deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14739
Published: 2025-12-18
Description: Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack 

and potentially arbitrary code execution

under the context of the ‘root’ user.This issue affects WR940N and WR941ND: ≤ WR940N v5 3.20.1 Build 200316, 

≤

 WR941ND v6 3.16.9 Build 151203.
CWE: CWE-824
References: https://blog.exodusintel.com/2022/06/23/tp-link-wr940n-wr941nd-uninitialized-pointer-vulnerability/; https://www.tp-link.com/us/support/download/tl-wr940n/v5/#Firmware; https://www.tp-link.com/us/support/download/tl-wr941nd/#Firmware
CVE: CVE-2025-14885
Published: 2025-12-18
Description: A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://medium.com/@rvpipalwa/remote-code-execution-rce-vulnerability-report-4394b38ff90e; https://vuldb.com/?ctiid.337373; https://vuldb.com/?id.337373
CVE: CVE-2025-56157
Published: 2025-12-18
Description: Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://dify.com; https://gist.github.com/Cristliu/216ddbadaf3258498c93d408683ecabd; https://gist.github.com/Cristliu/298f51cbc72c45d91632cd0d65aa8161
CVE: CVE-2025-59949
Published: 2025-12-18
Description: FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/FreshRSS/FreshRSS/pull/7958; https://github.com/FreshRSS/FreshRSS/pull/7997; https://github.com/FreshRSS/FreshRSS/pull/7999
CVE: CVE-2025-63387
Published: 2025-12-18
Description: Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous access to sensitive system configuration data. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the description inaccurately classifies the returned data as sensitive system configuration, stating that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://gist.github.com/Cristliu/cddc0cbbf354de51106ab63a11be94af; https://gist.github.com/Cristliu/dfc5f3a31dc6d7fff2754867e5c649a5; https://github.com/langgenius/dify/discussions
CVE: CVE-2025-65559
Published: 2025-12-18
Description: An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in `lib/pfcp/context.c` (`ogs_pfcp_object_teid_hash_set`) if the CreatePDR?PDI?F-TEID has CH=1 and the F-TEID address-family flag(s) (IPv4/IPv6) do not match the GTP-U resource family configured for the selected DNN (Network Instance), resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/open5gs/open5gs/issues/4135; https://github.com/open5gs/open5gs/issues/4135
CVE: CVE-2025-65561
Published: 2025-12-18
Description: An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/free5gc/free5gc/issues/730; https://github.com/free5gc/go-upf/pull/80; https://github.com/free5gc/free5gc/issues/730
CVE: CVE-2025-65562
Published: 2025-12-18
Description: The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint64 SEID is converted to int and used in index arithmetic. This leads to a negative index into n.sess and a Go runtime panic, resulting in a denial of service (UPF crash). The issue has been reproduced on free5GC v4.1.0 with crashes observed in the session lookup/deletion path in internal/pfcp/node.go; other versions may also be affected. No authentication is required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://github.com/free5gc/free5gc/issues/731; https://github.com/free5gc/free5gc/issues/731
CVE: CVE-2025-65563
Published: 2025-12-18
Description: A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory NodeID Information Element, the association setup handler dereferences a nil pointer instead of validating the message, causing a panic and terminating the UPF process. An attacker who can send PFCP Association Setup Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/omec-project/upf/issues/955; https://github.com/omec-project/upf/pull/963; https://github.com/omec-project/upf/issues/955
CVE: CVE-2025-65564
Published: 2025-12-18
Description: A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory Recovery Time Stamp Information Element, the association setup handler dereferences a nil pointer via IE.RecoveryTimeStamp() instead of validating the message. This results in a panic and terminates the UPF process. An attacker who can send PFCP Association Setup Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/omec-project/upf/issues/956; https://github.com/omec-project/upf/pull/964; https://github.com/omec-project/upf/issues/956
CVE: CVE-2025-65565
Published: 2025-12-18
Description: A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association is established, a PFCP Session Establishment Request that is missing the mandatory F-SEID (CPF-SEID) Information Element is not properly validated. The session establishment handler calls IE.FSEID() on a nil pointer, which triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/omec-project/upf/issues/957; https://github.com/omec-project/upf/issues/957
CVE: CVE-2025-65567
Published: 2025-12-18
Description: A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a specially crafted PFCP Session Establishment Request with a CreatePDR that contains a malformed Flow-Description is not robustly validated. The Flow-Description parser (parseFlowDesc) can read beyond the bounds of the provided buffer, causing a panic and terminating the UPF process. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/omec-project/upf/issues/959; https://github.com/omec-project/upf/issues/959
CVE: CVE-2025-65568
Published: 2025-12-18
Description: A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address field is not properly validated. During parsing, parseFAR() calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer and triggers an index-out-of-range panic. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://omec-projectupf.com; http://upf-epc-pfcpiface.com; https://github.com/omec-project/upf/issues/962
CVE: CVE-2025-67745
Published: 2025-12-18
Description: MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null.
CVSS Score: 7.1 (HIGH)
CWE: CWE-402
References: https://github.com/Aiven-Open/myhoard/commit/fac89793bfc8c81ae040aadf5292f5d0100b6640; https://github.com/Aiven-Open/myhoard/security/advisories/GHSA-v42r-6hr9-4hcr
CVE: CVE-2019-25228
Published: 2025-12-18
Description: An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-virtual-context-information-disclosure
CVE: CVE-2019-25229
Published: 2025-12-18
Description: An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling unauthorized file uploads.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-mvc-forms-unrestricted-file-upload
CVE: CVE-2019-25230
Published: 2025-12-18
Description: An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget properties dialog. Attackers can exploit this vulnerability to access unauthorized system information without proper access controls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-user-widget-information-disclosure
CVE: CVE-2020-36889
Published: 2025-12-18
Description: A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in users' browsers when administrators view error messages in the administration interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-administration-interface-stored-xss
CVE: CVE-2020-36890
Published: 2025-12-18
Description: An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-administrator-access-control-bypass
CVE: CVE-2020-36891
Published: 2025-12-18
Description: A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss
CVE: CVE-2021-47711
Published: 2025-12-18
