deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14003
Published: 2025-12-15
Description: The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Author-level access and above, to add images to arbitrary Modula galleries owned by other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3414176/modula-best-grid-gallery; https://www.wordfence.com/threat-intel/vulnerabilities/id/4490afba-1487-40a4-99c6-c753acb10df3?source=cve
CVE: CVE-2025-14156
Published: 2025-12-15
Description: The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://plugins.trac.wordpress.org/changeset?old_path=%2Ffox-lms%2Ftags%2F1.0.5.0%2Fincludes%2Frest%2FPayments.php&new_path=%2Ffox-lms%2Ftags%2F1.0.5.2%2Fincludes%2Frest%2FPayments.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/de4f8d45-9522-4a32-bc98-be8dbf3a5cf1?source=cve
CVE: CVE-2025-14383
Published: 2025-12-15
Description: The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3416518/booking/trunk/includes/_capacity/capacity.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/790f93b0-eb69-473f-a726-bfe215f5d870?source=cve
CVE: CVE-2025-34179
Published: 2025-12-15
Description: NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.
CWE: CWE-89
References: https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/; https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway/; https://www.vulncheck.com/advisories/netsupport-manager-unauthenticated-sqli-local-file-disclosure
CVE: CVE-2025-34180
Published: 2025-12-15
Description: NetSupport Manager < 14.12.0001  relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed through the same key.
CWE: CWE-257
References: https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/; https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway/; https://www.vulncheck.com/advisories/netsupport-manager-gateway-key-reversible-encoding-credential-recovery
CVE: CVE-2025-34181
Published: 2025-12-15
Description: NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFILE request handler. An attacker with a valid Gateway Key can supply a crafted filename containing directory traversal sequences to write files to arbitrary locations on the server. This can be leveraged to place attacker-controlled DLLs or executables in privileged paths and achieve remote code execution in the context of the NetSupport Manager connectivity service.
CWE: CWE-22
References: https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/; https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway/; https://www.vulncheck.com/advisories/netsupport-manager-authenticated-path-traversal-arbitrary-write-rce
CVE: CVE-2025-34411
Published: 2025-12-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it identified a vulnerability in a SaaS product that does not require user action.
CVE: CVE-2025-34412
Published: 2025-12-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it identified a vulnerability in a SaaS product that does not require user action.
CVE: CVE-2024-44598
Published: 2025-12-15
Description: FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://fnt.com; https://gist.github.com/ZeroBreach-GmbH/e957dc32e72b366894565b7ff03659a4
CVE: CVE-2024-44599
Published: 2025-12-15
Description: FNT Command 13.4.0 is vulnerable to Directory Traversal.
CVSS Score: 8.3 (HIGH)
CWE: CWE-434
References: http://fnt.com; https://gist.github.com/ZeroBreach-GmbH/577755034cb5c0423fbb0bba659b915d
CVE: CVE-2025-13823
Published: 2025-12-15
Description: A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go into recoverable fault with fault code 0xFE60. To recover the controller, clear the fault.
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1766.html
CVE: CVE-2025-13824
Published: 2025-12-15
Description: A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF019. To recover, clear the fault.
CWE: CWE-763
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1766.html
CVE: CVE-2025-13888
Published: 2025-12-15
Description: A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-266
References: https://access.redhat.com/errata/RHSA-2025:23203; https://access.redhat.com/errata/RHSA-2025:23206; https://access.redhat.com/errata/RHSA-2025:23207
CVE: CVE-2025-14387
Published: 2025-12-15
Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LearnPress/learnpress/commit/3bdaa63920c7d485e7efa7c92d3f19273a2916ff; https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b3a37-436d-4d03-8818-d5267b23067b?source=cve
CVE: CVE-2025-60786
Published: 2025-12-15
Description: A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.icescrum.com/download/; https://zdaylabs.com/CVE-2025-60786.html
CVE: CVE-2025-66843
Published: 2025-12-15
Description: grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Yohane-Mashiro/grav_cve/issues/1; https://github.com/Yohane-Mashiro/grav_cve/issues/1
CVE: CVE-2025-66844
Published: 2025-12-15
Description: In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: https://github.com/Yohane-Mashiro/grav_cve/issues/2
CVE: CVE-2025-66963
Published: 2025-12-15
Description: An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://hitron.com; https://github.com/kakarotossj3/CVEs/blob/main/Hitron/Insufficient%20Session%20Expiration/Details
CVE: CVE-2025-11393
Published: 2025-12-15
Description: A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle.

This allows a standard user within the cluster to send unauthorized commands to the management platform, effectively acting with the full permissions of the cluster administrator. This could lead to unauthorized changes to the cluster's configuration or status on the Red Hat platform.
CVSS Score: 8.7 (HIGH)
CWE: CWE-441
References: https://access.redhat.com/errata/RHSA-2025:23236; https://access.redhat.com/security/cve/CVE-2025-11393; https://bugzilla.redhat.com/show_bug.cgi?id=2402032
CVE: CVE-2025-55893
Published: 2025-12-15
Description: TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/l0tk3/CVES/blob/main/CVE-2025-55893.pdf; https://www.totolink.net/
CVE: CVE-2025-55901
Published: 2025-12-15
Description: TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/l0tk3/CVES/blob/main/CVE-2025-55901.pdf; https://www.totolink.net
CVE: CVE-2025-65742
Published: 2025-12-15
Description: An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execute a full account takeover via a crafted API request.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://github.com/CBx216/CVE-2025-65742-Newgen-OmniDocs-LDAP-BFLA/blob/main/CVE-2025-65742.md; https://newgensoft.com/
CVE: CVE-2025-66434
Published: 2025-12-15
Description: An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to configure Dunning Type and its child table Dunning Letter Text can inject arbitrary Jinja expressions, resulting in server-side code execution within a restricted but still unsafe context. This can leak database information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-1336
References: https://iamanc.github.io/post/erpnext-ssti-bug-1; https://www.notion.so/SSTI-bug-1-239e6086eadc8096bfcfe90551a3a483?source=copy_link
CVE: CVE-2025-66435
Published: 2025-12-15
Description: An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Contract Template can inject arbitrary Jinja expressions into the contract_terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94, CWE-1336
References: https://iamanc.github.io/post/erpnext-ssti-bug-2; https://www.notion.so/SSTI-bug-2-239e6086eadc80878e8fcc7b6c26a584?source=copy_link
CVE: CVE-2025-14038
Published: 2025-12-15
Description: EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been remediated in EDB Hybrid Manager 1.3.3, and customers should consider upgrading to 1.3.3 as soon as possible.
