deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2752
Published: 2025-03-25
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fast_atoreal_move in the library include/assimp/fast_atof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://github.com/assimp/assimp/issues/6013; https://github.com/assimp/assimp/issues/6013#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300857
CVE: CVE-2024-13690
Published: 2025-03-25
Description: The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: http://plugins.svn.wordpress.org/wp-church-donation/tags/1.7/includes/church-donation-form-display.php; http://plugins.svn.wordpress.org/wp-church-donation/tags/1.7/includes/church-donation-listings.php; https://wordpress.org/plugins/wp-church-donation/
CVE: CVE-2024-13710
Published: 2025-03-25
Description: The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebud_settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/estatebud-properties-listings/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c43f4c91-329d-46b9-b2c8-f35e5baa38d7?source=cve
CVE: CVE-2024-13731
Published: 2025-03-25
Description: The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?old_path=/alert-box-block/tags/1.1.3&new_path=/alert-box-block/tags/1.1.4&sfp_email=&sfph_mail=; https://wordpress.org/plugins/alert-box-block/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d63cd13e-4a16-483f-8165-6c8090ceebab?source=cve
CVE: CVE-2025-2319
Published: 2025-03-25
Description: The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTS_menu' function. This makes it possible for unauthenticated attackers to execute code on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Version 5.25.10 adds a nonce check, which makes this vulnerability exploitable by admins only.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/elisqlreports/tags/4..11.13/index.php; https://plugins.trac.wordpress.org/browser/elisqlreports/tags/4..11.15/index.php; https://plugins.trac.wordpress.org/browser/elisqlreports/tags/4..11.33/index.php
CVE: CVE-2025-2510
Published: 2025-03-25
Description: The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/frndzk-expandable-bottom-bar/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/4261c81e-13a2-4022-8048-aeb0ea4e9ee4?source=cve
CVE: CVE-2025-2559
Published: 2025-03-25
Description: A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-770
References: https://access.redhat.com/errata/RHSA-2025:4335; https://access.redhat.com/errata/RHSA-2025:4336; https://access.redhat.com/security/cve/CVE-2025-2559
CVE: CVE-2025-2753
Published: 2025-03-25
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as critical. Affected is the function SceneCombiner::MergeScenes of the file code/AssetLib/LWS/LWSLoader.cpp of the component LWS File Handler. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://github.com/assimp/assimp/issues/6014; https://github.com/assimp/assimp/issues/6014#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300858
CVE: CVE-2025-2754
Published: 2025-03-25
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been declared as critical. Affected by this vulnerability is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument it leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/issues/6015; https://github.com/assimp/assimp/issues/6015#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300859
CVE: CVE-2025-2755
Published: 2025-03-25
Description: A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument src.entries leads to out-of-bounds read. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://github.com/assimp/assimp/issues/6017; https://github.com/assimp/assimp/issues/6017#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300860
CVE: CVE-2024-53678
Published: 2025-03-25
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache VCL. Users can modify form data submitted when requesting a new Block Allocation such that a SELECT SQL statement is modified. The data returned by the SELECT statement is not viewable by the attacker.

This issue affects all versions of Apache VCL from 2.2 through 2.5.1.

Users are recommended to upgrade to version 2.5.2, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://lists.apache.org/thread/2bmjnzgjwwq59nv6xw44w0tnpz4k4pf4; http://www.openwall.com/lists/oss-security/2025/03/24/1
CVE: CVE-2024-53679
Published: 2025-03-25
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache VCL in the User Lookup form. A user with sufficient rights to be able to view this part of the site can craft a URL or be tricked in to clicking a URL that will give a specified user elevated rights.



This issue affects all versions of Apache VCL through 2.5.1.



Users are recommended to upgrade to version 2.5.2, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread/bq5vs0hndt9cz9b6rpfr5on1nd4qrmyr; http://www.openwall.com/lists/oss-security/2025/03/24/2
CVE: CVE-2025-2542
Published: 2025-03-25
Description: The Your Simple SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/your-simple-svg-support/tags/1.0.0/your-simple-svg-support.php#L16; https://plugins.trac.wordpress.org/browser/your-simple-svg-support/tags/1.0.0/your-simple-svg-support.php#L20; https://plugins.trac.wordpress.org/changeset/3259951/
CVE: CVE-2025-2635
Published: 2025-03-25
Description: The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/digital-license-manager/trunk/includes/ListTables/Activations.php#L476; https://plugins.trac.wordpress.org/changeset/3260900/; https://wordpress.org/plugins/digital-license-manager/#developers
CVE: CVE-2025-2756
Published: 2025-03-25
Description: A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument tmp leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/issues/6018; https://github.com/assimp/assimp/issues/6018#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300861
CVE: CVE-2025-2757
Published: 2025-03-25
Description: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/assimp/assimp/issues/6019; https://github.com/assimp/assimp/issues/6019#issue[PII_REDACTED]; https://vuldb.com/?ctiid.300862
CVE: CVE-2025-2109
Published: 2025-03-25
Description: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/wp-compress-core.php#L994; https://plugins.trac.wordpress.org/changeset/3254259/; https://wordpress.org/plugins/wp-compress-image-optimizer/#developers
CVE: CVE-2022-1804
Published: 2025-03-25
Description: accountsservice no longer drops permissions when writting .pam_environment
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250; https://ubuntu.com/security/notices/USN-5439-1
CVE: CVE-2024-10037
Published: 2025-03-25
Description: A vulnerability exists in the RTU500 web server component that can cause a denial of service to the RTU500 CMU application if a specially crafted message sequence is executed on a WebSocket connection.
An attacker must be properly authenticated and the test mode function of RTU500 must be enabled to exploit this vulnerability.

