deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13425
Published: 2025-11-20
Description: A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
CWE: CWE-476
References: https://github.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672
CVE: CVE-2025-34320
Published: 2025-11-20
Description: BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service. Retrieved configuration artifacts may contain account credentials used for BBj Enterprise Manager; possession of these credentials enables administrative access and use of legitimate management functionality that can result in execution of system commands under the service account. Depending on the operating system and the privileges of the BBj service account, this issue may also allow access to other sensitive files on the host, including operating system or application data, potentially exposing additional confidential information.
CWE: CWE-22
References: https://myemail.constantcontact.com/BASIS-International-Ltd--releases-BBj---the-Barista--Application-Framework--and-AddonSoftware--by-Barista-version-25-00.html?soid=[PII_REDACTED]19&aid=WbfWkReLRVE; https://www.vulncheck.com/advisories/basis-bbj-unauthenticated-arbitrary-file-read-rce
CVE: CVE-2025-36161
Published: 2025-11-20
Description: IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7252019
CVE: CVE-2025-60737
Published: 2025-11-20
Description: Cross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /index.php component
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/iSee857/ilevia-EVE-X1-Server-CSRF
CVE: CVE-2025-60738
Published: 2025-11-20
Description: An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/iSee857/ilevia-EVE-X1-Server
CVE: CVE-2025-62293
Published: 2025-11-20
Description: SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status.


This issue was fixed in version 1.55.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62294
Published: 2025-11-20
Description: SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malicious attacker is able to brute-force all possible values and takeover any account in reasonable amount of time.

This issue was fixed in version 1.55.
CVSS Score: 7.5 (HIGH)
CWE: CWE-340
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62295
Published: 2025-11-20
Description: SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor.

This issue was fixed in version 1.55.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62296
Published: 2025-11-20
Description: SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor.

This issue was fixed in version 1.55.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62297
Published: 2025-11-20
Description: SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page.

This issue was fixed in version 1.55.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62729
Published: 2025-11-20
Description: SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages.

This issue was fixed in version 1.55.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62730
Published: 2025-11-20
Description: SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with user_manage_team role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this role to escalate to admin privileges. This issue affects both Bulk Update functionality and regular edition of user's right and privileges.

This issue was fixed in version 1.55.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62731
Published: 2025-11-20
Description: SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. By default only administrators and users with special privileges are able to access this endpoint.

This issue was fixed in version 1.55.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2025/11/CVE-2025-62293; https://www.soplanning.org/en/
CVE: CVE-2025-62875
Published: 2025-11-20
Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD.




