deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42212
Published: 2025-05-05
Description: HCL BigFix Compliance is affected by an improper or missing SameSite attribute.  This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1275
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120961
CVE: CVE-2024-42213
Published: 2025-05-05
Description: HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment.  An attacker might gain access to these files by indexing or retrieved via predictable URLs or misconfigured permissions, leading to information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-531
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120961
CVE: CVE-2025-29573
Published: 2025-05-05
Description: Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/stephenmcd/mezzanine; https://www.squadappsec.com/post/cve-2025-29573-persistent-xss-in-mezzanine-cms-6-0-0-via-malicious-filename
CVE: CVE-2025-43849
Published: 2025-05-05
Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_a and cpkt_b variables take user input (e.g. a path to a model) and pass it to the merge function in process_ckpt.py, which uses them to load the models on those paths with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/lib/train/process_ckpt.py#L196; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1357; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1358
CVE: CVE-2025-43850
Published: 2025-05-05
Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckpt_dir variable takes user input (e.g. a path to a model) and passes it to the change_info function in export.py, which uses it to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/onnx/export.py#L7; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1495; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1505
CVE: CVE-2025-43851
Published: 2025-05-05
Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , a new instance of AudioPre class is created with the model_path attribute containing the aformentioned user input. In the AudioPre class, the user input, is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/onnx/export.py#L7; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1073; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1098
CVE: CVE-2025-43852
Published: 2025-05-05
Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The model_choose variable takes user input (e.g. a path to a model) and passes it to the uvr function in vr.py. In uvr , if model_name contains the string "DeEcho", a new instance of AudioPreDeEcho class is created with the model_path attribute containing the aforementioned user input. In the AudioPreDeEcho class, the user input is used to load the model on that path with torch.load, which can lead to unsafe deserialization and remote code execution. As of time of publication, no known patches exist.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/7ef19867780cf703841ebafb565a4e47d1ea86ff/infer/modules/uvr5/vr.py#L214; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1073; https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/blob/9f2f0559e6932c10c48642d404e7d2e771d9db43/infer-web.py#L1098
CVE: CVE-2025-46335
Published: 2025-05-05
Description: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6987a946485a795f4fd38cebdb4860b368a1995d; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-mwfg-948f-2cc5
CVE: CVE-2025-46340
Published: 2025-05-05
Description: Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in `UrlPreviewService` and `MkUrlPreview`, it is possible for an attacker to inject arbitrary CSS into the `MkUrlPreview` component. `UrlPreviewService.wrap` falls back to returning the original URL if it's using a protocol that is likely to not be understood by Misskey, IE something other than `http` or `https`. This both can de-anonymize users and_allow further attacks in the client. Additionally, `MkUrlPreview` doesn't escape CSS when applying a `background-image` property, allowing an attacker to craft a URL that applies arbitrary styles to the preview element. Theoretically, an attacker can craft a CSS injection payload to create a fake error message that can deceive the user into giving away their credentials or similar sensitive information. Version 2025.4.1 contains a patch for the issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-116
References: https://github.com/misskey-dev/misskey/commit/d10fdfe9738b17a9d81037c031b40a2cc4cb8038; https://github.com/misskey-dev/misskey/security/advisories/GHSA-3p2w-xmv5-jm95
CVE: CVE-2025-46553
Published: 2025-05-05
Description: @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects, despite explicitly requesting not to. Version 5.2.1 contains a patch for the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-665, CWE-669, CWE-693
