deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-65790
Published: 2025-12-22
Description: A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline <script> element, the browser executes the attacker-controlled JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://fuguhub.com/; https://github.com/hunterxxx/FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790
CVE: CVE-2025-65837
Published: 2025-12-22
Description: PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hyperkopite/PublicCMS_Vulns/blob/main/XSS_1.md; https://github.com/sanluan/PublicCMS/issues/100; https://github.com/Hyperkopite/PublicCMS_Vulns/blob/main/XSS_1.md
CVE: CVE-2025-67290
Published: 2025-12-22
Description: A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://piranha.com; https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67290
CVE: CVE-2025-67291
Published: 2025-12-22
Description: A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://piranha.com; https://github.com/vuquyen03/CVE/tree/main/CVE-2025-67291
CVE: CVE-2025-67418
Published: 2025-12-22
Description: ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://clipbucket.com; https://medium.com/@arpit03sharma2003/cve-2025-67418-when-default-credentials-become-a-remote-root-button-03be5ee4b927
CVE: CVE-2025-65817
Published: 2025-12-22
Description: LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/Istaarkk/CVE-2025-65817/blob/main/README.md; https://github.com/Istaarkk/CVE-2025-65817/blob/main/README.md
CVE: CVE-2025-66735
Published: 2025-12-22
Description: youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleController.java does not perform permission checks, which may allow non-root users to directly access root roles.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-862
References: https://gist.github.com/old6ma/dc9e6e4a693d12c1a35fd4e1d21d4743; https://gitee.com/youlaiorg/youlai-boot/commit/[PII_REDACTED]f92264ded814a9d3e9f2a4ff0da121; https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FR
CVE: CVE-2025-66736
Published: 2025-12-22
Description: youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The importUsers function in SysUserController.java does not perform a permission check on the current user's identity, which may allow regular users to import user data into the database, resulting in an authorization bypass vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284, CWE-862
References: https://gist.github.com/old6ma/be1d4a5373ee2de901ed4c8d81485046; https://gitee.com/youlaiorg/youlai-boot/commit/[PII_REDACTED]f92264ded814a9d3e9f2a4ff0da121; https://gitee.com/youlaiorg/youlai-boot/issues/ICH8FV
CVE: CVE-2021-47713
Published: 2025-12-22
Description: Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields. Attackers can send repeated requests with extremely long query strings and multiple threads to consume server resources and potentially crash the GraphQL endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/hasura/graphql-engine; https://www.exploit-db.com/exploits/49789; https://www.vulncheck.com/advisories/hasura-graphql-denial-of-service-via-malicious-graphql-query
CVE: CVE-2021-47714
Published: 2025-12-22
Description: Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/hasura/graphql-engine; https://www.exploit-db.com/exploits/49790; https://www.vulncheck.com/advisories/hasura-graphql-local-file-read-via-sql-injection
CVE: CVE-2021-47715
Published: 2025-12-22
Description: Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/hasura/graphql-engine; https://www.exploit-db.com/exploits/49791; https://www.vulncheck.com/advisories/hasura-graphql-server-side-request-forgery-via-remote-schema-injection
CVE: CVE-2022-50687
Published: 2025-12-22
Description: Cobian Backup 11 Gravity 11.2.0.582 contains a denial of service vulnerability in the FTP password input field that allows attackers to crash the application. Attackers can generate a specially crafted 800-byte buffer and paste it into the password field to trigger an application crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.cobiansoft.com/; https://www.exploit-db.com/exploits/50790; https://www.vulncheck.com/advisories/cobian-backup-gravity-local-denial-of-service-via-password-field
CVE: CVE-2022-50688
Published: 2025-12-22
Description: Cobian Backup Gravity 11.2.0.582 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path in the CobianBackup11 service to inject malicious code that would execute with LocalSystem privileges during service startup.
