deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-31204
Published: 2025-05-12
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122719
CVE: CVE-2025-31205
Published: 2025-05-12
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. A malicious website may exfiltrate data cross-origin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122719
CVE: CVE-2025-31206
Published: 2025-05-12
Description: A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-843
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31207
Published: 2025-05-12
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://support.apple.com/en-us/122404; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31208
Published: 2025-05-12
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31209
Published: 2025-05-12
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to disclosure of user information.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31210
Published: 2025-05-12
Description: The issue was addressed with improved UI. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing web content may lead to a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31212
Published: 2025-05-12
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122720
CVE: CVE-2025-31213
Published: 2025-05-12
Description: A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to access associated usernames and websites in a user's iCloud Keychain.
CVSS Score: 7.6 (HIGH)
CWE: CWE-532
References: https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717
CVE: CVE-2025-31214
Published: 2025-05-12
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker in a privileged network position may be able to intercept network traffic.
CVSS Score: 8.1 (HIGH)
CWE: CWE-300
References: https://support.apple.com/en-us/122404; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31215
Published: 2025-05-12
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31217
Published: 2025-05-12
Description: The issue was addressed with improved input validation. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31218
Published: 2025-05-12
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network connections.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31219
Published: 2025-05-12
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31220
Published: 2025-05-12
Description: A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717
CVE: CVE-2025-31221
Published: 2025-05-12
Description: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may be able to leak memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31222
Published: 2025-05-12
Description: A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A user may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717
CVE: CVE-2025-31223
Published: 2025-05-12
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122719
CVE: CVE-2025-31224
Published: 2025-05-12
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to bypass certain Privacy preferences.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717; https://support.apple.com/en-us/122718
CVE: CVE-2025-31225
Published: 2025-05-12
Description: A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in spotlight search results.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: https://support.apple.com/en-us/122404; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31226
Published: 2025-05-12
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing a maliciously crafted image may lead to a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31227
Published: 2025-05-12
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to access a deleted call recording.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/122404; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31228
Published: 2025-05-12
Description: The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may be able to access notes from the lock screen.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31232
Published: 2025-05-12
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A sandboxed app may be able to access sensitive user data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717; https://support.apple.com/en-us/122718
CVE: CVE-2025-31233
Published: 2025-05-12
Description: The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31234
Published: 2025-05-12
Description: The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122720
CVE: CVE-2025-31235
Published: 2025-05-12
Description: A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to cause unexpected system termination.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717
CVE: CVE-2025-31236
Published: 2025-05-12
Description: An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31237
Published: 2025-05-12
Description: This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously crafted AFP network share may lead to system termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717; https://support.apple.com/en-us/122718
CVE: CVE-2025-31238
Published: 2025-05-12
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122719
CVE: CVE-2025-31239
Published: 2025-05-12
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Parsing a file may lead to an unexpected app termination.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31240
Published: 2025-05-12
Description: This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously crafted AFP network share may lead to system termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717; https://support.apple.com/en-us/122718
CVE: CVE-2025-31241
Published: 2025-05-12
Description: A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. A remote attacker may cause an unexpected app termination.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-415
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31242
Published: 2025-05-12
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.3, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122069; https://support.apple.com/en-us/122070; https://support.apple.com/en-us/122404
CVE: CVE-2025-31244
Published: 2025-05-12
Description: A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31245
Published: 2025-05-12
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5. An app may be able to cause unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31246
Published: 2025-05-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6. Connecting to a malicious AFP server may corrupt kernel memory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31247
Published: 2025-05-12
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker may gain access to protected parts of the file system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122717; https://support.apple.com/en-us/122718
CVE: CVE-2025-31249
Published: 2025-05-12
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31250
Published: 2025-05-12
Description: An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31251
Published: 2025-05-12
Description: The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122405; https://support.apple.com/en-us/122716
CVE: CVE-2025-31253
Published: 2025-05-12
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may not result in audio being silenced.
CVSS Score: 7.1 (HIGH)
CWE: CWE-672
References: https://support.apple.com/en-us/122404; http://seclists.org/fulldisclosure/2025/May/5
CVE: CVE-2025-31256
Published: 2025-05-12
Description: The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31257
Published: 2025-05-12
Description: This issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: https://support.apple.com/en-us/122404; https://support.apple.com/en-us/122716; https://support.apple.com/en-us/122719
CVE: CVE-2025-31258
Published: 2025-05-12
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-31259
Published: 2025-05-12
Description: A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be able to capture a screenshot of an app entering or exiting full screen mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/122716; https://support.apple.com/en-us/125110; https://support.apple.com/en-us/125111
CVE: CVE-2025-31260
Published: 2025-05-12
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/122716; http://seclists.org/fulldisclosure/2025/May/7
CVE: CVE-2025-46825
Published: 2025-05-12
Description: Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/kanboard/kanboard/blame/v1.2.44/app/Template/project_view/importTasks.php#L11; https://github.com/kanboard/kanboard/commit/6ebf22eeaae9f8b4abab72e3c18e45a2c4a2a808; https://github.com/kanboard/kanboard/commit/ac94004ea9fc455dcc5edc8a242d67d1ccd85564
CVE: CVE-2023-49641
Published: 2025-05-13
Description: Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginCheck.php resource does not validate the characters received and they are sent unfiltered to the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://fluidattacks.com/advisories/zimerman/; https://www.kashipara.com/
CVE: CVE-2025-26662
Published: 2025-05-13
Description: The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3558755; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-30009
Published: 2025-05-13
Description: he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and integrity within the scope of that victim�s browser, with no effect on availability of the application
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3578900; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-30010
Published: 2025-05-13
Description: The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. On successful exploitation, the attacker could cause low impact on confidentiality and integrity with no impact on the availability of the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://me.sap.com/notes/3578900; https://url.sap/sapsecuritypatchday