deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-57178
Published: 2025-02-10
Description: An SQL injection vulnerability exists in Stock-Forecaster <=01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio() endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software behavior.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/nihal223/Stock-Forecaster; https://github.com/waristea/cve-research/tree/main/CVE-2024-57178
CVE: CVE-2025-1154
Published: 2025-02-10
Description: A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gist.github.com/GSBP0/9d26bf092647018e39eb515fb6c1eb0a; https://vuldb.com/?ctiid.295058; https://vuldb.com/?id.295058
CVE: CVE-2025-1155
Published: 2025-02-10
Description: A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your Location Search. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. It is planned to remove this page in the long term.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/mano257200/Qloapp-XSS-Vulnerability/tree/main; https://vuldb.com/?ctiid.295059; https://vuldb.com/?id.295059
CVE: CVE-2025-24016
Published: 2025-02-10
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-502
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016
CVE: CVE-2025-1002
Published: 2025-02-10
Description: MicroDicom DICOM Viewer version 2024.03

fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle (MITM) attack. This allows the attackers to modify the server's response and deliver a malicious update to the user.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-295
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-037-01
CVE: CVE-2025-1156
Published: 2025-02-10
Description: A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login. The manipulation of the argument usuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.295060; https://vuldb.com/?id.295060; https://vuldb.com/?submit.493482
CVE: CVE-2025-1157
Published: 2025-02-10
Description: A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_recuperar_senha.php. The manipulation of the argument recuperacao leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.295061; https://vuldb.com/?id.295061; https://vuldb.com/?submit.493492
CVE: CVE-2025-1158
Published: 2025-02-10
Description: A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the file addPolicyToSafetyGroup.jsp. The manipulation of the argument safetyGroupId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Rain1er/report/blob/main/CDG/addPolicyToSafetyGroup.md; https://vuldb.com/?ctiid.295062; https://vuldb.com/?id.295062
CVE: CVE-2025-1159
Published: 2025-02-10
Description: A vulnerability was found in CampCodes School Management Software 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academic-calendar. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/KhukuriRimal/Vulnerabilities/blob/main/Stored%20Cross%20Site%20Scripting-%20Teachers%20Account%20Takeover%20Possibility.pdf; https://vuldb.com/?ctiid.295063; https://vuldb.com/?id.295063
CVE: CVE-2025-24970
Published: 2025-02-10
Description: Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4; https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-25189
Published: 2025-02-10
Description: The ZOO-Project is an open source processing platform. A reflected Cross-Site Scripting vulnerability exists in the ZOO-Project Web Processing Service (WPS) publish.py CGI script prior to commit 7a5ae1a. The script reflects user input from the `jobid` parameter in its HTTP response without proper HTML encoding or sanitization. When a victim visits a specially crafted URL pointing to this endpoint, arbitrary JavaScript code can be executed in their browser context. The vulnerability occurs because the CGI script directly outputs the query string parameters into the HTML response without escaping HTML special characters. An attacker can inject malicious JavaScript code through the `jobid` parameter which will be executed when rendered by the victim's browser. Commit 7a5ae1a contains a fix for the issue.
CWE: CWE-79
References: https://github.com/ZOO-Project/ZOO-Project/commit/7a5ae1a10faa2f9877d18ec72550dc23e8ce1aac; https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-pw7m-p9q7-357p; https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-pw7m-p9q7-357p
CVE: CVE-2025-25190
Published: 2025-02-10
Description: The ZOO-Project is an open source processing platform. The ZOO-Project Web Processing Service (WPS) Server contains a Cross-Site Scripting (XSS) vulnerability in its EchoProcess service prior to commit 7a5ae1a. The vulnerability exists because the EchoProcess service directly reflects user input in its output without proper sanitization when handling complex inputs.The service accepts various input formats including XML, JSON, and SVG, and returns the content based on the requested MIME type. When processing SVG content and returning it with the image/svg+xml MIME type, the server fails to sanitize potentially malicious JavaScript in attributes like onload, allowing arbitrary JavaScript execution in the victim's browser context. This vulnerability is particularly dangerous because it exists in a service specifically designed to echo back user input, and the lack of proper sanitization in combination with SVG handling creates a reliable XSS vector. Commit 7a5ae1a contains a fix for the issue.
