deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11082
Published: 2025-09-27
Description: A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with "[f]ixed for 2.46".
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://sourceware.org/bugzilla/attachment.cgi?id=16358; https://sourceware.org/bugzilla/show_bug.cgi?id=33464; https://sourceware.org/bugzilla/show_bug.cgi?id=33464#c2
CVE: CVE-2025-11083
Published: 2025-09-27
Description: A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://sourceware.org/bugzilla/attachment.cgi?id=16353; https://sourceware.org/bugzilla/show_bug.cgi?id=33457; https://sourceware.org/bugzilla/show_bug.cgi?id=33457#c1
CVE: CVE-2025-11088
Published: 2025-09-28
Description: A weakness has been identified in itsourcecode Open Source Job Portal 1.0. Impacted is an unknown function of the file /admin/vacancy/index.php?view=edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/yihaofuweng/cve/issues/35; https://itsourcecode.com/; https://vuldb.com/?ctiid.326156
CVE: CVE-2025-11089
Published: 2025-09-28
Description: A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Profilers/PriProfile/COUNT3s4.php. Executing manipulation of the argument cbranch can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/evilthan9/cve/issues/2; https://vuldb.com/?ctiid.326171; https://vuldb.com/?id.326171
CVE: CVE-2025-11090
Published: 2025-09-28
Description: A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected is an unknown function of the file /admin/employee/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/friendddy/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.326172
CVE: CVE-2025-11091
Published: 2025-09-28
Description: A security flaw has been discovered in Tenda AC21 up to 16.03.08.16. Affected by this vulnerability is the function sscanf of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/maximdevere/CVE2/issues/2; https://vuldb.com/?ctiid.326173; https://vuldb.com/?id.326173
CVE: CVE-2025-11092
Published: 2025-09-28
Description: A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_switch_settings. This manipulation of the argument port causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/maximdevere/CVE2/issues/4; https://vuldb.com/?ctiid.326174; https://vuldb.com/?id.326174
CVE: CVE-2025-11094
Published: 2025-09-28
Description: A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_product_details.php. Such manipulation of the argument prod_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wolfsecurity2/CVE/tree/main/tmp34; https://vuldb.com/?ctiid.326175
CVE: CVE-2025-11095
Published: 2025-09-28
Description: A vulnerability was detected in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/delete_offline_device. Performing manipulation of the argument delvalue results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/n1ptune/dink/blob/main/delete_offline_device.md; https://vuldb.com/?ctiid.326176; https://vuldb.com/?id.326176
CVE: CVE-2025-11096
Published: 2025-09-28
Description: A flaw has been found in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/diag_traceroute. Executing manipulation of the argument target_addr can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/n1ptune/dink/blob/main/diag_traceroute.md; https://vuldb.com/?ctiid.326177; https://vuldb.com/?id.326177
CVE: CVE-2025-11097
Published: 2025-09-28
Description: A vulnerability has been found in D-Link DIR-823X 250416. Impacted is an unknown function of the file /goform/set_device_name. The manipulation of the argument mac leads to command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/n1ptune/dink/blob/main/set_device_name.md; https://vuldb.com/?ctiid.326178; https://vuldb.com/?id.326178
CVE: CVE-2025-11098
Published: 2025-09-28
Description: A vulnerability was found in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_wifi_blacklists. The manipulation of the argument macList results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/n1ptune/dink/blob/main/set_wifi_blacklists.md; https://vuldb.com/?ctiid.326179; https://vuldb.com/?id.326179
CVE: CVE-2025-11099
Published: 2025-09-28
Description: A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/n1ptune/dink/blob/main/uci_del_in_delete_prohibiting.md; https://vuldb.com/?ctiid.326180; https://vuldb.com/?id.326180
CVE: CVE-2025-11100
Published: 2025-09-28
Description: A vulnerability was identified in D-Link DIR-823X 250416. This affects the function uci_set of the file /goform/set_wifi_blacklists. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/n1ptune/dink/blob/main/uci_set.md; https://vuldb.com/?ctiid.326181; https://vuldb.com/?id.326181
CVE: CVE-2025-11101
Published: 2025-09-28
Description: A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php?view=edit. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/yihaofuweng/cve/issues/37; https://itsourcecode.com/; https://vuldb.com/?ctiid.326182
CVE: CVE-2025-11102
Published: 2025-09-28
Description: A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_content.php. Executing manipulation of the argument Title can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hbesljx/vul/issues/1; https://vuldb.com/?ctiid.326183; https://vuldb.com/?id.326183
CVE: CVE-2025-11103
Published: 2025-09-28
Description: A security vulnerability has been detected in Projectworlds Online Tours and Travels 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Landjun/CVE/issues/1; https://vuldb.com/?ctiid.326184; https://vuldb.com/?id.326184
CVE: CVE-2025-11104
Published: 2025-09-28
Description: A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The manipulation of the argument uid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/WANGshuyan2025/cve/issues/1; https://vuldb.com/?ctiid.326185
CVE: CVE-2025-11105
Published: 2025-09-28
Description: A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulation of the argument subcode causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/WANGshuyan2025/cve/issues/2; https://vuldb.com/?ctiid.326186
CVE: CVE-2025-11106
Published: 2025-09-28
Description: A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulingsystem/addfaculty.php. Such manipulation of the argument falname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/WANGshuyan2025/cve/issues/3; https://vuldb.com/?ctiid.326187
CVE: CVE-2025-11107
Published: 2025-09-28
Description: A vulnerability was found in code-projects Simple Scheduling System 1.0. This issue affects some unknown processing of the file /schedulingsystem/addcourse.php. Performing manipulation of the argument corcode results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/WANGshuyan2025/cve/issues/4; https://vuldb.com/?ctiid.326188
CVE: CVE-2025-11108
Published: 2025-09-28
