deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2474
Published: 2025-06-10
Description: Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.blackberry.com/pkb/s/article/140646
CVE: CVE-2025-2884
Published: 2025-06-10
Description: TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1; https://trustedcomputinggroup.org/about/security/; https://trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdf
CVE: CVE-2025-36574
Published: 2025-06-10
Description: Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access.
CVSS Score: 8.2 (HIGH)
CWE: CWE-36
References: https://www.dell.com/support/kbdoc/en-us/000325679/dsa-2025-226
CVE: CVE-2025-36575
Published: 2025-06-10
Description: Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-202
References: https://www.dell.com/support/kbdoc/en-us/000325679/dsa-2025-226
CVE: CVE-2025-36576
Published: 2025-06-10
Description: Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery (CSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
CVSS Score: 2.7 (LOW)
CWE: CWE-352
References: https://www.dell.com/support/kbdoc/en-us/000325679/dsa-2025-226
CVE: CVE-2025-36577
Published: 2025-06-10
Description: Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000325679/dsa-2025-226
CVE: CVE-2025-36578
Published: 2025-06-10
Description: Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863
References: https://www.dell.com/support/kbdoc/en-us/000325679/dsa-2025-226
CVE: CVE-2025-36580
Published: 2025-06-10
Description: Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000325679/dsa-2025-226
CVE: CVE-2025-43581
Published: 2025-06-10
Description: Substance3D - Sampler versions 5.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-55.html
CVE: CVE-2025-43588
Published: 2025-06-10
Description: Substance3D - Sampler versions 5.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb25-55.html
CVE: CVE-2025-5943
Published: 2025-06-10
Description: MicroDicom 

DICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-160-01
CVE: CVE-2025-5971
Published: 2025-06-10
Description: A vulnerability was found in code-projects School Fees Payment System 1.0. It has been classified as critical. This affects an unknown part of the file /ajx.php. The manipulation of the argument name_startsWith leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/qingchuana/q1ngchuan/issues/6; https://vuldb.com/?ctiid.311847
CVE: CVE-2025-30327
Published: 2025-06-10
Description: InCopy versions 20.2, 19.5.3 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://helpx.adobe.com/security/products/incopy/apsb25-41.html
CVE: CVE-2025-43550
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-43573
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-43574
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-43575
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-43576
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2170
CVE: CVE-2025-43577
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-43578
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2159
CVE: CVE-2025-43579
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an Information Exposure vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to gain unauthorized access to sensitive information. Exploitation of this issue does not require user interaction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-47107
Published: 2025-06-10
Description: InCopy versions 20.2, 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/incopy/apsb25-41.html
CVE: CVE-2025-47111
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-47112
Published: 2025-06-10
Description: Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb25-57.html
CVE: CVE-2025-5972
Published: 2025-06-10
Description: A vulnerability classified as problematic has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/manage-subadmins.php. The manipulation of the argument fullname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/kakalalaww/CVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.311850
CVE: CVE-2025-5973
Published: 2025-06-10
Description: A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-table.php. The manipulation of the argument tableno leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/kakalalaww/CVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.311851
CVE: CVE-2024-41502
Published: 2025-06-10
Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) section when creating or editing either a legal or a natural person.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jetimob.com; https://github.com/rafaelbaldasso/CVE-2024-41502; https://github.com/rafaelbaldasso/CVE-2024-41502
CVE: CVE-2024-41503
Published: 2025-06-10
Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca" (search) function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jetimob.com; https://github.com/rafaelbaldasso/CVE-2024-41503; https://github.com/rafaelbaldasso/CVE-2024-41503
CVE: CVE-2024-41504
Published: 2025-06-10
Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS). In the "Oportunidades" (opportunities) section of the application when creating or editing an "Atividade" (activity), the form field "Descrico" allows injection of JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jetimob.com; https://github.com/rafaelbaldasso/CVE-2024-41504; https://github.com/rafaelbaldasso/CVE-2024-41504
CVE: CVE-2024-41505
Published: 2025-06-10
Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jetimob.com; https://github.com/rafaelbaldasso/CVE-2024-41505; https://github.com/rafaelbaldasso/CVE-2024-41505
CVE: CVE-2025-36852
Published: 2025-06-10
Description: A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject compromised artifacts from an untrusted environment into trusted production environments without detection. 




The vulnerability exploits a fundamental design flaw in the "first-to-cache wins" principle, where artifacts built in untrusted environments (feature branches, pull requests) can poison the cache used by trusted environments (protected branches, production deployments). 




This attack bypasses all traditional security measures including encryption, access controls, and checksum validation because the poisoning occurs during the artifact construction phase, before any security measures are applied.
CWE: CWE-829
References: https://nx.app/files/cve-2025-06
CVE: CVE-2025-3052
Published: 2025-06-10
Description: An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.
CVSS Score: 8.2 (HIGH)
References: https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html; https://www.binarly.io/advisories/brly-dva-2025-001; https://www.kb.cert.org/vuls/id/806555
CVE: CVE-2025-49133
Published: 2025-06-10
Description: Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the "Part 4: Supporting Routines – Code" document, section "7.151 - /tpm/src/crypt/CryptUtil.c ". This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1; https://github.com/stefanberger/libtpms/security/advisories/GHSA-25w5-6fjj-hf8g; https://trustedcomputinggroup.org/resource/tpm-library-specification
CVE: CVE-2025-5974
Published: 2025-06-10
Description: A vulnerability, which was classified as problematic, has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this issue is some unknown functionality of the file /check-status.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/kakalalaww/CVE/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.311852
CVE: CVE-2025-5975
Published: 2025-06-10
Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /rpms/download-pass.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/kakalalaww/CVE/issues/9; https://phpgurukul.com/; https://vuldb.com/?ctiid.311853
CVE: CVE-2025-5976
Published: 2025-06-10
Description: A vulnerability has been found in PHPGurukul Rail Pass Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/add-pass.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/kakalalaww/CVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.311854
CVE: CVE-2025-5977
Published: 2025-06-10
Description: A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. This issue affects some unknown processing of the file /datatable.php. The manipulation of the argument sSortDir_0 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/jiangffffd/cve/issues/1; https://vuldb.com/?ctiid.311855
CVE: CVE-2025-35940
Published: 2025-06-10
Description: The ArchiverSpaApi ASP.NET  application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to access protected ArchiverSpaApi URL endpoints.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://www.tenable.com/security/research/tra-2025-17; https://www.tenable.com/security/research/tra-2025-17
CVE: CVE-2025-5978
Published: 2025-06-10
Description: A vulnerability was found in Tenda FH1202 1.2.0.14. It has been classified as critical. Affected is the function fromVirtualSer of the file /goform/VirtualSer. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://lavender-bicycle-a5a.notion.site/Tenda-FH1202-fromVirtualSer-20b53a41781f80b7a6c7e727f93d7d9f?source=copy_link; https://vuldb.com/?ctiid.311856; https://vuldb.com/?id.311856
CVE: CVE-2025-5979
Published: 2025-06-10
Description: A vulnerability classified as critical has been found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /branch.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/jiangffffd/cve/issues/2; https://vuldb.com/?ctiid.311859
CVE: CVE-2025-5980
Published: 2025-06-10
Description: A vulnerability classified as critical was found in code-projects Restaurant Order System 1.0. This vulnerability affects unknown code of the file /order.php. The manipulation of the argument tabidNoti leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/jiangffffd/cve/issues/3; https://vuldb.com/?ctiid.311860
CVE: CVE-2025-22829
Published: 2025-06-10
Description: The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.

Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0; https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60; https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/