deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53762
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync

Use-after-free can occur in hci_disconnect_all_sync if a connection is
deleted by concurrent processing of a controller event.

To prevent this the code now tries to iterate over the list backwards
to ensure the links are cleanup before its parents, also it no longer
relies on a cursor, instead it always uses the last element since
hci_abort_conn_sync is guaranteed to call hci_conn_del.

UAF crash log:
==================================================================
BUG: KASAN: slab-use-after-free in hci_set_powered_sync
(net/bluetooth/hci_sync.c:5424) [bluetooth]
Read of size 8 at addr ffff888009d9c000 by task kworker/u9:0/124

CPU: 0 PID: 124 Comm: kworker/u9:0 Tainted: G        W
6.5.0-rc1+ #10
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.2-1.fc38 04/01/2014
Workqueue: hci0 hci_cmd_sync_work [bluetooth]
Call Trace:
 <TASK>
 dump_stack_lvl+0x5b/0x90
 print_report+0xcf/0x670
 ? __virt_addr_valid+0xdd/0x160
 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth]
 kasan_report+0xa6/0xe0
 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth]
 ? __pfx_set_powered_sync+0x10/0x10 [bluetooth]
 hci_set_powered_sync+0x2c9/0x4a0 [bluetooth]
 ? __pfx_hci_set_powered_sync+0x10/0x10 [bluetooth]
 ? __pfx_lock_release+0x10/0x10
 ? __pfx_set_powered_sync+0x10/0x10 [bluetooth]
 hci_cmd_sync_work+0x137/0x220 [bluetooth]
 process_one_work+0x526/0x9d0
 ? __pfx_process_one_work+0x10/0x10
 ? __pfx_do_raw_spin_lock+0x10/0x10
 ? mark_held_locks+0x1a/0x90
 worker_thread+0x92/0x630
 ? __pfx_worker_thread+0x10/0x10
 kthread+0x196/0x1e0
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 </TASK>

Allocated by task 1782:
 kasan_save_stack+0x33/0x60
 kasan_set_track+0x25/0x30
 __kasan_kmalloc+0x8f/0xa0
 hci_conn_add+0xa5/0xa80 [bluetooth]
 hci_bind_cis+0x881/0x9b0 [bluetooth]
 iso_connect_cis+0x121/0x520 [bluetooth]
 iso_sock_connect+0x3f6/0x790 [bluetooth]
 __sys_connect+0x109/0x130
 __x64_sys_connect+0x40/0x50
 do_syscall_64+0x60/0x90
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Freed by task 695:
 kasan_save_stack+0x33/0x60
 kasan_set_track+0x25/0x30
 kasan_save_free_info+0x2b/0x50
 __kasan_slab_free+0x10a/0x180
 __kmem_cache_free+0x14d/0x2e0
 device_release+0x5d/0xf0
 kobject_put+0xdf/0x270
 hci_disconn_complete_evt+0x274/0x3a0 [bluetooth]
 hci_event_packet+0x579/0x7e0 [bluetooth]
 hci_rx_work+0x287/0xaa0 [bluetooth]
 process_one_work+0x526/0x9d0
 worker_thread+0x92/0x630
 kthread+0x196/0x1e0
 ret_from_fork+0x2c/0x50
==================================================================
References: https://git.kernel.org/stable/c/94d9ba9f9888b748d4abd2aa1547af56ae85f772; https://git.kernel.org/stable/c/a30c074f0b5b7f909a15c978fbc96a29e2f94e42; https://git.kernel.org/stable/c/ba3ba53ce1f76fc372b8f918fece4f9b1e41acd4
CVE: CVE-2023-53763
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "f2fs: fix to do sanity check on extent cache correctly"

syzbot reports a f2fs bug as below:

UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19
index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]')
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 ubsan_epilogue lib/ubsan.c:217 [inline]
 __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
 inline_data_addr fs/f2fs/f2fs.h:3275 [inline]
 __recover_inline_status fs/f2fs/inode.c:113 [inline]
 do_read_inode fs/f2fs/inode.c:480 [inline]
 f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604
 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601
 mount_bdev+0x276/0x3b0 fs/super.c:1391
 legacy_get_tree+0xef/0x190 fs/fs_context.c:611
 vfs_get_tree+0x8c/0x270 fs/super.c:1519
 do_new_mount+0x28f/0xae0 fs/namespace.c:3335
 do_mount fs/namespace.c:3675 [inline]
 __do_sys_mount fs/namespace.c:3884 [inline]
 __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The issue was bisected to:

commit d48a7b3a72f121655d95b5157c32c7d555e44c05
Author: Chao Yu <chao@kernel.org>
Date:   Mon Jan 9 03:49:20 2023 +0000

    f2fs: fix to do sanity check on extent cache correctly

The root cause is we applied both v1 and v2 of the patch, v2 is the right
fix, so it needs to revert v1 in order to fix reported issue.

v1:
commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly")
https://lore.kernel.org/lkml/[PII_REDACTED]4920.492914-1-chao@kernel.org/

v2:
commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly")
https://lore.kernel.org/lkml/[PII_REDACTED]4[PII_REDACTED]-1-chao@kernel.org/
References: https://git.kernel.org/stable/c/0d545a8e77cbd1fbad311b18952e38e0f7672ab4; https://git.kernel.org/stable/c/958ccbbf1ce716d77c7cfa79ace50a421c1eed73; https://git.kernel.org/stable/c/bbb3cd66301ef752fae[PII_REDACTED]f228d69bcaf
CVE: CVE-2023-53764
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Handle lock during peer_id find

ath12k_peer_find_by_id() requires that the caller hold the
ab->base_lock. Currently the WBM error path does not hold
the lock and calling that function, leads to the
following lockdep_assert()in QCN9274:

[[PII_REDACTED]93] ------------[ cut here ]------------
[[PII_REDACTED]16] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k]
[[PII_REDACTED]33] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)]
[[PII_REDACTED]67] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G        W  O       6.1.0-rc2+ #3
[[PII_REDACTED]72] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019
[[PII_REDACTED]77] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k]
[[PII_REDACTED]90] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00
[[PII_REDACTED]96] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246
[[PII_REDACTED]03] RAX: [PII_REDACTED] RBX: ffff9f[PII_REDACTED] RCX: [PII_REDACTED]
[[PII_REDACTED]08] RDX: [PII_REDACTED] RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7
[[PII_REDACTED]13] RBP:[PII_REDACTED]00000a R08: [PII_REDACTED] R09: [PII_REDACTED]
[[PII_REDACTED]17] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0
[[PII_REDACTED]22] R13: ffff9f[PII_REDACTED] R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040
[[PII_REDACTED]26] FS:  [PII_REDACTED](0000) GS:ffff9f[PII_REDACTED](0000) knlGS:[PII_REDACTED]
[[PII_REDACTED]31] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[[PII_REDACTED]36] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4:[PII_REDACTED]3706e0
[[PII_REDACTED]41] Call Trace:
[[PII_REDACTED]46]  <IRQ>
[[PII_REDACTED]51]  ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k]
[[PII_REDACTED]72]  ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k]
[[PII_REDACTED]84]  ? __lock_acquire+0x4ca/0x1a60
[[PII_REDACTED]04]  ath12k_dp_service_srng+0x263/0x310 [ath12k]
[[PII_REDACTED]20]  ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k]
[[PII_REDACTED]33]  __napi_poll+0x22/0x260
[[PII_REDACTED]41]  net_rx_action+0x2f8/0x380
[[PII_REDACTED]53]  __do_softirq+0xd0/0x4c9
[[PII_REDACTED]62]  irq_exit_rcu+0x88/0xe0
[[PII_REDACTED]69]  common_interrupt+0xa5/0xc0
[[PII_REDACTED]74]  </IRQ>
[[PII_REDACTED]79]  <TASK>
[[PII_REDACTED]84]  asm_common_interrupt+0x22/0x40

Handle spin lock/unlock in WBM error path to hold the necessary lock
expected by ath12k_peer_find_by_id().

