deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-55199
Published: 2025-08-14
Description: Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/helm/helm/commit/b78692c18f0fb38fe5ba4571a674de067a4c53a5; https://github.com/helm/helm/security/advisories/GHSA-9h84-qmv7-982p
CVE: CVE-2025-8930
Published: 2025-08-14
Description: A vulnerability was found in code-projects Medical Store Management System 1.0. This issue affects some unknown processing of the file UpdateCompany.java of the component Update Company Page. The manipulation of the argument companyNameTxt leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.319889; https://vuldb.com/?id.319889
CVE: CVE-2025-8931
Published: 2025-08-14
Description: A vulnerability was determined in code-projects Medical Store Management System 1.0. Affected is an unknown function of the file ChangePassword.java. The manipulation of the argument newPassTxt leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.319890; https://vuldb.com/?id.319890
CVE: CVE-2025-8932
Published: 2025-08-14
Description: A vulnerability was determined in 1000 Projects Sales Management System 1.0. This vulnerability affects unknown code of the file /superstore/admin/sales.php. The manipulation of the argument ssalescat leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/lan041221/cvec/issues/3; https://vuldb.com/?ctiid.319894
CVE: CVE-2025-8933
Published: 2025-08-14
Description: A vulnerability was identified in 1000 Projects Sales Management System 1.0. This issue affects some unknown processing of the file /superstore/admin/sales.php. The manipulation of the argument ssalescat leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://1000projects.org/; https://github.com/lan041221/cvec/issues/4; https://vuldb.com/?ctiid.319895
CVE: CVE-2025-8934
Published: 2025-08-14
Description: A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the argument select2112 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://1000projects.org/; https://github.com/lan041221/cvec/issues/5; https://vuldb.com/?ctiid.319896
CVE: CVE-2025-8935
Published: 2025-08-14
Description: A vulnerability was found in 1000 Projects Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /superstore/custcmp.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/lan041221/cvec/issues/6; https://vuldb.com/?ctiid.319897
CVE: CVE-2024-7402
Published: 2025-08-14
Description: Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by performing MITM (Man-in-the-Middle) activity on the Netskope Client communication channel. A successful exploitation would require administrative privileges on the machine, and could result in temporarily altering the configuration of Netskope Client or permanently disabling or removing the agent from the machine.
CWE: CWE-354, CWE-354
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2024-002
CVE: CVE-2025-0309
Published: 2025-08-14
Description: An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
CWE: CWE-295
References: https://blog.amberwolf.com/blog/2025/august/breaking-into-your-network-zer0-effort/; https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-002
CVE: CVE-2025-5941
Published: 2025-08-14
Description: Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful exploit can potentially result in user-controllable memory being leaked in a domain name stored on the local machine.
CWE: CWE-125
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-001
CVE: CVE-2025-5942
Published: 2025-08-14
Description: Netskope was notified about a potential gap in its agent (NS Client) on Windows systems.  If this gap is successfully exploited, an unprivileged user can trigger a heap overflow in the epdlpdrv.sys driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation can also potentially be performed by an unprivileged user whose NS Client is configured to use Endpoint DLP. A successful exploit can result in a denial-of-service for the local machine.
CWE: CWE-122
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-003
CVE: CVE-2025-8936
Published: 2025-08-14
Description: A vulnerability was determined in 1000 Projects Sales Management System 1.0. Affected by this issue is some unknown functionality of the file /superstore/dist/dordupdate.php. The manipulation of the argument select2 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/lan041221/cvec/issues/7; https://vuldb.com/?ctiid.319898
CVE: CVE-2025-8937
Published: 2025-08-14
Description: A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/N350R_formSysCmd.pdf; https://github.com/rew1X/CVE/blob/main/TOTOLINK/formSysCmd/formSysCmd.md; https://vuldb.com/?ctiid.319900
CVE: CVE-2025-8938
Published: 2025-08-14
Description: A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-912
References: https://github.com/rew1X/CVE/blob/main/TOTOLINK/formSysTel/formSysTel.md; https://github.com/rew1X/CVE/blob/main/TOTOLINK/formSysTel/formSysTel.md#poc; https://vuldb.com/?ctiid.319901
CVE: CVE-2025-3414
Published: 2025-08-14
Description: The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/1dd322b5-3c1d-4da7-8737-e6688fc9f4df/; https://wpscan.com/vulnerability/1dd322b5-3c1d-4da7-8737-e6688fc9f4df/
CVE: CVE-2025-6790
Published: 2025-08-14
Description: The Quiz and Survey Master (QSM)  WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/af337f9f-c955-49eb-9675-2f85da96fcfe/; https://wpscan.com/vulnerability/af337f9f-c955-49eb-9675-2f85da96fcfe/
CVE: CVE-2025-7808
Published: 2025-08-14
Description: The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fa[PII_REDACTED]-47f6-bab5-9f6dff0f236a/
CVE: CVE-2025-8046
Published: 2025-08-14
Description: The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/14a53525-8c08-472d-bae4-b3f14368b802/; https://wpscan.com/vulnerability/14a53525-8c08-472d-bae4-b3f14368b802/
CVE: CVE-2025-8939
Published: 2025-08-14
Description: A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC20/Tenda%20AC20.md; https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC20/Tenda%20AC20.md#3-poc; https://vuldb.com/?ctiid.319902
CVE: CVE-2025-8940
Published: 2025-08-14
Description: A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this vulnerability is the function strcpy of the file /goform/saveParentControlInfo. The manipulation of the argument Time leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC20-2/Tenda%20AC20-2.md; https://github.com/lin-3-start/lin-cve/blob/main/Tenda%20AC20-2/Tenda%20AC20-2.md#poc; https://vuldb.com/?ctiid.319903
CVE: CVE-2025-8946
Published: 2025-08-14
Description: A vulnerability has been found in projectworlds Online Notes Sharing Platform 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument User leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guoma-book/CVE/issues/1; https://vuldb.com/?ctiid.319912; https://vuldb.com/?id.319912
CVE: CVE-2025-8947
Published: 2025-08-14
Description: A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guoma-book/CVE/issues/3; https://github.com/guoma-book/CVE/issues/4; https://vuldb.com/?ctiid.319913
CVE: CVE-2025-8948
Published: 2025-08-14
Description: A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guoma-book/CVE/issues/5; https://vuldb.com/?ctiid.319914; https://vuldb.com/?id.319914
CVE: CVE-2025-8949
Published: 2025-08-14
Description: A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The manipulation of the argument ping_ipaddr leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/i-Corner/cve/issues/16; https://vuldb.com/?ctiid.319915; https://vuldb.com/?id.319915
CVE: CVE-2025-27388
Published: 2025-08-14
Description: Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
CWE: CWE-20
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]426209280
CVE: CVE-2025-8950
Published: 2025-08-14
Description: A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /Recruitment/index.php?page=view_vacancy. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Noc14/cve/issues/1; https://vuldb.com/?ctiid.319919; https://vuldb.com/?id.319919
CVE: CVE-2025-8951
Published: 2025-08-14
Description: A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzx-yyds/mycve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.319920
CVE: CVE-2025-48860
Published: 2025-08-14
Description: A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.
CVSS Score: 8.0 (HIGH)
CWE: CWE-284
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html
CVE: CVE-2025-48861
Published: 2025-08-14
Description: A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html
CVE: CVE-2025-48862
Published: 2025-08-14
Description: Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.
CVSS Score: 7.1 (HIGH)
CWE: CWE-311, CWE-1104
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html
CVE: CVE-2025-54472
Published: 2025-08-14
Description: Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network.



Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it.
The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0.



Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services.



How to Fix: we provide two methods, you can choose one of them:

1. Upgrade bRPC to version 1.14.1.
2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually.

No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-400
References: https://lists.apache.org/thread/r3xsy3wvs4kmfhc281173k5b6ll1xt2m; http://www.openwall.com/lists/oss-security/2025/08/12/2
CVE: CVE-2025-5998
Published: 2025-08-14
Description: The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/17bad181-6cea-445e-b91c-22415d90743e/; https://wpscan.com/vulnerability/17bad181-6cea-445e-b91c-22415d90743e/
CVE: CVE-2025-8952
Published: 2025-08-14
Description: A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.319921; https://vuldb.com/?id.319921; https://vuldb.com/?submit.627814
CVE: CVE-2025-8953
Published: 2025-08-14
Description: A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /check_availability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/29; https://vuldb.com/?ctiid.319922; https://vuldb.com/?id.319922
CVE: CVE-2025-8954
Published: 2025-08-14
Description: A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/LitBot123/mycve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.319923
CVE: CVE-2025-55346
Published: 2025-08-14
Description: User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://research.jfrog.com/vulnerabilities/flowise-js-injection-remote-code-exection-jfsa-2[PII_REDACTED]25/; https://research.jfrog.com/vulnerabilities/flowise-js-injection-remote-code-exection-jfsa-2[PII_REDACTED]25/
CVE: CVE-2025-7761
Published: 2025-08-14
Description: Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.

The vendor was contacted early about this disclosure but did not respond in any way. Potentially all versions are vulnerable.
CWE: CWE-79
References: https://cert.pl/posts/2025/07/CVE-2025-7761; https://www.lepszybip.pl/; https://www.lepszybip.pl/
CVE: CVE-2025-8047
Published: 2025-08-14
Description: The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert marketing security services. Users that pay are added to allowedDomains to suppress the popup.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/a0c70b98-a3f9-4d4c-a25f-81424230b1a5/; https://wpscan.com/vulnerability/a0c70b98-a3f9-4d4c-a25f-81424230b1a5/
CVE: CVE-2025-8943
Published: 2025-08-14
Description: The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-862
References: https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2[PII_REDACTED]78/
CVE: CVE-2025-8955
Published: 2025-08-14
Description: A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit-doctor.php. The manipulation of the argument docfees leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/LitBot123/mycve/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.319924
CVE: CVE-2025-8956
Published: 2025-08-14
Description: A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/LonTan0/CVE/blob/main/Remote%20Arbitrary%20Command%20Execution%20Vulnerability%20in%20ssdpcgi%20of%20D-Link%20DIR%E2%80%91818L.md; https://vuldb.com/?ctiid.319925; https://vuldb.com/?id.319925