deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-50755
Published: 2025-09-02
Description: Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WN535K3/set_sys_cmd/readme.md
CVE: CVE-2025-50757
Published: 2025-09-02
Description: Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/Summermu/VulnForIoT/tree/main/Wavlink_WN535K3/set_sys_adm_username/readme.md
CVE: CVE-2024-51423
Published: 2025-09-02
Description: Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.offsecguy.com/cve/infor/vulnerability/reflected-xss
CVE: CVE-2025-54599
Published: 2025-09-02
Description: The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://bevy.com/b/events-and-groups; https://gist.github.com/deep1chil/558e8da919690a634bec684e7c4d0ffe; https://www.youtube.com/watch?v=wbmIvA09Ra8
CVE: CVE-2025-55372
Published: 2025-09-02
Description: An arbitrary file upload vulnerability in Beakon Application before v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://packetstorm.news/files/id/208951/
CVE: CVE-2025-57611
Published: 2025-09-02
Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the dump() method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check the return value of avfilter_graph_dump() for NULL, leading to a crash if the underlying memory allocation fails.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://github.com/meh/rust-ffmpeg/issues/192
CVE: CVE-2025-57612
Published: 2025-09-02
Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Null pointer dereference vulnerability in the name() method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check for a NULL return value from the av_get_sample_fmt_name() C function, which can be triggered by providing an unrecognized sample format.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/meh/rust-ffmpeg/issues/192
CVE: CVE-2025-57613
Published: 2025-09-02
Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A null pointer dereference vulnerability in the input() constructor function allows an attacker to cause a denial of service. The vulnerability is triggered when the avio_alloc_context() call fails and returns NULL, which is then stored and later dereferenced by the Io struct's Drop implementation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/meh/rust-ffmpeg/issues/192
CVE: CVE-2025-57614
Published: 2025-09-02
Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) Integer overflow and invalid input vulnerability in the cached method allows an attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability occurs when dimension parameters are zero or exceed i32::MAX, leading to an unchecked cast that violates the underlying C function's preconditions and triggers undefined behavior.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/meh/rust-ffmpeg/issues/192
CVE: CVE-2025-57615
Published: 2025-09-02
Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) An integer overflow vulnerability in the Vector::new constructor function allows an attacker to cause a denial of service via a null pointer dereference. The vulnerability stems from an unchecked cast of a usize parameter to c_int, which can result in a negative value being passed to the underlying C function sws_allocVec().
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/meh/rust-ffmpeg/issues/192
CVE: CVE-2025-57616
Published: 2025-09-02
Description: An issue was discovered in rust-ffmpeg 0.3.0 (after comit 5ac0527) A use-after-free vulnerability in the write_interleaved method allows an attacker to cause a denial of service or memory corruption. The method violates Rust's aliasing rules by modifying a data structure through a mutable pointer while only holding an immutable reference, which can lead to undefined behavior when the data is accessed later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/meh/rust-ffmpeg/issues/192
CVE: CVE-2025-55373
Published: 2025-09-02
Description: Incorrect access control in Beakon Application before v5.4.3 allows authenticated attackers with low-level privileges to escalate privileges and execute commands with Administrator rights.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: http://beakon.com; https://beakon.com.au; https://packetstorm.news/files/id/208952/
CVE: CVE-2025-55472
Published: 2025-09-02
Description: SQL Injection vulnerability exists in Tirreno v0.9.5, specifically in the /admin/loadUsers API endpoint. The vulnerability arises due to unsafe handling of user-supplied input in the columns[0][data] parameter, which is directly used in SQL queries without proper validation or parameterization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://cyberducky.medium.com/blind-sql-injection-found-in-tirreno-security-analytics-cbd791cec1c0; https://github.com/tirrenotechnologies/tirreno; https://github.com/tirrenotechnologies/tirreno/releases/tag/v0.9.6
CVE: CVE-2025-55473
Published: 2025-09-02
Description: Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in the /ip.php endpoint, which processes and displays the X-Forwarded-For HTTP header without proper sanitization or output encoding. This allows an attacker to inject malicious JavaScript code that will execute in visitor browsers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cyber-ducky.com/xss-found-in-asian-arts-talent-foundation-2/; https://github.com/AATF/aatf.us; https://hub.docker.com/r/aatf/aatf.us
CVE: CVE-2025-55474
Published: 2025-09-02
Description: Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cyber-ducky.com/stored-xss-found-in-many-notes-the-best-note-taking-app/; https://github.com/brufdev/many-notes/releases/tag/v0.10.2; https://medium.com/@cyberducky/how-i-found-a-stored-xss-in-markdown-rendering-e73cfc3cd93a
CVE: CVE-2025-9696
Published: 2025-09-02
Description: The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform actions such as firmware replacement, disabling power production, modifying grid settings, creating SSH tunnels, altering firewall settings, and manipulating connected devices.