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1
References: https://git.kernel.org/stable/c/95a389e2ff3212d866cc51c77d682d2934074eb8; https://git.kernel.org/stable/c/9faf7c696610a348ca94a224d55c946b19b3279d
CVE: CVE-2023-53765
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

dm cache: free background tracker's queued work in btracker_destroy

Otherwise the kernel can BUG with:

[ 2245.426978] =============================================================================
[ 2245.435155] BUG bt_work (Tainted: G    B   W         ): Objects remaining in bt_work on __kmem_cache_shutdown()
[ 2245.445233] -----------------------------------------------------------------------------
[ 2245.445233]
[ 2245.454879] Slab 0x00000000b0ce2b30 objects=64 used=2 fp=0x000000000a3c6a4e flags=0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)
[ 2245.467300] CPU: 7 PID: 10805 Comm: lvm Kdump: loaded Tainted: G    B   W          6.0.0-rc2 #19
[ 2245.476078] Hardware name: Dell Inc. PowerEdge R7525/0590KW, BIOS 2.5.6 10/06/2021
[ 2245.483646] Call Trace:
[ 2245.486100]  <TASK>
[ 2245.488206]  dump_stack_lvl+0x34/0x48
[ 2245.491878]  slab_err+0x95/0xcd
[ 2245.495028]  __kmem_cache_shutdown.cold+0x31/0x136
[ 2245.499821]  kmem_cache_destroy+0x49/0x130
[ 2245.503928]  btracker_destroy+0x12/0x20 [dm_cache]
[ 2245.508728]  smq_destroy+0x15/0x60 [dm_cache_smq]
[ 2245.513435]  dm_cache_policy_destroy+0x12/0x20 [dm_cache]
[ 2245.518834]  destroy+0xc0/0x110 [dm_cache]
[ 2245.522933]  dm_table_destroy+0x5c/0x120 [dm_mod]
[ 2245.527649]  __dm_destroy+0x10e/0x1c0 [dm_mod]
[ 2245.532102]  dev_remove+0x117/0x190 [dm_mod]
[ 2245.536384]  ctl_ioctl+0x1a2/0x290 [dm_mod]
[ 2245.540579]  dm_ctl_ioctl+0xa/0x20 [dm_mod]
[ 2245.544773]  __x64_sys_ioctl+0x8a/0xc0
[ 2245.548524]  do_syscall_64+0x5c/0x90
[ 2245.552104]  ? syscall_exit_to_user_mode+0x12/0x30
[ 2245.556897]  ? do_syscall_64+0x69/0x90
[ 2245.560648]  ? do_syscall_64+0x69/0x90
[ 2245.564394]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 2245.569447] RIP: 0033:0x7fe52583ec6b
...
[ 2245.646771] ------------[ cut here ]------------
[ 2245.651395] kmem_cache_destroy bt_work: Slab cache still has objects when called from btracker_destroy+0x12/0x20 [dm_cache]
[ 2245.651408] WARNING: CPU: 7 PID: 10805 at mm/slab_common.c:478 kmem_cache_destroy+0x128/0x130

Found using: lvm2-testsuite --only "cache-single-split.sh"

Ben bisected and found that commit 0495e337b703 ("mm/slab_common:
Deleting kobject in kmem_cache_destroy() without holding
slab_mutex/cpu_hotplug_lock") first exposed dm-cache's incomplete
cleanup of its background tracker work objects.
References: https://git.kernel.org/stable/c/673a3af21d5e3ed769f3eaed0c888244290a3506; https://git.kernel.org/stable/c/95ab80a8a0fef2ce0cc494a306dd283948066ce7; https://git.kernel.org/stable/c/ed56ad5cacb7a3aeb611494d5d66e2399d2bfecc
CVE: CVE-2023-53766
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

