deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13740
Published: 2025-12-15
Description: The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3413649/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f117f713-e2f1-4803-87f7-14b1576d823b?source=cve
CVE: CVE-2025-14702
Published: 2025-12-15
Description: A flaw has been found in Smartbit CommV Smartschool App up to 10.4.4. Impacted is an unknown function of the component be.smartschool.mobile.SplashActivity. Executing manipulation can lead to path traversal. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/Secsys-FDU/AF_CVEs/issues/4; https://vuldb.com/?ctiid.336419; https://vuldb.com/?id.336419
CVE: CVE-2025-14703
Published: 2025-12-15
Description: A vulnerability has been found in Shiguangwu sgwbox N3 2.0.25. The affected element is an unknown function of the file /fsnotify of the component POST Message Handler. The manipulation of the argument token leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://vuldb.com/?ctiid.336420; https://vuldb.com/?id.336420; https://vuldb.com/?submit.706914
CVE: CVE-2025-67906
Published: 2025-12-15
Description: In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054; https://github.com/MISP/MISP/compare/v2.5.27...v2.5.28; https://github.com/franckferman/CVE-2025-67906
CVE: CVE-2025-67907
Published: 2025-12-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-67906. Reason: This candidate is a reservation duplicate of CVE-2025-67906. Notes: All CVE users should reference CVE-2025-67906 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-14704
Published: 2025-12-15
Description: A vulnerability was found in Shiguangwu sgwbox N3 2.0.25. The impacted element is an unknown function of the file /eshell of the component API. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://vuldb.com/?ctiid.336421; https://vuldb.com/?id.336421; https://vuldb.com/?submit.706915
CVE: CVE-2025-14705
Published: 2025-12-15
Description: A vulnerability was determined in Shiguangwu sgwbox N3 2.0.25. This affects an unknown function of the component SHARESERVER Feature. This manipulation of the argument params causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-77, CWE-77
References: https://vuldb.com/?ctiid.336422; https://vuldb.com/?id.336422; https://vuldb.com/?submit.706974
CVE: CVE-2025-11363
Published: 2025-12-15
Description: The Royal Addons for Elementor  WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/b2eadb7a-30a4-44c7-a420-849484faccf4/
CVE: CVE-2025-12684
Published: 2025-12-15
Description: The URL Shortify  WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
CVSS Score: 7.1 (HIGH)
References: https://wpscan.com/vulnerability/8f1e04c6-8781-4366-99d9-9a59102957cf/
CVE: CVE-2025-13355
Published: 2025-12-15
Description: The URL Shortify  WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
References: https://wpscan.com/vulnerability/8581af77-2d72-48e8-9b22-2c36f122473c/
CVE: CVE-2025-14549
Published: 2025-12-15
Description: In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers of OMR on Z processors incorrectly handles NUL (0x00) characters during the Latin-compatible charset (UTF-8, ISO8859-1, ASCII, etc) to IBM-1047/037 translation sequence. This can cause the output byte array to be truncated, discarding the first NUL byte and all subsequent characters, and thereby exposing a possible buffer over-read problem. This issue is fixed in Eclipse OMR version 0.8.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/eclipse-omr/omr/pull/8073
CVE: CVE-2025-14706
Published: 2025-12-15
Description: A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the component NETREBOOT Interface. Such manipulation leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-77, CWE-77
References: https://vuldb.com/?ctiid.336423; https://vuldb.com/?id.336423; https://vuldb.com/?submit.706975
CVE: CVE-2025-14707
Published: 2025-12-15
Description: A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the component DOCKER Feature. Performing manipulation of the argument params results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-77, CWE-77
References: https://vuldb.com/?ctiid.336424; https://vuldb.com/?id.336424; https://vuldb.com/?submit.706976
CVE: CVE-2025-14712
Published: 2025-12-15
Description: Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://www.twcert.org.tw/en/cp-139-10571-a0c2a-2.html; https://www.twcert.org.tw/tw/cp-132-10570-72e31-1.html
CVE: CVE-2025-14019
Published: 2025-12-15
Description: LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks.
CVSS Score: 3.4 (LOW)
CWE: CWE-451
References: https://hackerone.com/reports/3062270
CVE: CVE-2025-14020
Published: 2025-12-15
Description: LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-451
References: https://hackerone.com/reports/2547989
CVE: CVE-2025-14021
Published: 2025-12-15
Description: The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://hackerone.com/reports/2548498
CVE: CVE-2025-14022
Published: 2025-12-15
Description: LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.
CVSS Score: 7.7 (HIGH)
CWE: CWE-295, CWE-295
References: https://hackerone.com/reports/2853445
CVE: CVE-2025-14023
Published: 2025-12-15
Description: LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user interface, which could create confusion about the trust context of displayed pages or interactive elements under specific conditions.
CVSS Score: 3.1 (LOW)
CWE: CWE-451
References: https://hackerone.com/reports/3260386; https://hackerone.com/reports/3260386
CVE: CVE-2025-14708
Published: 2025-12-15
Description: A weakness has been identified in Shiguangwu sgwbox N3 2.0.25. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/http_eshell_server of the component WIREDCFGGET Interface. Executing manipulation of the argument params can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-120, CWE-120
References: https://vuldb.com/?ctiid.336425; https://vuldb.com/?id.336425; https://vuldb.com/?submit.706977
CVE: CVE-2025-14709
Published: 2025-12-15
Description: A security vulnerability has been detected in Shiguangwu sgwbox N3 2.0.25. Affected by this issue is some unknown functionality of the file /usr/sbin/http_eshell_server of the component WIRELESSCFGGET Interface. The manipulation of the argument params leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://vuldb.com/?ctiid.336426; https://vuldb.com/?id.336426; https://vuldb.com/?submit.706989
CVE: CVE-2025-14710
Published: 2025-12-15
Description: A vulnerability was detected in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This affects an unknown part of the file /controller/api/OrderList.php. The manipulation of the argument telephone results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/navex2/CVE/issues/3; https://vuldb.com/?ctiid.336427; https://vuldb.com/?id.336427
CVE: CVE-2025-14711
Published: 2025-12-15
Description: A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This manipulation of the argument pickedHotelName/type causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/navex2/CVE/issues/1; https://github.com/navex2/CVE/issues/2; https://vuldb.com/?ctiid.336428
CVE: CVE-2025-11670
Published: 2025-12-15
Description: Zohocorp ManageEngine ADManager Plus versions before 8025 are vulnerable to NTLM Hash Exposure. 
This vulnerability is exploitable only by technicians who have the “Impersonate as Admin” option enabled.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-200
References: https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-11670.html
CVE: CVE-2025-14714
Published: 2025-12-15
Description: An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle




By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges




In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions

This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-288
References: https://www.libreoffice.org/about-us/security/advisories/cve-2025-14714
CVE: CVE-2025-37731
Published: 2025-12-15
Description: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063
CVE: CVE-2025-37732
Published: 2025-12-15
Description: Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://discuss.elastic.co/t/kibana-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-28/384064
CVE: CVE-2025-66388
Published: 2025-12-15
Description: A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization.

Users are recommended to upgrade to version 3.1.4, which fixes this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://github.com/apache/airflow/pull/58772; https://lists.apache.org/thread/mv9hzsx8grjf7gdlkxwppnpbtogtls2g; http://www.openwall.com/lists/oss-security/2025/12/12/1
CVE: CVE-2025-65430
Published: 2025-12-15
Description: An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the access/refresh tokens are now rejected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-613
References: https://allauth.org/news/2025/10/django-allauth-65.13.0-released/
CVE: CVE-2025-65431
Published: 2025-12-15
Description: An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://allauth.org/news/2025/10/django-allauth-65.13.0-released/
CVE: CVE-2025-65778
Published: 2025-12-15
Description: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/wekan/wekan; https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release; https://github.com/wekan/wekan/commit/e9a727301d7b4f1689a703503df668c0f4f4cab8
CVE: CVE-2025-65779
Published: 2025-12-15
Description: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/wekan/wekan; https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release; https://github.com/wekan/wekan/commit/ea310d7508b344512e5de0dfbc9bdfd38145c5c5
CVE: CVE-2025-65780
Published: 2025-12-15
Description: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/wekan/wekan; https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release; https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81
CVE: CVE-2025-65781
Published: 2025-12-15
Description: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
CVSS Score: 8.2 (HIGH)
CWE: CWE-287, CWE-400
References: https://github.com/wekan/wekan; https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release; https://github.com/wekan/wekan/commit/ccd90343394f433b287733ad0a33c08e0a71f53c
CVE: CVE-2025-65782
Published: 2025-12-15
Description: An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/wekan/wekan; https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release; https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9c
CVE: CVE-2025-12900
Published: 2025-12-15
Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3411587; https://www.wordfence.com/threat-intel/vulnerabilities/id/59592b27-d431-499a-b3c3-3d43a5513c36?source=cve
CVE: CVE-2025-13367
Published: 2025-12-15
Description: The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/membership-listing.php; https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/thank-you-page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=cve
CVE: CVE-2025-13608
Published: 2025-12-15
Description: The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'child_pages' shortcode in all versions up to, and including, 2.0.0. This is due to insufficient input sanitization and output escaping on four user-supplied attributes (use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt) in the 'show_child_pages' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3403877/cc-child-pages; https://www.wordfence.com/threat-intel/vulnerabilities/id/139009b5-69d4-44ca-820c-766645828e5e?source=cve
CVE: CVE-2025-13610
Published: 2025-12-15
Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3414853/custom-registration-form-builder-with-submission-manager; https://www.wordfence.com/threat-intel/vulnerabilities/id/4be512bd-190a-415a-bd20-a49373f63fbb?source=cve
CVE: CVE-2025-13728
Published: 2025-12-15
Description: The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3409232/fluent-security/tags/2.1.0/app/Hooks/Handlers/CustomAuthHandler.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a3187d3e-e1da-4af7-a1fa-9657389f9e22?source=cve
CVE: CVE-2025-13950
Published: 2025-12-15
Description: The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/OneSignal/OneSignal-WordPress-Plugin/pull/387/files; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=cve