deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-64753
Published: 2025-11-13
Description: grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the user was not supposed to have read access. This was fixed in version 1.7.7 by restricting the `/compare` endpoint to users with full read access. As a workaround, remove sensitive document history using the `/states/remove` endpoint. Another possibility is to block the `/compare` endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/gristlabs/grist-core/releases/tag/v1.7.7; https://github.com/gristlabs/grist-core/security/advisories/GHSA-3v78-cw58-v685
CVE: CVE-2025-64754
Published: 2025-11-13
Description: Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
CWE: CWE-601
References: https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78
CVE: CVE-2025-64530
Published: 2025-11-13
Description: Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorrectly allowed user-defined access control directives on interface types/fields, which could be bypassed by instead querying the implementing object types/fields in Apollo Router via inline fragments, for example. A fix to versions 2.9.5, 2.10.4, 2.11.5, and 2.12.1 of composition logic in Federation now disallows interfaces types and fields to contain user-defined access control directives. Some workarounds are available. Users of Apollo Rover with an unpatched composition version or are using the Apollo Studio build pipeline with Federation version 2.8 or below should manually copy the access control requirements on interface types/fields to each implementing object type/field where appropriate. Do not remove those access control requirements from the interface types/fields, as unpatched Apollo Composition will not automatically generate them in the supergraph schema. Customers not using Apollo Router access control features (`@authenticated`, `@requiresScopes`, or `@policy` directives) or not specifying access control requirements on interface types/fields are not affected and do not need to take action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://github.com/apollographql/federation/security/advisories/GHSA-mx7m-j9xf-62hw
CVE: CVE-2024-11919
Published: 2025-11-14
Description: Inappropriate implementation in Intents in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/352516283
CVE: CVE-2024-11920
Published: 2025-11-14
Description: Inappropriate implementation in Dawn in Google Chrome on Mac prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html; https://issues.chromium.org/issues/371840056
CVE: CVE-2024-13178
Published: 2025-11-14
Description: Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html; https://issues.chromium.org/issues/40068607
CVE: CVE-2024-13983
Published: 2025-11-14
Description: Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Chromium security severity: Low)
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601
References: https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html; https://issues.chromium.org/issues/379818904
CVE: CVE-2024-7017
Published: 2025-11-14
Description: Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/338248595
CVE: CVE-2024-7021
Published: 2025-11-14
Description: Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-desktop_16.html; https://issues.chromium.org/issues/40064701
CVE: CVE-2024-9126
Published: 2025-11-14
Description: Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a series of curated UI gestures. (Chromium security severity: Medium)
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html; https://issues.chromium.org/issues/349653218
CVE: CVE-2025-12904
Published: 2025-11-14
Description: The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and including, 0.4.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3392176/h5pxapikatchu; https://www.wordfence.com/threat-intel/vulnerabilities/id/90552d5a-6103-48c7-ad44-52ee8ecac114?source=cve
CVE: CVE-2025-13097
Published: 2025-11-14
Description: Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html; https://issues.chromium.org/issues/402791076
CVE: CVE-2025-13102
Published: 2025-11-14
Description: Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/351564774
CVE: CVE-2025-13107
Published: 2025-11-14
Description: Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/429440615
CVE: CVE-2025-9479
Published: 2025-11-14
Description: Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_25.html; https://issues.chromium.org/issues/390743124
CVE: CVE-2025-13160
Published: 2025-11-14
Description: IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access specific APIs to obtain sensitive information from the internal network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://www.twcert.org.tw/en/cp-139-10502-11c6d-2.html; https://www.twcert.org.tw/tw/cp-132-10501-a25a6-1.html
CVE: CVE-2025-13161
Published: 2025-11-14
Description: IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-10502-11c6d-2.html; https://www.twcert.org.tw/tw/cp-132-10501-a25a6-1.html
CVE: CVE-2025-10686
Published: 2025-11-14
Description: The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/27d58c5a-ab87-41aa-a806-53fa96d4351c/
CVE: CVE-2025-64444
Published: 2025-11-14
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS command with root privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/jp/JVN49899607/; https://support.sonynetwork.co.jp/faqsupport/manoma/web/knowledge11157.html
CVE: CVE-2025-11776
Published: 2025-11-14
Description: Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-41436
Published: 2025-11-14
Description: Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2025-55070
Published: 2025-11-14
Description: Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://mattermost.com/security-updates
CVE: CVE-2025-55073
Published: 2025-11-14
Description: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-306
References: https://mattermost.com/security-updates
CVE: CVE-2025-11794
Published: 2025-11-14
Description: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates
CVE: CVE-2025-11981
Published: 2025-11-14
Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks.php#L1844; https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks.php#L1872; https://plugins.trac.wordpress.org/changeset/3389346#file62
CVE: CVE-2025-8855
Published: 2025-11-14
Description: Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.This issue affects Brokerage Automation: before 1.1.71.