FS: JFS: Check for read-only mounted filesystem in txBegin

 This patch adds a check for read-only mounted filesystem
 in txBegin before starting a transaction potentially saving
 from NULL pointer deref.
References: https://git.kernel.org/stable/c/2a8807f9f511c64de0c7cc9900a1683e3d72a3e5; https://git.kernel.org/stable/c/2febd5f81e4bfba61d9f374dcca628aff374cc56; https://git.kernel.org/stable/c/5c094ca994824e038b6a97835ded4e5d1d808504
CVE: CVE-2023-53767
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()

Currently the buffer pointed by event is not freed in case
ATH12K_FLAG_UNREGISTERING bit is set, this causes memory leak.

Add a goto skip instead of return, to ensure event and all the
list entries are freed properly.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
References: https://git.kernel.org/stable/c/960412bee0ea75f6b3c2dca4a3535795ee84c47a; https://git.kernel.org/stable/c/a87f59041a7f77b4bdab05cea60ac6adc69dc5d2
CVE: CVE-2023-53768
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

regmap-irq: Fix out-of-bounds access when allocating config buffers

When allocating the 2D array for handling IRQ type registers in
regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix
with num_config_bases rows and num_config_regs columns.

This is currently handled by allocating a buffer to hold a pointer for
each row (i.e. num_config_bases). After that, the logic attempts to
allocate the memory required to hold the register configuration for
each row. However, instead of doing this allocation for each row
(i.e. num_config_bases allocations), the logic erroneously does this
allocation num_config_regs number of times.

This scenario can lead to out-of-bounds accesses when num_config_regs
is greater than num_config_bases. Fix this by updating the terminating
condition of the loop that allocates the memory for holding the register
configuration to allocate memory only for each row in the matrix.

Amit Pundir reported a crash that was occurring on his db845c device
due to memory corruption (see "Closes" tag for Amit's report). The KASAN
report below helped narrow it down to this issue:

[   14.033877][    T1] ==================================================================
[   14.042507][    T1] BUG: KASAN: invalid-access in regmap_add_irq_chip_fwnode+0x594/0x1364
[   14.050796][    T1] Write of size 8 at addr 06ffff[PII_REDACTED] by task init/1

[   14.242004][    T1] The buggy address belongs to the object at ffffff[PII_REDACTED]
[   14.242004][    T1]  which belongs to the cache kmalloc-8 of size 8
[   14.255669][    T1] The buggy address is located 0 bytes inside of
[   14.255669][    T1]  8-byte region [ffffff[PII_REDACTED], ffffff[PII_REDACTED])
References: https://git.kernel.org/stable/c/6e7b2337ecd028bd888a1a0be4115b8a88faf838; https://git.kernel.org/stable/c/963b54df82b6d6206d7def273390bf3f7af558e1; https://git.kernel.org/stable/c/b1a726ad33e585e3d9fa70712df31ae105e4532c
CVE: CVE-2023-53769
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