The flaw is due to a misconfiguration in the Istio Gateway, which manages authentication and authorization for the affected endpoints. The security policy relies on an explicit definition of required permissions in the Istio Gateway configuration, and the affected endpoints were not defined in the configuration. This allowed requests to bypass both authentication and authorization within a Hybrid Manager service.
All versions of Hybrid Manager - LTS should be upgraded to 1.3.3, and all versions of Hybrid Manager - Innovation should be upgraded to 2025.12.
CVSS Score: 7.0 (HIGH)
CWE: CWE-306, CWE-862
References: https://www.enterprisedb.com/docs/security/advisories/cve202514038/
CVE: CVE-2025-66436
Published: 2025-12-15
Description: An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94, CWE-1336
References: https://iamanc.github.io/post/erpnext-ssti-bug-3; https://www.notion.so/SSTI-bug-3-239e6086eadc8020aeecdaf123e32f3d?source=copy_link
CVE: CVE-2025-66437
Published: 2025-12-15
Description: An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders address templates using frappe.render_template() with a context derived from the address_dict parameter, which can be either a dictionary or a string referencing an Address document. Although ERPNext uses a custom Jinja2 SandboxedEnvironment, dangerous functions like frappe.db.sql remain accessible via get_safe_globals(). An authenticated attacker with permission to create or modify an Address Template can inject arbitrary Jinja expressions into the template field. By creating an Address document with a matching country, and then calling the get_address_display API with address_dict="address_name", the system will render the malicious template using attacker-controlled data. This leads to server-side code execution or database information disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-1336
References: https://iamanc.github.io/post/erpnext-ssti-bug-4; https://www.notion.so/SSTI-bug-4-239e6086eadc80aa9331fba874c674a5?source=copy_link
CVE: CVE-2025-66438
Published: 2025-12-15
Description: A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or other exposed globals.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-1336
References: https://iamanc.github.io/post/erpnext-ssti-bug-5; https://www.notion.so/SSTI-bug-5-239e6086eadc80a48f17c1257a604d2c?source=copy_link
CVE: CVE-2025-66439
Published: 2025-12-15
Description: An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the from_posting_date parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/frappe/frappe/security; https://iamanc.github.io/post/erpnext-sqli
CVE: CVE-2025-66440
Published: 2025-12-15
Description: An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_entry.py is vulnerable to SQL Injection. It allows an attacker to extract arbitrary data from the database by injecting SQL payloads via the to_posting_date parameter, which is directly interpolated into the query without proper sanitization or parameter binding.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/frappe/frappe/security; https://iamanc.github.io/post/erpnext-sqli
CVE: CVE-2023-36337
Published: 2025-12-15
Description: A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/nguyenkhanhthuan/f345c8ea0551c10ead197680f2ba9c66; https://github.com/ThuanNguyen115685/Report/blob/main/XSS.md
CVE: CVE-2025-51962
Published: 2025-12-15
Description: A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Sunnyshineshow/vulnerability-research/blob/main/CVE-2025-51962/CVE-2025-51962.md; https://github.com/pmgl/microstudio/
CVE: CVE-2025-65176
Published: 2025-12-15
Description: An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUS_LOGON_FAILURE" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the network share while impersonating them. The exploitation of this vulnerability can allow an unprivileged attacker with access to the affected system to perform NTLM relay attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-325#oneagent-sprint-325-ga; https://docs.dynatrace.com/docs/whats-new/oneagent/sprint-325#oneagent-sprint-325-ga; https://hackerone.com/reports/3313408
CVE: CVE-2025-65213
Published: 2025-12-15
Description: MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and nan_inf_track_for_single_op() functions use pickle.load() on user-controlled file paths without validation, allowing arbitrary code execution. An attacker can craft a malicious pickle file that executes arbitrary Python code when loaded, enabling remote code execution with the privileges of the victim process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/MooreThreads/torch_musa/issues/110#issuecomment[PII_REDACTED]
CVE: CVE-2025-65835
Published: 2025-12-15
Description: The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null. If a broadcast is sent with extras present but without EXTRA_CHOSEN_COMPONENT, the code dereferences a null value and throws a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application on the device can send crafted ACTION_SEND broadcasts to this component and repeatedly crash the host application, resulting in a local, unauthenticated application-level denial of service for any app that includes the plugin.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://github.com/EddyVerbruggen/SocialSharing-PhoneGap-Plugin; https://medium.com/@lcrawfqrd/local-dos-via-exported-receivers-f6b1da10d3b7; https://www.npmjs.com/package/cordova-plugin-x-socialsharing
CVE: CVE-2025-12035
Published: 2025-12-15
Description: An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p793-3456-h7w3
CVE: CVE-2025-13489
Published: 2025-12-15
Description: IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7254662
CVE: CVE-2025-14148
Published: 2025-12-15
Description: IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.ibm.com/support/pages/node/7254663