deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-59532
Published: 2025-09-22
Description: Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat a model-generated cwd as the sandbox’s writable root, including paths outside of the folder where the user started their session. This logic bypassed the intended workspace boundary and enables arbitrary file writes and command execution where the Codex process has permissions - this did not impact the network-disabled sandbox restriction. This issue has been patched in Codex CLI 0.39.0 that canonicalizes and validates that the boundary used for sandbox policy is based on where the user started the session, and not the one generated by the model. Users running 0.38.0 or earlier should update immediately via their package manager or by reinstalling the latest Codex CLI to ensure sandbox boundaries are enforced. If using the Codex IDE extension, users should immediately update to 0.4.12 for a fix of the sandbox issue.
CWE: CWE-20
References: https://github.com/openai/codex/commit/[PII_REDACTED]a1e0faabc2af3db805b66ce3ae182d; https://github.com/openai/codex/releases/tag/rust-v0.39.0; https://github.com/openai/codex/security/advisories/GHSA-w5fx-fh39-j5rw
CVE: CVE-2025-59535
Published: 2025-09-22
Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-200, CWE-829
References: https://github.com/dnnsoftware/Dnn.Platform/blob/develop/DNN%20Platform/Library/UI/Skins/Skin.cs#L305; https://github.com/dnnsoftware/Dnn.Platform/commit/72f30f69fd2214d77f6c2577dfcca495a24caf5c; https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-wq2j-w9pm-7x2p
CVE: CVE-2025-10816
Published: 2025-09-22
Description: A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity reference. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-610, CWE-611, CWE-611
References: https://github.com/[PII_REDACTED]/CVE/issues/1; https://vuldb.com/?ctiid.325174; https://vuldb.com/?id.325174
CVE: CVE-2025-10817
Published: 2025-09-22
Description: A weakness has been identified in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/admin_user.php. Executing manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/244556089/cve/issues/1; https://vuldb.com/?ctiid.325175; https://vuldb.com/?id.325175
CVE: CVE-2025-43806
Published: 2025-09-22
Description: Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43806
CVE: CVE-2025-10819
Published: 2025-09-22
Description: A security vulnerability has been detected in fuyang_lipengjun platform 1.0. This issue affects the function UserCouponController of the file /usercoupon/queryAll. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.325176; https://vuldb.com/?id.325176; https://vuldb.com/?submit.653740
CVE: CVE-2025-10820
Published: 2025-09-22
Description: A vulnerability was detected in fuyang_lipengjun platform 1.0. Impacted is the function TopicController of the file /topic/queryAll. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.325177; https://vuldb.com/?id.325177; https://vuldb.com/?submit.653741
CVE: CVE-2025-10821
Published: 2025-09-22
Description: A flaw has been found in fuyang_lipengjun platform 1.0. The affected element is the function TopicCategoryController of the file /topiccategory/queryAll. This manipulation causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.325178; https://vuldb.com/?id.325178; https://vuldb.com/?submit.653742
CVE: CVE-2025-43810
Published: 2025-09-22
Description: Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to add a note to an order in a different virtual instance via the _com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43810
CVE: CVE-2025-43814
Published: 2025-09-22
Description: In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user’s password reminder answer, which allows remote authenticated users to obtain a user’s password reminder answer via the audit events.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43814
CVE: CVE-2025-10822
Published: 2025-09-23
Description: A vulnerability has been found in fuyang_lipengjun platform 1.0. The impacted element is the function SysSmsLogController of the file /sys/smslog/queryAll. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.325179; https://vuldb.com/?id.325179; https://vuldb.com/?submit.653743
CVE: CVE-2025-10823
Published: 2025-09-23
Description: A vulnerability was found in axboe fio up to 3.41. This affects the function str_buffer_pattern_cb of the file options.c. Performing manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://github.com/axboe/fio/issues/1982; https://github.com/user-attachments/files/22266964/poc.zip; https://vuldb.com/?ctiid.325180
CVE: CVE-2025-10824
Published: 2025-09-23
Description: A vulnerability was determined in axboe fio up to 3.41. This impacts the function __parse_jobs_ini of the file init.c. Executing manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-416
References: https://github.com/axboe/fio/issues/1981; https://github.com/user-attachments/files/22266756/poc.zip; https://vuldb.com/?ctiid.325181
CVE: CVE-2025-10825
Published: 2025-09-23
Description: A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. Affected is an unknown function of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/fubxx/CVE/blob/main/Online%20Beauty%20Parlor%20Management%20System%20SQL%20Injection%20on%20view-appointment.php.md; https://vuldb.com/?ctiid.325182; https://vuldb.com/?id.325182
CVE: CVE-2025-10826
Published: 2025-09-23
Description: A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/fubxx/CVE/blob/main/Online%20Beauty%20Parlor%20Management%20System%20SQL%20Injection%20on%20sales-reports-detail.php.md; https://vuldb.com/?ctiid.325183; https://vuldb.com/?id.325183
CVE: CVE-2025-10827
Published: 2025-09-23
Description: A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/485961590/CVE/issues/1; https://vuldb.com/?ctiid.325184; https://vuldb.com/?id.325184
CVE: CVE-2025-10828
Published: 2025-09-23
Description: A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/para-paradise/webray.com.cn/blob/main/Pet%20Grooming%20Management/SourceCodester%20Pet%20Grooming%20Management%20Software%20edit.php%20sql%20injection%20Vulnerability.md; https://vuldb.com/?ctiid.325185; https://vuldb.com/?id.325185
CVE: CVE-2025-10829
Published: 2025-09-23
Description: A vulnerability was detected in Campcodes Computer Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/sup_edit1.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Michsta/CVE/issues/1; https://vuldb.com/?ctiid.325186; https://vuldb.com/?id.325186
CVE: CVE-2025-10830
Published: 2025-09-23
Description: A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/inv_edit1.php. Executing manipulation of the argument idd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Michsta/CVE/issues/2; https://vuldb.com/?ctiid.325187; https://vuldb.com/?id.325187
CVE: CVE-2025-10831
Published: 2025-09-23
Description: A vulnerability has been found in Campcodes Computer Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. The manipulation of the argument prodcode leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Michsta/CVE/issues/3; https://vuldb.com/?ctiid.325188; https://vuldb.com/?id.325188
CVE: CVE-2025-10832
Published: 2025-09-23
Description: A vulnerability was found in SourceCodester Pet Grooming Management Software 1.0. The affected element is an unknown function of the file /admin/fetch_product_details.php. The manipulation of the argument barcode results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/lalalalalalala555/Pet-grooming-management-v1.0-sql-injection/blob/main/report.md; https://vuldb.com/?ctiid.325189; https://vuldb.com/?id.325189
CVE: CVE-2025-42907
Published: 2025-09-23
Description: SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://me.sap.com/notes/3540622; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-58915
Published: 2025-09-23
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/request-a-quote/vulnerability/wordpress-request-a-quote-plugin-2-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-9494
Published: 2025-09-23
Description: An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.