virt/coco/sev-guest: Double-buffer messages

The encryption algorithms read and write directly to shared unencrypted
memory, which may leak information as well as permit the host to tamper
with the message integrity. Instead, copy whole messages in or out as
needed before doing any computation on them.
References: https://git.kernel.org/stable/c/4b69c63f716cfda38e1210e65b68f67f6cee2ddf; https://git.kernel.org/stable/c/577a64725bfd[PII_REDACTED]8e953d405067ee565b; https://git.kernel.org/stable/c/965006103a14703cc42043bbf9b5e0cdf7a468ad
CVE: CVE-2025-14209
Published: 2025-12-08
Description: A weakness has been identified in Campcodes School File Management System 1.0. This impacts an unknown function of the file /update_query.php. This manipulation of the argument stud_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/IdealDreamLast/PublicCVE/issues/1; https://vuldb.com/?ctiid.334652; https://vuldb.com/?id.334652
CVE: CVE-2025-14210
Published: 2025-12-08
Description: A security vulnerability has been detected in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /delete_member.php. Such manipulation of the argument user_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rassec2/dbcve/issues/9; https://vuldb.com/?ctiid.334653; https://vuldb.com/?id.334653
CVE: CVE-2025-14211
Published: 2025-12-08
Description: A vulnerability was detected in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_book.php. Performing a manipulation of the argument book_id results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rassec2/dbcve/issues/10; https://vuldb.com/?ctiid.334654; https://vuldb.com/?id.334654
CVE: CVE-2025-14212
Published: 2025-12-08
Description: A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /member_search.php. Executing a manipulation of the argument roll_number can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rassec2/dbcve/issues/11; https://vuldb.com/?ctiid.334655; https://vuldb.com/?id.334655
CVE: CVE-2025-14214
Published: 2025-12-08
Description: A vulnerability has been found in itsourcecode Student Information System 1.0. This affects an unknown part of the file /section_edit1.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ltranquility/CVE/issues/15; https://itsourcecode.com/; https://vuldb.com/?ctiid.334656
CVE: CVE-2025-14215
Published: 2025-12-08
Description: A vulnerability was found in code-projects Currency Exchange System 1.0. This vulnerability affects unknown code of the file /edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/rassec2/dbcve/issues/12; https://vuldb.com/?ctiid.334657
CVE: CVE-2025-14216
Published: 2025-12-08
Description: A vulnerability was determined in code-projects Currency Exchange System 1.0. This issue affects some unknown processing of the file /viewserial.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/rassec2/dbcve/issues/13; https://vuldb.com/?ctiid.334658
CVE: CVE-2025-14217
Published: 2025-12-08
Description: A vulnerability was identified in code-projects Currency Exchange System 1.0. Impacted is an unknown function of the file /edittrns.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/rassec2/dbcve/issues/14; https://vuldb.com/?ctiid.334659
CVE: CVE-2025-14218
Published: 2025-12-08
Description: A security flaw has been discovered in code-projects Currency Exchange System 1.0. The affected element is an unknown function of the file /editotheraccount.php. Performing manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/rassec2/dbcve/issues/15; https://vuldb.com/?ctiid.334660
CVE: CVE-2025-14219
Published: 2025-12-08
Description: A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_running.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/yyue02/cve/issues/1; https://vuldb.com/?ctiid.334661; https://vuldb.com/?id.334661
CVE: CVE-2025-14220
Published: 2025-12-08
Description: A security vulnerability has been detected in ORICO CD3510 1.9.12. This affects an unknown function of the component File Upload. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.334662; https://vuldb.com/?id.334662; https://vuldb.com/?submit.701302
CVE: CVE-2025-14221
Published: 2025-12-08
Description: A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://mega.nz/file/T4hjCagS#87U1JgRHZWzXW2HTpBIG-H9dJ_w9kUERmaaQqJyB5_Q; https://vuldb.com/?ctiid.334663; https://vuldb.com/?id.334663
CVE: CVE-2025-14222
Published: 2025-12-08
Description: A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/tiancesec/CVE/issues/14; https://vuldb.com/?ctiid.334664
CVE: CVE-2025-14223
Published: 2025-12-08
Description: A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument staff_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/woshilaiyi/cve/issues/4; https://vuldb.com/?ctiid.334665
CVE: CVE-2025-14253
Published: 2025-12-08
Description: Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-36
References: https://www.twcert.org.tw/en/cp-139-10543-380bd-2.html; https://www.twcert.org.tw/tw/cp-132-10542-4c682-1.html
CVE: CVE-2025-14254
Published: 2025-12-08
Description: Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10543-380bd-2.html; https://www.twcert.org.tw/tw/cp-132-10542-4c682-1.html
CVE: CVE-2025-14255
Published: 2025-12-08
Description: Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10543-380bd-2.html; https://www.twcert.org.tw/tw/cp-132-10542-4c682-1.html
CVE: CVE-2025-66320
Published: 2025-12-08
Description: Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66321
Published: 2025-12-08
Description: Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66322
Published: 2025-12-08
Description: Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/12/