This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62875; https://security.opensuse.org/2025/10/31/opensmtpd-local-DoS.html; http://www.openwall.com/lists/oss-security/2025/10/31/3
CVE: CVE-2025-12120
Published: 2025-11-20
Description: Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://github.com/lite-xl/lite-xl/pull/2164; https://kb.cert.org/vuls/id/579478
CVE: CVE-2025-12121
Published: 2025-11-20
Description: Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsanitized shell command construction. This function was used in project directory launching (core.lua), drag-and-drop file handling (rootview.lua), and the “open in system” command in the treeview plugin (treeview.lua). If an attacker could influence input to system.exec, they might execute arbitrary commands with the privileges of the Lite XL process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-78
References: https://github.com/lite-xl/lite-xl/pull/2163; https://kb.cert.org/vuls/id/579478
CVE: CVE-2025-13437
Published: 2025-11-20
Description: When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.
CWE: CWE-706
References: https://github.com/google/zx/issues/1348
CVE: CVE-2025-52410
Published: 2025-11-20
Description: Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is not adequately sanitized before being used in SQL queries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/mathurvishal/Institute-of-Current-Students---PHP-Project/issues/2
CVE: CVE-2025-62709
Published: 2025-11-20
Description: ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Because Host is a client-controlled header, an attacker can supply an arbitrary Host value. This allows an attacker to cause password-reset links (sent by forget.php) to be generated with the attacker’s domain. If a victim follows that link and enters their activation code on the attacker-controlled domain, the attacker can capture the code and use it to reset the victim’s password and take over the account. This issue has been patched in version 5.5.2#162.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-640
References: https://github.com/MacWarrior/clipbucket-v5/commit/1a93532e665217b5d329808ca78e37e59e9f8a9d; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-xhhf-mpqr-2cq5; https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-xhhf-mpqr-2cq5
CVE: CVE-2025-62724
Published: 2025-11-20
Description: Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-61, CWE-367
References: https://github.com/OSC/ondemand/security/advisories/GHSA-vjpg-34px-gjrw
CVE: CVE-2025-63848
Published: 2025-11-20
Description: Stored cross site scripting (xss) vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SWI-Prolog; https://github.com/coderMohammed1/CVE-2025-63848
CVE: CVE-2025-64027
Published: 2025-11-20
Description: Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cybercrewinc/CVE-2025-64027/; https://github.com/grokability/snipe-it
CVE: CVE-2025-64185
Published: 2025-11-20
Description: Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability.
CWE: CWE-277, CWE-552
References: https://github.com/OSC/ondemand/security/advisories/GHSA-r2cg-hg78-gq9p
CVE: CVE-2025-64428
Published: 2025-11-20
Description: Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/dataease/dataease/commit/b7e585c1cc3fc2b73cb289b8680b4b3914be3d53; https://github.com/dataease/dataease/releases/tag/v2.10.17; https://github.com/dataease/dataease/security/advisories/GHSA-88ph-3236-2m2h
CVE: CVE-2025-63888
Published: 2025-11-20
Description: The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://gist.github.com/Master-0-0/0bf54cbb335b586b42b0db0db804e7aa; https://www.yuque.com/lcc316/df0kgm/mglhbxltgbmzfh2s
CVE: CVE-2025-63889
Published: 2025-11-20
Description: The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://gist.github.com/Master-0-0/dd63209602f04267f1a27a75a064df26; https://www.yuque.com/lcc316/df0kgm/xqkrw5rfz5vqxo9t
CVE: CVE-2025-64524
Published: 2025-11-20
Description: cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In versions 2.0.1 and prior, a heap-buffer-overflow vulnerability in the rastertopclx filter causes the program to crash with a segmentation fault when processing maliciously crafted input data. This issue can be exploited to trigger memory corruption, potentially leading to arbitrary code execution. This issue has been patched via commit 956283c.
CVSS Score: 3.3 (LOW)
CWE: CWE-122, CWE-787
References: https://github.com/OpenPrinting/cups-filters/commit/956283c74a34ae924266a2a63f8e5f529a1abd06; https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-rq44-2q5p-x3hv; http://www.openwall.com/lists/oss-security/2025/11/20/1
CVE: CVE-2025-10571
Published: 2025-11-20
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-288
References: https://search.abb.com/library/Download.aspx?DocumentID=7PAA022088&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-55126
Published: 2025-11-20
Description: HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box at the top of advertiser-related pages, with campaign names being the vector for the stored XSS
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/3411750
CVE: CVE-2025-55127
Published: 2025-11-20
Description: HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-156
References: https://hackerone.com/reports/3413764
CVE: CVE-2025-55128
Published: 2025-11-20
Description: HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in the “userlog-index.php”. An attacker with access to the admin interface could request an arbitrarily large number of items per page, potentially leading to a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://hackerone.com/reports/3413890
CVE: CVE-2025-63700
Published: 2025-11-20
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-35029
Published: 2025-11-20
Description: Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-272-01.json; https://www.cve.org/CVERecord?id=CVE-2025-35029
CVE: CVE-2025-48986
Published: 2025-11-20
Description: Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://hackerone.com/reports/3398283; https://hackerone.com/reports/3398283
CVE: CVE-2025-48987
Published: 2025-11-20
Description: Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/3399191; https://hackerone.com/reports/3399191
CVE: CVE-2025-52666
Published: 2025-11-20
Description: Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator user to disable the admin user console due to a fatal PHP error.
CVSS Score: 2.7 (LOW)
CWE: CWE-134
References: https://hackerone.com/reports/3399218; https://hackerone.com/reports/3399218
CVE: CVE-2025-52667
Published: 2025-11-20
Description: Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/3399809
CVE: CVE-2025-52668
Published: 2025-11-20
Description: Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/3400506; https://hackerone.com/reports/3400506
CVE: CVE-2025-52669
Published: 2025-11-20
Description: Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://hackerone.com/reports/3401464; https://hackerone.com/reports/3401464
CVE: CVE-2025-52670
Published: 2025-11-20
Description: Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-862
References: https://hackerone.com/reports/3401612
CVE: CVE-2025-52671
Published: 2025-11-20
Description: Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://hackerone.com/reports/3403450; https://hackerone.com/reports/3403450
CVE: CVE-2025-55123
Published: 2025-11-20
Description: Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be able to craft XSS attacks to their own advertiser users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/3404968; https://hackerone.com/reports/3404968
CVE: CVE-2025-55124
Published: 2025-11-20
Description: Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://hackerone.com/reports/3403727; https://hackerone.com/reports/3403727
CVE: CVE-2025-25613
Published: 2025-11-20
Description: FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://fs.com; http://s3150-8t2f.com; https://github.com/SwiftSecur/S3150-8T2F-FS.com-Research/wiki
CVE: CVE-2025-62674
Published: 2025-11-20
Description: The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an attacker unauthorized access to camera configuration information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-02.json; https://icam365.net/en/aboutUs/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02
CVE: CVE-2025-63685
Published: 2025-11-20
Description: Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of [regsvr32.exe] it loads. An attacker can place a crafted malicious DLL in the application's startup directory, which will be loaded and executed when the user launches the program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-491
References: https://github.com/QIU-DIE/CVE/issues/5
CVE: CVE-2025-63807
Published: 2025-11-20
Description: An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without authentication. Successful exploitation may result in account takeover via password reset or other authentication bypass methods.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-1390
References: https://gist.github.com/Rycarl-Furry/3e93c6f0d48a29518adf341e0fc7e2dd
CVE: CVE-2025-64770
Published: 2025-11-20
Description: The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unauthorized access to camera configuration information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-324-02.json; https://icam365.net/en/aboutUs/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-02