CVSS Score: 8.1 (HIGH)
CWE: CWE-302, CWE-639, CWE-640
References: https://www.usom.gov.tr/bildirim/tr-25-0396
CVE: CVE-2025-10018
Published: 2025-11-14
Description: QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/11/CVE-2025-9982; https://opensolution.org/cms-system-quick-cms.html
CVE: CVE-2025-11918
Published: 2025-11-14
Description: Rockwell Automation Arena® suffers from a
stack-based buffer overflow vulnerability. The specific flaw exists within the
parsing of DOE files. Local attackers are able to exploit this issue to
potentially execute arbitrary code on affected installations of Arena®. Exploiting
the vulnerability requires opening a malicious DOE file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-121
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1763.html
CVE: CVE-2025-12149
Published: 2025-11-14
Description: In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule is not enforced, allowing access to all documents in the queried indices.
CWE: CWE-200, CWE-863
References: https://docs.search-guard.com/latest/changelog-searchguard-flx-3_1_3; https://docs.search-guard.com/latest/changelog-searchguard-flx-4_0_0; https://search-guard.com/cve-advisory/
CVE: CVE-2025-9982
Published: 2025-11-14
Description: A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege escalation.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-256
References: https://cert.pl/posts/2025/11/CVE-2025-9982; https://opensolution.org/cms-system-quick-cms.html
CVE: CVE-2024-21635
Published: 2025-11-14
Description: Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update their password. In versions up to and including 0.18.1, though, the bad actor will still have access to their account because the bad actor's Access Token stays on the list as a valid token. The user will have to manually delete the bad actor's Access Token to secure their account. The list of Access Tokens has a generic Description which makes it hard to pinpoint a bad actor in a list of Access Tokens. A known patched version of Memos isn't available. To improve Memos security, all Access Tokens will need to be revoked when a user changes their password. This removes the session for all the user's devices and prompts the user to log in again. One can treat the old Access Tokens as "invalid" because those Access Tokens were created with the older password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://github.com/usememos/memos/security/advisories/GHSA-mr34-8733-grr2; https://github.com/usememos/memos/security/advisories/GHSA-mr34-8733-grr2
CVE: CVE-2025-13168
Published: 2025-11-14
Description: A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This manipulation of the argument search_term causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Upgrading to version 0.2.1 is able to mitigate this issue. Patch name: 063384e0dddfd191847cd2d6524c342cc380b058. It is suggested to upgrade the affected component. The vendor replied and reacted very professional.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ictrun/ury-vulns/blob/main/README.md; https://github.com/ictrun/ury-vulns/blob/main/README.md#verification-steps; https://github.com/ury-erp/ury/commit/063384e0dddfd191847cd2d6524c342cc380b058
CVE: CVE-2024-42749
Published: 2025-11-14
Description: Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/altocms/altocms; https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-42749.md
CVE: CVE-2024-44630
Published: 2025-11-14
Description: Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname, ocp, nation, mobno, email, board1, roll1, pyear1, board2, roll2, pyear2, sub1,marks1, sub2, course-short, income, category, ph, country, state, city, padd, cadd, and gender.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44630.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-44632
Published: 2025-11-14
Description: PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44632.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-44633
Published: 2025-11-14
Description: PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44633.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-44635
Published: 2025-11-14
Description: PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44635.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-44636
Published: 2025-11-14
Description: PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-44639
Published: 2025-11-14
Description: PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44639.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-44640
Published: 2025-11-14
Description: PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44640.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2024-55016
Published: 2025-11-14
Description: PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-55016.md; https://phpgurukul.com/student-record-system-php
CVE: CVE-2025-13169
Published: 2025-11-14
Description: A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /add_query_reserve.php. Such manipulation of the argument room_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/hanshi-798/CVE/blob/main/tmp72/report.md; https://vuldb.com/?ctiid.332457
CVE: CVE-2025-13170
Published: 2025-11-14
Description: A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/edit_account.php. Performing a manipulation of the argument admin_id results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/pfdlyy/CVE/issues/1; https://vuldb.com/?ctiid.332458
CVE: CVE-2025-64446
Published: 2025-11-14
Description: A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23
References: https://fortiguard.fortinet.com/psirt/FG-IR-25-910; https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-64446
CVE: CVE-2025-8870
Published: 2025-11-14
Description: On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-248
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22811-security-advisory-0125
CVE: CVE-2025-12897
Published: 2025-11-14
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.