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-245-03
CVE: CVE-2025-9828
Published: 2025-09-02
Description: A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-327
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Tenda/CP6.md; https://vuldb.com/?ctiid.322175; https://vuldb.com/?id.322175
CVE: CVE-2025-32098
Published: 2025-09-02
Description: An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file delete operations during the update process.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-32098/
CVE: CVE-2025-32100
Published: 2025-09-02
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. A programming mistake for buffer copy leads to out-of-bounds writes via malformed ROHC packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-32100/
CVE: CVE-2025-50565
Published: 2025-09-02
Description: Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/OoO7ce/CVE-2025-50565
CVE: CVE-2025-51966
Published: 2025-09-02
Description: A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, embedded JavaScript code executes within the application's privileged context, potentially allowing attackers to steal sensitive data or perform unauthorized actions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://t1sts.github.io/2025/05/27/uTools-has-an-XSS-vulnerability/; https://t1sts.github.io/2025/09/01/CVE-2025-51966/
CVE: CVE-2025-55476
Published: 2025-09-02
Description: FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This parameter is unsafely evaluated in a SQL ORDER BY clause without proper sanitization, allowing an attacker to inject arbitrary SQL subqueries.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://cyber-ducky.com/blind-sql-injection-in-fireshare-found-in-an-api-sort-parameter/; https://github.com/ShaneIsrael/fireshare/issues/311; https://github.com/ShaneIsrael/fireshare/releases/tag/v1.2.26
CVE: CVE-2025-55824
Published: 2025-09-02
Description: ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands to obtain sensitive data on the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/CTRLCCT/8f314998f30a95262e512b5417151ea1
CVE: CVE-2025-36162
Published: 2025-09-02
Description: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7243830
CVE: CVE-2025-43726
Published: 2025-09-02
Description: Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000361664/dsa-2025-336
CVE: CVE-2025-57774
Published: 2025-09-02
Description: There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-57775
Published: 2025-09-02
Description: There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-57776
Published: 2025-09-02
Description: There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-57777
Published: 2025-09-02
Description: There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-57778
Published: 2025-09-02
Description: There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-9188
Published: 2025-09-02
Description: There is a deserialization of untrusted data vulnerability in Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-9189
Published: 2025-09-02
Description: There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DASYLab.  This vulnerability may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted DSB file.  The vulnerability affects all versions of DASYLab.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1285, CWE-787
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE: CVE-2025-9829
Published: 2025-09-02
Description: A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The manipulation of the argument mobilenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dad-zm/myCVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.322176
CVE: CVE-2025-6685
Published: 2025-09-02
Description: ATEN eco DC Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of ATEN eco DC. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based interface. The issue results from the lack of validating the assigned user role when handling requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26647.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.aten.com/global/en/supportcenter/info/security-advisory/25/; https://www.zerodayinitiative.com/advisories/ZDI-25-650/
CVE: CVE-2025-7974
Published: 2025-09-02
Description: rocket.chat Incorrect Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of rocket.chat. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 3000 by default. The issue results from incorrect authorization. An attacker can leverage this vulnerability to disclose information in the context of the application. Was ZDI-CAN-26517.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.zerodayinitiative.com/advisories/ZDI-25-627/
CVE: CVE-2025-7975
Published: 2025-09-02
Description: Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-26913.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-25-647/
CVE: CVE-2025-7976
Published: 2025-09-02
Description: Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26882.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-25-648/
CVE: CVE-2025-8298
Published: 2025-09-02
Description: Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the N6CQueryInformationHandleCustomized11nOids function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-25864.
CVSS Score: 3.8 (LOW)
CWE: CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-25-881/
CVE: CVE-2025-8299
Published: 2025-09-02
Description: Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the MgntActSet_TEREDO_SET_RS_PACKET function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25857.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-882/
CVE: CVE-2025-8300
Published: 2025-09-02
Description: Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26552.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-883/
CVE: CVE-2025-8301
Published: 2025-09-02
Description: Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-24786.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-880/