References: https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed; https://github.com/misskey-dev/summaly/security/advisories/GHSA-7899-w6c4-vqc4
CVE: CVE-2025-46559
Published: 2025-05-05
Description: Misskey is an open source, federated social media platform. Starting in version 12.31.0 and prior to version 2025.4.1, missing validation in `Mk:api` allows malicious AiScript code to access additional endpoints that it isn't designed to have access to. The missing validation allows malicious AiScript code to prefix a URL with `../` to step out of the `/api` directory, thereby being able to make requests to other endpoints, such as `/files`, `/url`, and `/proxy`. Version 2025.4.1 fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/misskey-dev/misskey/commit/583df3ec63e25a1fd34def0dac13405396b8b663; https://github.com/misskey-dev/misskey/security/advisories/GHSA-gmq6-738q-vjp2
CVE: CVE-2025-46571
Published: 2025-05-05
Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the `/api/v1/files/` backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files uploaded by low-privileged users can only be viewed by admins or themselves, limiting the impact of this vulnerability. A link to such a file can be sent to an admin, and if clicked, will give the low-privileged user complete control over the admin's account, ultimately enabling RCE via functions. Version 0.6.6 contains a fix for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/files.py#L434-L438; https://github.com/open-webui/open-webui/commit/ef2aeb7c0eb976bac759e59ac359c94a5b8dc7e0; https://github.com/open-webui/open-webui/security/advisories/GHSA-8gh5-qqh8-hq3x
CVE: CVE-2025-46719
Published: 2025-05-05
Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, a vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's access token and gain full control over their account. Chat transcripts can be shared with other users in the same server, or with the whole open-webui community if "Enable Community Sharing" is enabled in the admin panel. If this exploit is used against an admin user, it is possible to achieve Remote Code Execution on the server where the open-webui backend is hosted. This can be done by creating a new function which contains malicious python code. This vulnerability also affects chat transcripts uploaded to `https://openwebui.com/c/<user>/<chat_id>`, allowing for wormable stored XSS in https[:]//openwebui[.]com. Version 0.6.6 contains a patch for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/open-webui/open-webui/blob/main/src/lib/components/chat/Messages/Markdown/MarkdownTokens.svelte#L269-L279; https://github.com/open-webui/open-webui/commit/6fd082d55ffaf6eb226efdeebc7155e3693d2d01; https://github.com/open-webui/open-webui/security/advisories/GHSA-9f4f-jv96-8766
CVE: CVE-2025-46720
Published: 2025-05-05
Description: Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mutations by adding additional unique filters. These filters can be used as an oracle to probe the existence or value of otherwise unreadable fields. Specifically, when a mutation includes a `where` clause with multiple unique filters (e.g. `id` and `email`), Keystone will attempt to match records even if filtering by the latter fields would normally be rejected by `field.isFilterable` or `list.defaultIsFilterable`. This can allow malicious actors to infer the presence of a particular field value when a filter is successful in returning a result. This affects any project relying on the default or dynamic `isFilterable` behavior (at the list or field level) to prevent external users from using the filtering of fields as a discovery mechanism. While this access control is respected during `findMany` operations, it was not completely enforced during `update` and `delete` mutations when accepting more than one unique `where` values in filters. This has no impact on projects using `isFilterable: false` or `defaultIsFilterable: false` for sensitive fields, or for those who have otherwise omitted filtering by these fields from their GraphQL schema. This issue has been patched in `@keystone-6/core` version 6.5.0. To mitigate this issue in older versions where patching is not a viable pathway, set `isFilterable: false` statically for relevant fields to prevent filtering by them earlier in the access control pipeline (that is, don't use functions); set `{field}.graphql.omit.read: true` for relevant fields, which implicitly removes filtering by these fields from the GraphQL schema; and/or deny `update` and `delete` operations for the relevant lists completely.