CWE: CWE-79
References: https://github.com/ZOO-Project/ZOO-Project/commit/7a5ae1a10faa2f9877d18ec72550dc23e8ce1aac; https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-2569-6r9f-j7jv; https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-2569-6r9f-j7jv
CVE: CVE-2025-25193
Published: 2025-02-10
Description: Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386; https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-1160
Published: 2025-02-10
Description: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1392
References: https://gist.github.com/jmx0hxq/0e9cde14b6e9190a7451cd72d7b23bfd; https://vuldb.com/?ctiid.295064; https://vuldb.com/?id.295064
CVE: CVE-2025-1162
Published: 2025-02-10
Description: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/J0hnFFFF/j0hn_upload_two/blob/main/web1.pdf; https://vuldb.com/?ctiid.295065
CVE: CVE-2025-25194
Published: 2025-02-10
Description: Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. This vulnerability, which is present in versions 0.6.2 and prior of activitypub_federation and versions 0.19.8 and prior of Lemmy, allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request. As of time of publication, a fix has not been made available.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-918
References: https://github.com/LemmyNet/lemmy/security/advisories/GHSA-7723-35v7-qcxw
CVE: CVE-2025-1163
Published: 2025-02-11
Description: A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerability affects the function login of the component Authentication. The manipulation of the argument username leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/J0hnFFFF/j0hn_upload_three/blob/main/binary1.pdf; https://vuldb.com/?ctiid.295066
CVE: CVE-2025-1164
Published: 2025-02-11
Description: A vulnerability, which was classified as problematic, has been found in code-projects Police FIR Record Management System 1.0. This issue affects some unknown processing of the component Add Record Handler. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/J0hnFFFF/j0hn_upload_four/blob/main/binary2.pdf; https://vuldb.com/?ctiid.295067
CVE: CVE-2024-11890
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-0054
Published: 2025-02-11
Description: SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3526203; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-0064
Published: 2025-02-11
Description: Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.
CVSS Score: 8.7 (HIGH)
CWE: CWE-732
References: https://me.sap.com/notes/3525794; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-1165
Published: 2025-02-11
Description: A vulnerability, which was classified as critical, was found in Lumsoft ERP 8. Affected is the function DoUpload/DoWebUpload of the file /Api/FileUploadApi.ashx. The manipulation of the argument file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434
References: https://github.com/Rain1er/report/blob/main/Lserp/fileUpload_1.md; https://vuldb.com/?ctiid.295068; https://vuldb.com/?id.295068
CVE: CVE-2025-23187
Published: 2025-02-11
Description: Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3546470; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-23189
Published: 2025-02-11
Description: Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3546470; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-23190
Published: 2025-02-11
Description: Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3547581; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-23191
Published: 2025-02-11
Description: Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the `atom:link` values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacker. Successful exploitation could cause low impact on integrity of the application.
CVSS Score: 3.1 (LOW)
CWE: CWE-644
References: https://me.sap.com/notes/3426825; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-23193
Published: 2025-02-11
Description: SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://me.sap.com/notes/3561264; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24867
Published: 2025-02-11
Description: SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3445708; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24868
Published: 2025-02-11
Description: The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601
References: https://me.sap.com/notes/3563929; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24869
Published: 2025-02-11
Description: SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://me.sap.com/notes/3550027; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24870
Published: 2025-02-11
Description: SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-921
References: https://me.sap.com/notes/3562336; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24872
Published: 2025-02-11
Description: The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact on the confidentiality of the application with no effect on the integrity and availability of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://me.sap.com/notes/3553753; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24874
Published: 2025-02-11
Description: SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1021
References: https://me.sap.com/notes/3559510; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24875
Published: 2025-02-11
Description: SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://me.sap.com/notes/3555364; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-24876
Published: 2025-02-11
Description: The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
CVSS Score: 8.1 (HIGH)
CWE: CWE-302, CWE-1287
References: https://me.sap.com/notes/3567974; https://url.sap/sapsecuritypatchday; https://www.npmjs.com/package/@sap/approuter?activeTab=versions
CVE: CVE-2025-25241
Published: 2025-02-11
Description: Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3532025; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-25243
Published: 2025-02-11
Description: SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://me.sap.com/notes/3567551; https://url.sap/sapsecuritypatchday
CVE: CVE-2022-2283
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-1171
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-1266
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2238
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-2965
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-3185
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-3402
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-3437
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-3448
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-3483
Published: 2025-02-11
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.