Description: A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. This enables unauthorized database access and potential data manipulation by exploiting macro method input validation weaknesses.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-online-marketing-macros-sql-injection
CVE: CVE-2021-47712
Published: 2025-12-18
Description: A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The hotfix introduces an additional security layer to prevent hash value reuse and potential exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-url-hashing-cryptography-vulnerability
CVE: CVE-2022-50680
Published: 2025-12-18
Description: A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attackers can exploit this vulnerability to execute malicious scripts that could compromise user browsers and steal sensitive information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-email-marketing-stored-xss
CVE: CVE-2022-50681
Published: 2025-12-18
Description: A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich text editor component. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-rich-text-editor-reflected-xss
CVE: CVE-2022-50682
Published: 2025-12-18
Description: A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query string redirects via improper encoding in the routing engine. This could enable header injection and potentially facilitate further web application attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-93
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-routing-engine-crlf-injection
CVE: CVE-2022-50683
Published: 2025-12-18
Description: A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form redirect URL configuration. This allows malicious scripts to execute in users' browsers through unvalidated form configuration settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-form-configuration-stored-xss
CVE: CVE-2022-50684
Published: 2025-12-18
Description: An HTML injection vulnerability in Kentico Xperience allows attackers to inject malicious HTML values into form submission emails via unencoded form fields. Unencoded form values could enable HTML content execution in recipient email clients, potentially compromising email security.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-form-emails-html-injection
CVE: CVE-2022-50685
Published: 2025-12-18
Description: A stored cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via XML file uploads as page attachments or metafiles. Attackers can upload malicious XML files that enable stored XSS, allowing malicious scripts to execute in users' browsers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-file-upload-stored-xss2
CVE: CVE-2022-50686
Published: 2025-12-18
Description: An information disclosure vulnerability in Kentico Xperience allows attackers to view sensitive stack trace details via Portal Engine form control error messages. Detailed error messages can expose internal system information and potentially reveal implementation details to unauthorized users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-portal-engine-form-control-information-disclosure
CVE: CVE-2023-53736
Published: 2025-12-18
Description: A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-administration-interface-reflected-xss
CVE: CVE-2023-53737
Published: 2025-12-18
Description: A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localization application. Attackers can execute scripts that could affect multiple parts of the administration interface.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-localization-application-stored-xss2
CVE: CVE-2023-53738
Published: 2025-12-18
Description: A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers during page preview interactions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-page-preview-reflected-xss
CVE: CVE-2023-53934
Published: 2025-12-18
Description: A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler. Improper input validation enables remote attackers to potentially disrupt service availability through maliciously constructed requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-97
References: https://devnet.kentico.com/download/hotfixes; https://www.vulncheck.com/advisories/kentico-xperience-getresource-handler-denial-of-service
CVE: CVE-2023-53935
Published: 2025-12-18
Description: WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attackers can inject crafted SQL statements using UNION-based techniques to extract sensitive database information by sending malformed requests to the ticket endpoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://www.codester.com/items/5641/wbiz-desk-simple-and-effective-help-desk-system; https://www.exploit-db.com/exploits/51451; https://www.vulncheck.com/advisories/wbiz-desk-sql-injection-vulnerability-via-ticketphp-parameter
CVE: CVE-2023-53936
Published: 2025-12-18
Description: Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing session cookies and executing arbitrary JavaScript.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/owen2345/camaleon-cms; https://www.exploit-db.com/exploits/51446; https://www.vulncheck.com/advisories/cameleon-cms-authenticated-persistent-cross-site-scripting-via-post-creation
CVE: CVE-2023-53937
Published: 2025-12-18
Description: Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application startup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://hubstaff.com/; https://www.exploit-db.com/exploits/51461; https://www.vulncheck.com/advisories/hubstaff-dll-search-order-hijacking-via-wowlog-library
CVE: CVE-2023-53938
Published: 2025-12-18
Description: RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unencoded input parameters. Attackers can exploit the vulnerability by submitting crafted payloads in database, collection, and login parameters to execute arbitrary JavaScript in victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/iwind/rockmongo/; https://www.exploit-db.com/exploits/51437; https://www.vulncheck.com/advisories/rockmongo-stored-cross-site-scripting-vulnerability-via-multiple-parameters
CVE: CVE-2023-53939
Published: 2025-12-18
Description: TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallery pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.tinywebgallery.com/; https://www.exploit-db.com/exploits/51442; https://www.vulncheck.com/advisories/tinywebgallery-stored-cross-site-scripting-via-folder-name-parameter
CVE: CVE-2023-53940
Published: 2025-12-18
Description: Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown file. Attackers can embed a video source with an onerror event that executes shell commands through Node.js child_process module when the file is opened.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://github.com/alfonzm/codigo-app; https://www.exploit-db.com/exploits/51432; https://www.vulncheck.com/advisories/codigo-markdown-editor-electron-arbitrary-code-execution-via-markdown-file
CVE: CVE-2023-53941
Published: 2025-12-18
Description: EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting malicious payloads through the app_service_control parameter. Attackers can send POST requests to /index.php?zone=settings with crafted app_service_control values to execute commands with administrative privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.easyphp.org/; https://www.exploit-db.com/exploits/51430; https://www.vulncheck.com/advisories/easyphp-webserver-remote-code-execution