Description: A vulnerability was determined in code-projects Simple Scheduling System 1.0. Impacted is an unknown function of the file /schedulingsystem/addroom.php. Executing manipulation of the argument room can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/WANGshuyan2025/cve/issues/5; https://vuldb.com/?ctiid.326189
CVE: CVE-2025-11109
Published: 2025-09-28
Description: A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/us_edit.php?action=edit. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/DrNbnonono/CVE/issues/1; https://vuldb.com/?ctiid.326190; https://vuldb.com/?id.326190
CVE: CVE-2025-11110
Published: 2025-09-28
Description: A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/school_year.php. The manipulation of the argument school_year results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/JKyukino/cve/issues/1; https://vuldb.com/?ctiid.326191; https://vuldb.com/?id.326191
CVE: CVE-2025-11111
Published: 2025-09-28
Description: A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidates_edit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Clw309/CVE/issues/1; https://vuldb.com/?ctiid.326192; https://vuldb.com/?id.326192
CVE: CVE-2025-11112
Published: 2025-09-28
Description: A security vulnerability has been detected in PHPGurukul Employee Record Management System 1.3. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument First name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/tiancesec/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.326193
CVE: CVE-2025-11113
Published: 2025-09-28
Description: A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the argument city results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/yihaofuweng/cve/issues/39; https://vuldb.com/?ctiid.326194
CVE: CVE-2025-11114
Published: 2025-09-28
Description: A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.php. Executing manipulation of the argument absence[] can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/yihaofuweng/cve/issues/40; https://vuldb.com/?ctiid.326195
CVE: CVE-2025-11115
Published: 2025-09-28
Description: A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the file /addtime.php. The manipulation of the argument starttime/endtime leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/41; https://vuldb.com/?ctiid.326196
CVE: CVE-2025-11116
Published: 2025-09-28
Description: A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argument faculty results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/42; https://vuldb.com/?ctiid.326197
CVE: CVE-2025-11117
Published: 2025-09-28
Description: A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/zhaoyinshan/CVE/issues/2; https://vuldb.com/?ctiid.326198; https://vuldb.com/?id.326198
CVE: CVE-2025-11118
Published: 2025-09-28
Description: A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.php. Such manipulation of the argument staffId leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/Clw309/CVE/issues/2; https://vuldb.com/?ctiid.326199
CVE: CVE-2025-11119
Published: 2025-09-28
Description: A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the component POST Request Handler. Performing manipulation of the argument from results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/iflame28/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.326200
CVE: CVE-2025-11120
Published: 2025-09-28
Description: A weakness has been identified in Tenda AC8 16.03.34.06. The affected element is the function formSetServerConfig of the file /goform/SetServerConfig. Executing manipulation can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/alc9700jmo/CVE/issues/19; https://vuldb.com/?ctiid.326201; https://vuldb.com/?id.326201
CVE: CVE-2025-11121
Published: 2025-09-28
Description: A security vulnerability has been detected in Tenda AC18 15.03.05.19. The impacted element is an unknown function of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/AdvSetLanip.md; https://vuldb.com/?ctiid.326202; https://vuldb.com/?id.326202
CVE: CVE-2025-11122
Published: 2025-09-28
Description: A vulnerability was detected in Tenda AC18 15.03.05.19. This affects an unknown function of the file /goform/WizardHandle. The manipulation of the argument WANT/mtuvalue results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WizardHandle.md; https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/WizardHandle2.md; https://vuldb.com/?ctiid.326203
CVE: CVE-2025-11123
Published: 2025-09-28
Description: A flaw has been found in Tenda AC18 15.03.05.19. This impacts an unknown function of the file /goform/saveAutoQos. This manipulation of the argument enable causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/saveAutoQos.md; https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC18/saveAutoQos.md#poc; https://vuldb.com/?ctiid.326204
CVE: CVE-2025-11124
Published: 2025-09-28
Description: A vulnerability has been found in code-projects Project Monitoring System 1.0. Affected is an unknown function of the file /onlineJobSearchEngine/postjob.php. Such manipulation of the argument txtapplyto leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/xss4.md; https://github.com/asd1238525/cve/blob/main/xss4.md#poc
CVE: CVE-2025-11125
Published: 2025-09-29
Description: A vulnerability was found in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. Affected by this vulnerability is an unknown functionality of the file /connection_error.php of the component Error Message Handler. Performing manipulation of the argument Error results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/Lianhaorui/Report/blob/main/xss.docx; https://vuldb.com/?ctiid.326206; https://vuldb.com/?id.326206
CVE: CVE-2025-11126
Published: 2025-09-29
Description: A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation results in hard-coded credentials. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://vuldb.com/?ctiid.326209; https://vuldb.com/?id.326209; https://vuldb.com/?submit.654168
CVE: CVE-2025-11130
Published: 2025-09-29
Description: A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTool.m of the component XPC Service. This manipulation causes missing authentication. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.4 (HIGH)
CWE: CWE-287, CWE-306
References: https://github.com/SwayZGl1tZyyy/n-days/blob/main/pptp-vpn/README.md; https://vuldb.com/?ctiid.326210; https://vuldb.com/?id.326210
CVE: CVE-2025-11134
Published: 2025-09-29
Description: A security vulnerability has been detected in Cudy TR1200 1.16.3-20[PII_REDACTED]35. Impacted is an unknown function of the file /cgi-bin/luci/admin/network/wireless/config/ of the component Wireless Settings Page. Such manipulation of the argument SSID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/blackcloud411/Cudy_vuln/blob/main/CUDY_TR1200_XSS_Report.docx; https://vuldb.com/?ctiid.326211; https://vuldb.com/?id.326211