CVSS Score: 8.4 (HIGH)
CWE: CWE-428
References: https://www.cobiansoft.com/; https://www.exploit-db.com/exploits/50791; https://www.vulncheck.com/advisories/cobian-backup-gravity-unquoted-service-path-privilege-escalation
CVE: CVE-2022-50689
Published: 2025-12-22
Description: Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the password input field. Attackers can paste a large 8000-byte buffer into the password field to trigger an application crash during SFTP task configuration.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-120
References: https://www.cobiansoft.com/; https://www.exploit-db.com/exploits/50789; https://www.vulncheck.com/advisories/cobian-reflector-rc-local-denial-of-service-via-password-field
CVE: CVE-2022-50690
Published: 2025-12-22
Description: Wondershare MirrorGo 2.0.11.346 contains a local privilege escalation vulnerability due to incorrect file permissions on executable files. Unprivileged local users can replace the ElevationService.exe with a malicious file to execute arbitrary code with LocalSystem privileges.
CVSS Score: 8.4 (HIGH)
CWE: CWE-732
References: https://www.exploit-db.com/exploits/50787; https://www.vulncheck.com/advisories/wondershare-mirrorgo-local-privilege-escalation-via-insecure-file-permissions; https://www.wondershare.com/
CVE: CVE-2023-53955
Published: 2025-12-22
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51169; https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-authorization-bypass-via-insecure-object-references
CVE: CVE-2023-53960
Published: 2025-12-22
Description: SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the 'password' POST parameter to bypass authentication and potentially gain unauthorized access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51171; https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-sql-injection-via-authentication-bypass
CVE: CVE-2023-53961
Published: 2025-12-22
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the radio processing interface, triggering unintended administrative operations when a logged-in user visits the page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51168; https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-cross-site-request-forgery
CVE: CVE-2023-53962
Published: 2025-12-22
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the 'upgfile' parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to write files to unintended system locations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51172; https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-directory-traversal-file-write
CVE: CVE-2023-53963
Published: 2025-12-22
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51173; https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection
CVE: CVE-2023-53964
Published: 2025-12-22
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51174; https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-factory-reset-vulnerability
CVE: CVE-2023-53965
Published: 2025-12-22
Description: SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.
CVSS Score: 8.4 (HIGH)
CWE: CWE-428
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51167; https://www.vulncheck.com/advisories/sound-server-service-local-privilege-escalation-via-unquoted-service-path
CVE: CVE-2023-53966
Published: 2025-12-22
Description: SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://web.archive.org/web/[PII_REDACTED]4555/https://www.sound4.com/; https://www.exploit-db.com/exploits/51259; https://www.vulncheck.com/advisories/sound-linkandshare-transmitter-format-string-stack-buffer-overflow
CVE: CVE-2023-53967
Published: 2025-12-22
Description: Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the current credentials. Attackers can exploit the userManager.cgx API endpoint by sending a crafted POST request with a new MD5-hashed password to directly modify the admin account's authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.dbbroadcast.com; https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/; https://www.exploit-db.com/exploits/51458
CVE: CVE-2023-53968
Published: 2025-12-22
Description: Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.dbbroadcast.com; https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/; https://www.exploit-db.com/exploits/51457
CVE: CVE-2023-53969
Published: 2025-12-22
Description: Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.dbbroadcast.com; https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/; https://www.exploit-db.com/exploits/51456
CVE: CVE-2023-53970
Published: 2025-12-22
Description: Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with manipulated session parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.dbbroadcast.com; https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/; https://www.exploit-db.com/exploits/51459
CVE: CVE-2023-53971
Published: 2025-12-22
Description: WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://sourceforge.net/projects/webtareas/; https://www.exploit-db.com/exploits/51089; https://www.vulncheck.com/advisories/webtareas-authenticated-remote-code-execution-via-file-upload
CVE: CVE-2023-53972
Published: 2025-12-22
Description: WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://sourceforge.net/projects/webtareas/; https://www.exploit-db.com/exploits/51087; https://www.vulncheck.com/advisories/webtareas-unauthenticated-sql-injection-via-session-cookie-parameter
CVE: CVE-2023-53973
Published: 2025-12-22
Description: Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorized system locations using the quarantine module. Attackers can leverage symbolic link techniques to restore quarantined files to restricted directories, potentially enabling system-level access through techniques like DLL hijacking.
