deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10458
Published: 2025-09-19
Description: Parameters are not validated or sanitized, and are later used in various internal operations.
CVSS Score: 7.6 (HIGH)
CWE: CWE-130
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vmww-237q-2fwp
CVE: CVE-2025-5948
Published: 2025-09-19
Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793; https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=cve
CVE: CVE-2025-7403
Published: 2025-09-19
Description: Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes are attacker-controlled, enabling precise memory corruption.
CVSS Score: 7.6 (HIGH)
CWE: CWE-123
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9r46-cqqw-6j2j
CVE: CVE-2025-7702
Published: 2025-09-19
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pusula Communication Information Internet Industry and Trade Ltd. Co. Manageable Email Sending System allows Exploiting Trust in Client.This issue affects Manageable Email Sending System: from <=2025.06 before 2025.08.06.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://www.usom.gov.tr/bildirim/tr-25-0274
CVE: CVE-2025-10647
Published: 2025-09-19
Description: The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_handler_download_pdf_media function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset/3364156/embed-pdf-wpforms/trunk/includes/class-wpforms-field-pdf-viewer.php; https://wordpress.org/plugins/embed-pdf-wpforms/; https://www.wordfence.com/threat-intel/vulnerabilities/id/af67a544-daff-469f-a66b-e998b79b7845?source=cve
CVE: CVE-2025-9905
Published: 2025-09-19
Description: The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.

One can create a specially crafted .h5/.hdf5 model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed.

This is achieved by crafting a special .h5 archive file that uses the Lambda layer feature of keras which allows arbitrary Python code in the form of pickled code. The vulnerability comes from the fact that the safe_mode=True option is not honored when reading .h5 archives.

Note that the .h5/.hdf5 format is a legacy format supported by Keras 3 for backwards compatibility.
CVSS Score: 7.3 (HIGH)
CWE: CWE-913
References: https://github.com/keras-team/keras/pull/21602; https://github.com/keras-team/keras/security/advisories/GHSA-36rr-ww3j-vrjv
CVE: CVE-2025-9906
Published: 2025-09-19
Description: The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.

One can create a specially crafted .keras model archive that, when loaded via Model.load_model, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enable_unsafe_deserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enable_unsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.
CVSS Score: 7.3 (HIGH)
CWE: CWE-502
References: https://github.com/keras-team/keras/pull/21429
CVE: CVE-2025-10630
Published: 2025-09-19
Description: Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. 