CWE: CWE-78
References: https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2025-9495
Published: 2025-09-23
Description: The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.
CWE: CWE-602
References: https://https://www.corporate.carrier.com/product-security/advisories-resources/
CVE: CVE-2025-10833
Published: 2025-09-23
Description: A vulnerability was determined in 1000projects Bookstore Management System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument unm causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/xingrenlvke/cve/issues/1; https://vuldb.com/?ctiid.325190; https://vuldb.com/?id.325190
CVE: CVE-2025-10834
Published: 2025-09-23
Description: A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. This affects an unknown function of the file /jobportal/admin/login.php. Such manipulation of the argument user_email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/yihaofuweng/cve/issues/30; https://itsourcecode.com/; https://vuldb.com/?ctiid.325191
CVE: CVE-2025-10380
Published: 2025-09-23
Description: The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Model panel. This makes it possible for authenticated attackers, with author-level access or higher, to execute arbitrary PHP code and commands on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1336
References: https://plugins.trac.wordpress.org/browser/acf-views/tags/3.7.19/src/Template_Engines/Twig.php#L106; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364566%40acf-views&new=3364566%40acf-views&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/52b04517-f0be-4bbf-818c-70a12d76bfec?source=cve
CVE: CVE-2025-10835
Published: 2025-09-23
Description: A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/view_payorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/xiaoliyu-1/Pet-grooming-management-view_payorder.php-v.1.0-sql-injection/blob/main/report.md; https://vuldb.com/?ctiid.325192; https://vuldb.com/?id.325192
CVE: CVE-2025-10836
Published: 2025-09-23
Description: A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/print1.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/xiaoliyu-1/Pet-grooming-management-print1.php-v.1.0-sql-injection/blob/main/report.md; https://vuldb.com/?ctiid.325193; https://vuldb.com/?id.325193
CVE: CVE-2025-10837
Published: 2025-09-23
Description: A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/asd1238525/cve/blob/main/xss3.md; https://vuldb.com/?ctiid.325194
CVE: CVE-2025-8902
Published: 2025-09-23
Description: The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://widget-options.com/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/98f8a524-b0b8-4e11-b789-bed3bd257a10?source=cve
CVE: CVE-2025-10838
Published: 2025-09-23
Description: A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function sub_45BB10 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC21/Tenda%20AC21%20Buffer%20overflow.md; https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC21/Tenda%20AC21%20Buffer%20overflow.md#poc; https://vuldb.com/?ctiid.325200
CVE: CVE-2025-10839
Published: 2025-09-23
Description: A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/para-paradise/webray.com.cn/blob/main/Pet%20Grooming%20Management/SourceCodester%20Pet%20Grooming%20Management%20Software%20inv-print.php%20sql%20injection%20Vulnerability.md; https://vuldb.com/?ctiid.325201; https://vuldb.com/?id.325201
CVE: CVE-2025-10840
Published: 2025-09-23
Description: A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/xiaoliyu-1/Pet-grooming-management-print-payment.php-v.1.0-Unauthorized-sql-injection/blob/main/report.md; https://vuldb.com/?ctiid.325202; https://vuldb.com/?id.325202
CVE: CVE-2025-1131
Published: 2025-09-23
Description: A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions.


Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp; https://lists.debian.org/debian-lts-announce/2025/10/msg00006.html
CVE: CVE-2025-26399
Published: 2025-09-23
Description: SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
CVE: CVE-2025-9321
Published: 2025-09-23
Description: The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/wpcasa/trunk/includes/class-wpsight-api.php#L48; https://plugins.trac.wordpress.org/changeset/3365172/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c1001b2b-395a-44ee-827e-6e57f7a50218?source=cve
CVE: CVE-2025-10841
Published: 2025-09-23
Description: A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/fengzipan/cve/blob/master/tmp30/tmp30/report.md; https://vuldb.com/?ctiid.325203