CVSS Score: 8.4 (HIGH)
CWE: CWE-59, CWE-59
References: https://www.exploit-db.com/exploits/51151; https://www.vulncheck.com/advisories/zillya-total-security-local-privilege-escalation-via-quarantine-module; https://zillya.com/
CVE: CVE-2023-53974
Published: 2025-12-22
Description: D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing sensitive network credentials and system configurations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://dlinkmea.com/index.php/product/details?det=dU1iNFc4cWRsdUpjWEpETFlSeFlZdz09; https://www.dlink.com; https://www.exploit-db.com/exploits/51129
CVE: CVE-2023-53975
Published: 2025-12-22
Description: Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/thedigicraft/Atom.CMS; https://www.exploit-db.com/exploits/51086; https://www.vulncheck.com/advisories/atom-cms-unauthenticated-sql-injection-via-admin-index-page
CVE: CVE-2023-53976
Published: 2025-12-22
Description: myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject malicious scripts when creating new templates. Attackers can exploit this vulnerability by inserting script payloads in the template title field when adding new templates through the 'Templates and Style' > 'Templates' > 'Manage Templates' > 'Global Templates' interface, causing arbitrary JavaScript to execute when the template is viewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mybb.com/; https://www.exploit-db.com/exploits/51136; https://www.vulncheck.com/advisories/mybb-forums-stored-cross-site-scripting-via-template-management
CVE: CVE-2023-53977
Published: 2025-12-22
Description: myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when adding new forums through the 'Forums and Posts' > 'Forum Management' interface, causing arbitrary JavaScript to execute when the forum listing is viewed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mybb.com/; https://www.exploit-db.com/exploits/51136; https://www.vulncheck.com/advisories/mybb-forums-stored-cross-site-scripting-via-forum-management
CVE: CVE-2023-53978
Published: 2025-12-22
Description: myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject malicious scripts when creating announcements. Attackers can exploit this vulnerability by inserting script payloads in the announcement title field when adding announcements through the 'Forums and Posts' > 'Forum Announcements' interface, causing arbitrary JavaScript to execute when the announcement is displayed on the forum.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mybb.com/; https://www.exploit-db.com/exploits/51136; https://www.vulncheck.com/advisories/mybb-forums-stored-cross-site-scripting-via-forum-announcements
CVE: CVE-2023-53979
Published: 2025-12-22
Description: MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbitrary code. Attackers can modify upload path settings, upload a malicious PHP-embedded image file, and execute commands through the language configuration editing interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://fdlucifer.github.io/2023/01/17/mybb1-8-32-LFI-RCE/; https://mybb.com/; https://www.exploit-db.com/exploits/51213
CVE: CVE-2023-53980
Published: 2025-12-22
Description: ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/51238; https://www.projectsend.org/; https://www.vulncheck.com/advisories/projectsend-remote-code-execution-via-file-extension-manipulation
CVE: CVE-2023-53981
Published: 2025-12-22
Description: PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through the exiftran path configuration. Attackers can exploit the ffmpeg configuration settings by base64 encoding a reverse shell command and executing it through a crafted video upload process.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/thibaud-rohmer/PhotoShow; https://lscp.llc/index.php/2021/07/19/how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0/; https://www.exploit-db.com/exploits/51236
CVE: CVE-2025-34457
Published: 2025-12-22
Description: wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a terminating FEND byte without reserving sufficient space in the stack buffer. This results in an out-of-bounds write followed by an out-of-bounds read during the subsequent call to kiss_unwrap(), leading to stack memory corruption or application crashes. This vulnerability may allow remote unauthenticated attackers to trigger a denial-of-service condition.
CWE: CWE-121
References: https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-010-direwolf-stack-buffer-overflow-kiss-frame.md; https://github.com/wb2osz/direwolf/commit/694c954; https://github.com/wb2osz/direwolf/issues/617