Versions 5.2.1 and below contained a ReDoS vulnerability via user-supplied regex query which could causes CPU usage to max out. This vulnerability is fixed in version 6.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/grafana/grafana-zabbix/releases/tag/v6.0.0; https://grafana.com/security/security-advisories/cve-2025-10630/
CVE: CVE-2025-10719
Published: 2025-09-19
Description: Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specific parameter to access other users' files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.twcert.org.tw/en/cp-139-10397-49db1-2.html; https://www.twcert.org.tw/tw/cp-132-10396-68624-1.html
CVE: CVE-2025-8531
Published: 2025-09-19
Description: Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-130
References: https://jvn.jp/vu/JVNVU97846038/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-266-02; https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-013_en.pdf
CVE: CVE-2025-10468
Published: 2025-09-19
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal.This issue affects CityPlus: before 24.29375.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.usom.gov.tr/bildirim/tr-25-0279
CVE: CVE-2025-10707
Published: 2025-09-19
Description: A weakness has been identified in JeecgBoot up to 3.8.2. Affected is an unknown function of the file /message/sysMessageTemplate/sendMsg. Executing manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.324995; https://vuldb.com/?id.324995; https://vuldb.com/?submit.644659
CVE: CVE-2025-10708
Published: 2025-09-19
Description: A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /history/historyDownload.do;usrlogout.do. The manipulation of the argument fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Cstarplus/CVE/issues/4; https://vuldb.com/?ctiid.324996; https://vuldb.com/?id.324996
CVE: CVE-2025-10709
Published: 2025-09-19
Description: A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Cstarplus/CVE/issues/5; https://vuldb.com/?ctiid.324997; https://vuldb.com/?id.324997
CVE: CVE-2025-9969
Published: 2025-09-19
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS.This issue affects Real Estate Packages: before 5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0278
CVE: CVE-2025-10710
Published: 2025-09-19
Description: A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/1276486/CVE/issues/11; https://vuldb.com/?ctiid.324998; https://vuldb.com/?id.324998
CVE: CVE-2025-10711
Published: 2025-09-19
Description: A vulnerability has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This vulnerability affects unknown code of the file /index.php/sysmanage/Login. Such manipulation of the argument Name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/1276486/CVE/issues/12; https://vuldb.com/?ctiid.324999; https://vuldb.com/?id.324999
CVE: CVE-2025-7665
Published: 2025-09-19
Description: The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to Administrator. Premium features must be enabled in order to exploit the vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/trunk/handler/forms/class-registrationform.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a02910-5674-4266-ab6e-7926bf6adecc?source=cve
CVE: CVE-2025-10712
Published: 2025-09-19
Description: A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/1276486/CVE/issues/13; https://vuldb.com/?ctiid.325000; https://vuldb.com/?id.325000
CVE: CVE-2025-10715
Published: 2025-09-19
Description: A security flaw has been discovered in APEUni PTE Exam Practice App up to 10.8.0 on Android. The impacted element is an unknown function of the file AndroidManifest.xml of the component com.ape_edication. The manipulation results in improper export of android application components. The attack requires a local approach. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.ape_edication.md; https://github.com/KMov-g/androidapps/blob/main/com.ape_edication.md#steps-to-reproduce; https://vuldb.com/?ctiid.325003
CVE: CVE-2025-46703
Published: 2025-09-19
Description: Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-116, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE: CVE-2025-48007
Published: 2025-09-19
Description: Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-116, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE: CVE-2025-57880
Published: 2025-09-19
Description: Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS).
This issue affects BlueSpice: from 5 through 5.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE: CVE-2025-58114
Published: 2025-09-19
Description: Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05
CVE: CVE-2025-10716
Published: 2025-09-19
Description: A flaw has been found in Creality Cloud App up to 6.1.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.cxsw.sdprinter. Executing manipulation can lead to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.cxsw.sdprinter.md; https://vuldb.com/?ctiid.325007; https://vuldb.com/?id.325007
CVE: CVE-2025-10717
Published: 2025-09-19
Description: A vulnerability has been found in intsig CamScanner App 6.91.1.5.250711 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.intsig.camscanner. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.intsig.camscanner.md; https://github.com/KMov-g/androidapps/blob/main/com.intsig.camscanner.md#steps-to-reproduce; https://vuldb.com/?ctiid.325008
CVE: CVE-2025-57528
Published: 2025-09-19
Description: An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm).
CVSS Score: 7.7 (HIGH)
CWE: CWE-20
References: https://github.com/faqiadegege/IoTVuln/blob/main/tendaAc6_formSetCfm_funcname_overflow/detail.md
CVE: CVE-2025-8532
Published: 2025-09-19
Description: Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing.This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-285, CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0280
CVE: CVE-2025-8664
Published: 2025-09-19
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities E-Municipality Management allows Cross-Site Scripting (XSS).This issue affects StarCities E-Municipality Management: before 20250825.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0281
CVE: CVE-2025-10718
Published: 2025-09-19
Description: A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.ooma.office2.md; https://vuldb.com/?ctiid.325009; https://vuldb.com/?id.325009
CVE: CVE-2025-39837
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: asus-wmi: Fix racy registrations

asus_wmi_register_driver() may be called from multiple drivers
concurrently, which can lead to the racy list operations, eventually
corrupting the memory and hitting Oops on some ASUS machines.
Also, the error handling is missing, and it forgot to unregister ACPI
lps0 dev ops in the error case.

