfd17; https://phabricator.wikimedia.org/T394590
CVE: CVE-2025-5987
Published: 2025-07-07
Description: A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes.
CVSS Score: 8.1 (HIGH)
CWE: CWE-393
References: https://access.redhat.com/errata/RHSA-2025:23483; https://access.redhat.com/errata/RHSA-2025:23484; https://access.redhat.com/errata/RHSA-2026:0427
CVE: CVE-2025-6663
Published: 2025-07-07
Description: GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the parsing of H266 sei messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27381.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://gitlab.freedesktop.org/tpm/gstreamer/-/commit/eedd01ac3dfeb60e36a44bb61a6d0418454e8416; https://www.zerodayinitiative.com/advisories/ZDI-25-467/
CVE: CVE-2025-6711
Published: 2025-07-07
Description: An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0 versions prior to 6.0.21.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://jira.mongodb.org/browse/SERVER-98720
CVE: CVE-2025-6712
Published: 2025-07-07
Description: MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://jira.mongodb.org/browse/SERVER-106751
CVE: CVE-2025-6713
Published: 2025-07-07
Description: An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB Server v8.0 versions prior to 8.0.7, MongoDB Server v7.0 versions prior to 7.0.19 and MongoDB Server v6.0 versions prior to 6.0.22
CVSS Score: 7.7 (HIGH)
CWE: CWE-285
References: https://jira.mongodb.org/browse/SERVER-106752
CVE: CVE-2025-6714
Published: 2025-07-07
Description: MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9

Required Configuration:

This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-834
References: https://jira.mongodb.org/browse/SERVER-106753
CVE: CVE-2025-6793
Published: 2025-07-07
Description: Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the QLogicDownloadImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files and disclose information in the context of SYSTEM. Was ZDI-CAN-24912.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-450/
CVE: CVE-2025-6794
Published: 2025-07-07
Description: Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the saveAsText method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24913.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-454/
CVE: CVE-2025-6795
Published: 2025-07-07
Description: Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the getFileUploadSize method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24914.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-455/
CVE: CVE-2025-6796
Published: 2025-07-07
Description: Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the getAppFileBytes method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24916.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-451/
CVE: CVE-2025-6797
Published: 2025-07-07
Description: Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the getFileUploadBytes method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24917.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-456/
CVE: CVE-2025-6798
Published: 2025-07-07
Description: Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the deleteAppFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-24918.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-457/
CVE: CVE-2025-6799
Published: 2025-07-07
Description: Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the getFileUploadBytes method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24919.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-458/
CVE: CVE-2025-6800
Published: 2025-07-07
Description: Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the restoreESwitchConfig method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24920.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-459/
CVE: CVE-2025-6801
Published: 2025-07-07
Description: Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the saveNICParamsToFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of SYSTEM. Was ZDI-CAN-24921.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-460/
CVE: CVE-2025-6802
Published: 2025-07-07
Description: Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the getFileFromURL method. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24922.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.zerodayinitiative.com/advisories/ZDI-25-464/
CVE: CVE-2025-6803
Published: 2025-07-07
Description: Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the compressDriverFiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24923.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-452/
CVE: CVE-2025-6804
Published: 2025-07-07
Description: Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the compressFirmwareDumpFiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24924.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-453/
CVE: CVE-2025-6805
Published: 2025-07-07
Description: Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the deleteEventLogFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. Was ZDI-CAN-24925.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-461/
CVE: CVE-2025-6806
Published: 2025-07-07
Description: Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the decryptFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of SYSTEM. Was ZDI-CAN-24979.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-462/
CVE: CVE-2025-6807
Published: 2025-07-07
Description: Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the getDriverTmpPath method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24980.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-463/
CVE: CVE-2025-6810
Published: 2025-07-07
Description: Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of the ReadValue method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25246.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-25-448/
CVE: CVE-2025-6811
Published: 2025-07-07
Description: Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the TypeResolutionService class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25397.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-25-449/