deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-59141
Published: 2025-09-15
Description: simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishing attack. Version 0.2.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.2.4.
CWE: CWE-506
References: https://github.com/Qix-/node-simple-swizzle/security/advisories/GHSA-9g9j-rggx-7fmg; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59142
Published: 2025-09-15
Description: color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. This issue has been resolved in 2.1.2.
CWE: CWE-506
References: https://github.com/Qix-/color-string/security/advisories/GHSA-286p-vc9p-p5qv; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59143
Published: 2025-09-15
Description: color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issues has been resolved in 5.0.2.
CWE: CWE-506
References: https://github.com/Qix-/color/security/advisories/GHSA-qrmh-qg46-72pp; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59144
Published: 2025-09-15
Description: debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3.
CWE: CWE-506
References: https://github.com/debug-js/debug/issues/1005; https://github.com/debug-js/debug/security/advisories/GHSA-4x49-vf9v-38px; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59154
Published: 2025-09-15
Description: Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls X509Certificate.getSubjectDN().getName() and applies a regex to look for CN=. This method produces a provider-dependent string that does not escape special characters. In SunJSSE (sun.security.x509.X500Name), for example, commas and equals signs inside attribute values are not escaped. As a result, a malicious certificate can embed CN= inside another attribute value (e.g. OU="CN=admin,"). The regex will incorrectly interpret this as a legitimate Common Name and extract admin. If SASL EXTERNAL is enabled and configured to map CNs to user accounts, this allows the attacker to impersonate another user. The fix is included in Openfire 5.0.2 and 5.1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-290
References: https://github.com/igniterealtime/Openfire/blob/8d073dda36905da0fdee7cb623c025a01a5cbf6b/xmppserver/src/main/java/org/jivesoftware/util/cert/CNCertificateIdentityMapping.java#L43; https://github.com/igniterealtime/Openfire/security/advisories/GHSA-w252-645g-87mp; https://igniterealtime.atlassian.net/browse/OF-3122
CVE: CVE-2025-59162
Published: 2025-09-15
Description: color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 3.1.2.
CWE: CWE-506
References: https://github.com/Qix-/color-convert/security/advisories/GHSA-pxx3-g568-hxr4; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59330
Published: 2025-09-15
Description: error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 1.3.4.
CWE: CWE-506
References: https://github.com/Qix-/node-error-ex/security/advisories/GHSA-6jp5-hh4c-8c5h; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59331
Published: 2025-09-15
Description: is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.3.4.
CWE: CWE-506
References: https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-59332
Published: 2025-09-15
Description: 3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that arbitrary JavaScript can be inserted and executed.
CVSS Score: 8.6 (HIGH)
CWE: CWE-79
References: https://github.com/dolfinus/3DAlloy/commit/9fac[PII_REDACTED]265ac89c8824c4816d009b7a1b; https://github.com/dolfinus/3DAlloy/security/advisories/GHSA-f2rp-232x-mqrh
CVE: CVE-2025-10477
Published: 2025-09-15
Description: A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an unknown function of the file /Profilers/PriProfile/eligibility.php. Such manipulation of the argument Branch leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Miker132/CVE-/issues/6; https://vuldb.com/?ctiid.323913; https://vuldb.com/?id.323913
CVE: CVE-2025-10479
Published: 2025-09-15
Description: A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is an unknown function of the file /index.php. Performing manipulation of the argument stud_no results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/25; https://vuldb.com/?ctiid.323914; https://vuldb.com/?id.323914
CVE: CVE-2025-43798
Published: 2025-09-15
Description: Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-304
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43798
CVE: CVE-2025-43799
Published: 2025-09-15
Description: Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1393
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43799
CVE: CVE-2025-55211
Published: 2025-09-15
Description: FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) can run arbitrary shell commands by maliciously changing languages of the framework module. This vulnerability is fixed in 17.0.21.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-xg83-m6q5-q24h
CVE: CVE-2025-59056
Published: 2025-09-15
Description: FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/FreePBX/framework/blame/release/17.0/amp_conf/htdocs/admin/ajax.php#L18; https://github.com/FreePBX/security-reporting/security/advisories/GHSA-frc2-jhgg-rwpr
CVE: CVE-2025-59145
Published: 2025-09-15
Description: color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 2.0.2.
CWE: CWE-506
References: https://github.com/colorjs/color-name/security/advisories/GHSA-5fvm-p68v-5wmh; https://github.com/debug-js/debug/issues/1005; https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack
CVE: CVE-2025-10480
Published: 2025-09-15
Description: A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown function of the file /save_file.php. Executing manipulation can lead to unrestricted upload. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ganzhi-qcy/cve/issues/26; https://vuldb.com/?ctiid.323915; https://vuldb.com/?id.323915
CVE: CVE-2025-10481
Published: 2025-09-15
Description: A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an unknown function of the file /remove_file.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/10; https://vuldb.com/?ctiid.323916; https://vuldb.com/?id.323916
CVE: CVE-2025-10482
Published: 2025-09-15
Description: A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/11; https://vuldb.com/?ctiid.323917; https://vuldb.com/?id.323917
CVE: CVE-2025-43797
Published: 2025-09-15
Description: In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site membership can potentially view, add or edit content on the site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1188
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43797
CVE: CVE-2025-43802
Published: 2025-09-15
Description: Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web script or HTML via the externalReferenceCode parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43802
CVE: CVE-2025-56274
Published: 2025-09-15
Description: SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows low-privileged users to forge high privileged (such as admin) sessions and perform sensitive operations such as adding new users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: http://sourcecodester.com; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56274.md; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-56274.md
CVE: CVE-2025-57117
Published: 2025-09-15
Description: A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the department.php page by injecting a malicious payload into the Department Name field under Add Department.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://employee.com; https://github.com/Jazeye/CVE/blob/main/CVE-2025-57117/README.md; https://www.sourcecodester.com/
CVE: CVE-2025-57118
Published: 2025-09-15
Description: An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/Jazeye/CVE/tree/main/CVE-2025-57118; https://github.com/danielmiessler/SecLists/blob/master/Usernames/Names/names.txt; https://github.com/Jazeye/CVE/tree/main/CVE-2025-57118
CVE: CVE-2025-6947
Published: 2025-09-15
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the SIP Proxy module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.

This issue affects Firebox: from 12.0 through 12.11.2.
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00012
CVE: CVE-2025-6999
Published: 2025-09-15
Description: An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack.This issue affects Fireware OS: from 12.0 through 12.11.2.
CWE: CWE-444
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00014