This patch covers those issues by introducing a simple mutex at
acpi_wmi_register_driver() & *_unregister_driver, and adding the
proper call of asus_s2idle_check_unregister() in the error path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/5549202b9c02c2ecbc8634768a3da8d9e82d548d; https://git.kernel.org/stable/c/e7a70326fb26b905cfc8fe2366113aa4394733ef
CVE: CVE-2025-39838
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: prevent NULL pointer dereference in UTF16 conversion

There can be a NULL pointer dereference bug here. NULL is passed to
__cifs_sfu_make_node without checks, which passes it unchecked to
cifs_strndup_to_utf16, which in turn passes it to
cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash.

This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and
returns NULL early to prevent dereferencing NULL pointer.

Found by Linux Verification Center (linuxtesting.org) with SVACE
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1f797f062b5cf13a1c2bcc23285361baaa7c9260; https://git.kernel.org/stable/c/3c26a8d30ed6b53a52a023ec537dc50a6d34a67a; https://git.kernel.org/stable/c/70bccd9855dae56942f2b18a08ba137bb54093a0
CVE: CVE-2025-39839
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix OOB read/write in network-coding decode

batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/1e36c6c8dc8023b4bbe9a16e819f9998b9b6a183; https://git.kernel.org/stable/c/[PII_REDACTED]7bc1e920eb002483d7d981d9b2ac1c; https://git.kernel.org/stable/c/30fc47248f02b8a14a61df469e1da4704be1a19f
CVE: CVE-2025-39840
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

audit: fix out-of-bounds read in audit_compare_dname_path()

When a watch on dir=/ is combined with an fsnotify event for a
single-character name directly under / (e.g., creating /a), an
out-of-bounds read can occur in audit_compare_dname_path().

The helper parent_len() returns 1 for "/". In audit_compare_dname_path(),
when parentlen equals the full path length (1), the code sets p = path + 1
and pathlen = 1 - 1 = 0. The subsequent loop then dereferences
p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read.

Fix this by adding a pathlen > 0 check to the while loop condition
to prevent the out-of-bounds access.

[PM: subject tweak, sign-off email fixes]
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/4540f1d23e7f387880ce46d11b5cd3f27248bf8d; https://git.kernel.org/stable/c/9735a9dcc307427e7d6336c54171682f1bac9789
CVE: CVE-2025-39841
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix buffer free/clear order in deferred receive path

Fix a use-after-free window by correcting the buffer release sequence in
the deferred receive path. The code freed the RQ buffer first and only
then cleared the context pointer under the lock. Concurrent paths (e.g.,
ABTS and the repost path) also inspect and release the same pointer under
the lock, so the old order could lead to double-free/UAF.

Note that the repost path already uses the correct pattern: detach the
pointer under the lock, then free it after dropping the lock. The
deferred path should do the same.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/367cb5ffd8a8a4c85dc89f55e7fa7cc191425b11; https://git.kernel.org/stable/c/55658c7501467ca9ef3bd4453dd920010db8bc13; https://git.kernel.org/stable/c/897f64b01c1249ac730329b83f4f40bab71e86c7
CVE: CVE-2025-39842
Published: 2025-09-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ocfs2: prevent release journal inode after journal shutdown

Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already
been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. 
Therefore, the following calltrace will inevitably fail when it reaches
jbd2_journal_release_jbd_inode().

ocfs2_dismount_volume()->
  ocfs2_delete_osb()->
    ocfs2_free_slot_info()->
      __ocfs2_free_slot_info()->
        evict()->
          ocfs2_evict_inode()->
            ocfs2_clear_inode()->
	      jbd2_journal_release_jbd_inode(osb->journal->j_journal,

Adding osb->journal checks will prevent null-ptr-deref during the above
execution path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/42c415c53ad2065088cc411d08925effa5b3d255; https://git.kernel.org/stable/c/85e66331b60601d903cceaf8c10a234db863cd78; https://git.kernel.org/stable/c/e9188f66e94955431ddbe2cd1cdf8ff2bb486abf