CVSS Score: 3.1 (LOW)
CWE: CWE-200, CWE-203
References: https://github.com/keystonejs/keystone/security/advisories/GHSA-hg9m-67mm-7pg3
CVE: CVE-2025-4279
Published: 2025-05-05
Description: The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external_image_replace_get_posts::replace_post' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/external-image-replace/tags/1.0.8/class.php#L87; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1624fd-d98b-4953-99dc-a952dda48aa1?source=cve
CVE: CVE-2025-4283
Published: 2025-05-05
Description: A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/th3w0lf-1337/Vulnerabilities/blob/main/SMS-PHP/SQLi/Auth-Bypass/info.md; https://vuldb.com/?ctiid.307391; https://vuldb.com/?id.307391
CVE: CVE-2025-4318
Published: 2025-05-05
Description: The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
CWE: CWE-95
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-010/; https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3; https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8
CVE: CVE-2025-1909
Published: 2025-05-05
Description: The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/; https://www.buddyboss.com/resources/buddyboss-platform-pro-releases/2-7-10/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7cce9b8b-0589-4b09-b184-a66fc86fcb46?source=cve
CVE: CVE-2025-45607
Published: 2025-05-05
Description: An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://github.com/michaelliao/itranswarp/issues/73
CVE: CVE-2025-45608
Published: 2025-05-05
Description: Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/zykzhangyukang/Xinguan/issues/26
CVE: CVE-2025-45609
Published: 2025-05-05
Description: Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/LianjiaTech/kob/issues/29
CVE: CVE-2025-45610
Published: 2025-05-05
Description: Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/Jackson0714/PassJava-Platform/issues/48
CVE: CVE-2025-45611
Published: 2025-05-05
Description: Incorrect access control in the /user/edit/ component of hope-boot v1.0.0 allows attackers to bypass authentication via a crafted GET request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/java-aodeng/hope-boot/issues/86
CVE: CVE-2025-45612
Published: 2025-05-05
Description: Incorrect access control in xmall v1.1 allows attackers to bypass authentication via a crafted GET request to /index.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/Exrick/xmall/issues/96
CVE: CVE-2025-45613
Published: 2025-05-05
Description: Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/zhaojun1998/Shiro-Action/issues/24
CVE: CVE-2025-45614
Published: 2025-05-05
Description: Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/lcw2004/one/issues/44
CVE: CVE-2025-45615
Published: 2025-05-05
Description: Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/user-xiangpeng/yaoqishan/issues/29
CVE: CVE-2025-45616
Published: 2025-05-05
Description: Incorrect access control in the /admin/** API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/baidu/brcc/issues/194
CVE: CVE-2025-45617
Published: 2025-05-05
Description: Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/megagao/production_ssm/issues/33
CVE: CVE-2025-45618
Published: 2025-05-05
Description: Incorrect access control in the component /admin/sys/datasource/ajaxList of jeeweb-mybatis-springboot v0.0.1.RELEASE allows attackers to access sensitive information via a crafted payload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/huangjian888/jeeweb-mybatis-springboot/issues/31
CVE: CVE-2025-46726
Published: 2025-05-05
Description: Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Version 0.53.4 fixes the issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://github.com/langroid/langroid/blob/df6227e6c079ec22bb[PII_REDACTED]148d6685acff/langroid/agent/xml_tool_message.py#L51-L52; https://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3; https://github.com/langroid/langroid/security/advisories/GHSA-pw95-88fg-3j6f
CVE: CVE-2025-46730
Published: 2025-05-05
Description: MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications. Access to the MobSF web interface is often granted to internal security teams, audit teams, and external vendors.  MobSF provides a feature that allows users to upload ZIP files for static analysis. Upon upload, these ZIP files are automatically extracted and stored within the MobSF directory. However, in versions up to and including 4.3.2, this functionality lacks a check on the total uncompressed size of the ZIP file, making it vulnerable to a ZIP of Death (zip bomb) attack. Due to the absence of safeguards against oversized extractions, an attacker can craft a specially prepared ZIP file that is small in compressed form but expands to a massive size upon extraction. Exploiting this, an attacker can exhaust the server's disk space, leading to a complete denial of service (DoS) not just for MobSF, but also for any other applications or websites hosted on the same server. This vulnerability can lead to complete server disruption in an organization which can affect other internal portals and tools too (which are hosted on the same server). If some organization has created their customized cloud based mobile security tool using MobSF core then an attacker can exploit this vulnerability to crash their servers. Commit 6987a946485a795f4fd38cebdb4860b368a1995d fixes this issue. As an additional mitigation, it is recommended to implement a safeguard that checks the total uncompressed size of any uploaded ZIP file before extraction. If the estimated uncompressed size exceeds a safe threshold (e.g., 100 MB), MobSF should reject the file and notify the user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-409
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6987a946485a795f4fd38cebdb4860b368a1995d; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-c5vg-26p8-q8cr
CVE: CVE-2025-46731
Published: 2025-05-05
Description: Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CHANGES` must be enabled for this to work. Users should update to the patched versions 4.14.13 or 5.6.15 to mitigate the issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1336
References: http://github.com/craftcms/cms/pull/17026; https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production; https://github.com/craftcms/cms/security/advisories/GHSA-7c58-g782-9j38