The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-476
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE: CVE-2024-11499
Published: 2025-03-25
Description: A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to perform a CMU restart. The vulnerability can be triggered if certificates are updated while in use on active connections.

The affected CMU will automatically recover itself if an attacker successfully exploits this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE: CVE-2024-12169
Published: 2025-03-25
Description: A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to restart the affected CMU. This vulnerability only applies, if secure communication using IEC 62351-3 (TLS) is enabled.
CVSS Score: 6.5 (MEDIUM)
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE: CVE-2025-1445
Published: 2025-03-25
Description: A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active.

Precondition is that IEC61850 as client or server are configured using TLS on RTU500 device. It affects the CMU the IEC61850 stack is configured on.
CVSS Score: 7.5 (HIGH)
CWE: CWE-820
References: https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE: CVE-2025-27631
Published: 2025-03-25
Description: The TRMTracker web application is vulnerable to LDAP injection attack potentially allowing an attacker to inject code into a query and execute remote commands that can read and update data on the website.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-90
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-27632
Published: 2025-03-25
Description: A Host Header Injection vulnerability in TRMTracker application may allow an attacker by modifying the host header value in an HTTP request to leverage multiple attack vectors, including defacing the site content through web-cache poisoning.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-644
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-27633
Published: 2025-03-25
Description: The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://publisher.hitachienergy.com/preview?DocumentID=8DBD000210&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-29932
Published: 2025-03-25
Description: In JetBrains GoLand before 2025.1 an XXE during debugging was possible
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-611
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-42533
Published: 2025-03-25
Description: SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitrary code via the GEST_LOGIN parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8; https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8
CVE: CVE-2025-22230
Published: 2025-03-25
Description: VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-288
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25518
CVE: CVE-2025-29635
Published: 2025-03-25
Description: A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md; https://www.akamai.com/blog/security-research/2026/apr/cve-2025-29635-mirai-campaign-targets-d-link-devices; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-29635
CVE: CVE-2025-30091
Published: 2025-03-25
Description: In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.
CWE: CWE-96
References: https://www.moxiemanager.com/changelog/; https://www.moxiemanager.com/documentation/SEC-1063.php
CVE: CVE-2024-55604
Published: 2025-03-25
Description: Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to development information of a workspace. Datasources are such a component in a workspace. Yet, in versions of Appsmith prior to 1.51, app viewers are able to get a list of datasources in a workspace they're a member of. This information disclosure does NOT expose sensitive data in the datasources, such as database passwords and API Keys. The attacker needs to have been invited to a workspace as a "viewer", by someone in that workspace with access to invite. The attacker then needs to be able to signup/login to that Appsmith instance. The issue is patched in version 1.51. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280
References: https://github.com/appsmithorg/appsmith/security/advisories/GHSA-794x-gm8v-2wj6
CVE: CVE-2025-26742
Published: 2025-03-25
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo feed-instagram-lite allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through <= 1.0.0.35.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/feed-instagram-lite/vulnerability/wordpress-gallery-for-social-photo-plugin-1-0-0-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27147
Published: 2025-03-25
Description: The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deployment, VMWare ESX host remote inventory, and data collection (files, Windows registry, WMI). Versions prior to 1.5.0 have an improper access control vulnerability. Version 1.5.0 fixes the vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-22, CWE-73, CWE-552
References: https://github.com/glpi-project/glpi-inventory-plugin/commit/aaeb26d98d07019375c25b56e60fffc195553545; https://github.com/glpi-project/glpi-inventory-plugin/security/advisories/GHSA-h6x9-jm98-cw7c
CVE: CVE-2025-2530
Published: 2025-03-25
Description: Luxion KeyShot DAE File Parsing Access of Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of dae files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23698.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-25-173/
CVE: CVE-2025-2531
Published: 2025-03-25
Description: Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of dae files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23704.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-174/
CVE: CVE-2025-2532
Published: 2025-03-25
Description: Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of usdc files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23709.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-25-175/
CVE: CVE-2025-30212
Published: 2025-03-25
Description: Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 14.89.0 and 15.51.0 which could allow a malicious actor to access sensitive information. Versions 14.89.0 and 15.51.0 fix the issue. Upgrading is required; no other workaround is present.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/frappe/frappe/commit/27f13437db161a173137d91cd07d0f9287d7c556; https://github.com/frappe/frappe/commit/2ebd88520ecfa9bb7d3392b7de8c8f94a86ec05c; https://github.com/frappe/frappe/security/advisories/GHSA-3hj6-r5c9-q8f3
CVE: CVE-2025-30213
Published: 2025-03-25
Description: Frappe is a full-stack web application framework. Prior to versions 14.91.0 and 15.52.0, a system user was able to create certain documents in a specific way that could lead to remote code execution. Versions 14.9.1 and 15.52.0 contain a patch for the vulnerability. There's no workaround; an upgrade is required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/frappe/frappe/security/advisories/GHSA-v342-4xr9-x3q3