deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6139
Published: 2025-06-16
Description: A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.9 (LOW)
CWE: CWE-255, CWE-259
References: https://candle-throne-f75.notion.site/TOTOLINK-T10-shadow-20ddf0aa118580f5a455cd5dbc521472; https://vuldb.com/?ctiid.312608; https://vuldb.com/?id.312608
CVE: CVE-2025-27587
Published: 2025-06-16
Description: OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-385
References: https://github.com/openssl/openssl/issues/24253; https://minerva.crocs.fi.muni.cz
CVE: CVE-2025-43200
Published: 2025-06-16
Description: This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
CVSS Score: 4.2 (MEDIUM)
References: https://support.apple.com/en-us/122173; https://support.apple.com/en-us/122174; https://support.apple.com/en-us/122345
CVE: CVE-2025-6140
Published: 2025-06-16
Description: A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/pattern_formatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.2 is able to address this issue. The identifier of the patch is 10320184df1eb4638e253a34b1eb44ce78954094. It is recommended to upgrade the affected component.
CVSS Score: 3.3 (LOW)
CWE: CWE-400, CWE-404
References: https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094; https://github.com/gabime/spdlog/issues/3360; https://github.com/gabime/spdlog/issues/3360#issuecomment[PII_REDACTED]
CVE: CVE-2025-6141
Published: 2025-06-16
Description: A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-121
References: https://invisible-island.net/ncurses/NEWS.html#index-t20250329; https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html; https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html
CVE: CVE-2025-6142
Published: 2025-06-16
Description: A vulnerability was found in Intera InHire up to 20250530. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument 29chcotoo9 leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://drive.google.com/file/d/1-doSYzFeLaKtd_b6RmpBtZ5qtsvu4gYI/view?usp=sharing; https://vuldb.com/?ctiid.312613; https://vuldb.com/?id.312613
CVE: CVE-2025-48992
Published: 2025-06-16
Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-87
References: https://github.com/Intermesh/groupoffice/commit/2e3695db9cdef1da7a9d754ff4d98f49f6924e2d; https://github.com/Intermesh/groupoffice/security/advisories/GHSA-j35g-q5mc-jwgp
CVE: CVE-2025-6143
Published: 2025-06-16
Description: A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/13.md; https://vuldb.com/?ctiid.312618; https://vuldb.com/?id.312618
CVE: CVE-2025-6144
Published: 2025-06-16
Description: A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/688/1.md; https://github.com/awindog/cve/blob/main/688/1.md#poc; https://vuldb.com/?ctiid.312619
CVE: CVE-2025-6145
Published: 2025-06-16
Description: A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/688/2.md; https://github.com/awindog/cve/blob/main/688/2.md#poc; https://vuldb.com/?ctiid.312620
CVE: CVE-2025-6146
Published: 2025-06-17
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been classified as critical. This affects an unknown part of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/3.md; https://github.com/Lena-lyy/cve/blob/main/3.md#poc; https://vuldb.com/?ctiid.312621
CVE: CVE-2025-48993
Published: 2025-06-17
Description: Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Intermesh/groupoffice/commit/1e2a2450f204174f87a93217838d74718996dcdd; https://github.com/Intermesh/groupoffice/commit/a9031884f6a6fbd0f08a8b7790514b5bc0937c11; https://github.com/Intermesh/groupoffice/security/advisories/GHSA-xv2x-v374-92gv
CVE: CVE-2025-6147
Published: 2025-06-17
Description: A vulnerability was found in TOTOLINK A702R 4.0.0-B20[PII_REDACTED]. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/4.md; https://github.com/Lena-lyy/cve/blob/main/4.md#poc; https://vuldb.com/?ctiid.312622
CVE: CVE-2025-6148
Published: 2025-06-17
Description: A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20[PII_REDACTED]. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/5.md; https://github.com/Lena-lyy/cve/blob/main/5.md#poc; https://vuldb.com/?ctiid.312623
CVE: CVE-2025-6149
Published: 2025-06-17
Description: A vulnerability classified as critical has been found in TOTOLINK A3002R 4.0.0-B20[PII_REDACTED]. Affected is an unknown function of the file /boafrm/formSysLog of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/6.md; https://github.com/Lena-lyy/cve/blob/main/6.md#poc; https://vuldb.com/?ctiid.312624
CVE: CVE-2025-6150
Published: 2025-06-17
Description: A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/688/7.md; https://github.com/Lena-lyy/cve/blob/main/688/7.md#poc; https://vuldb.com/?ctiid.312625
CVE: CVE-2025-6151
Published: 2025-06-17
Description: A vulnerability has been found in 
TP-Link TL-WR940N V4 and TL-WR841N V11. Affected by this issue is some unknown 
functionality of the file /userRpm/WanSlaacCfgRpm.htm, which may lead to buffer overflow. The attack may be 
launched remotely. This vulnerability only affects products that are no longer 
supported by the maintainer.
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/WhereisDoujo/CVE/issues/7; https://vuldb.com/?ctiid.312626; https://vuldb.com/?id.312626
CVE: CVE-2025-3774
Published: 2025-06-17
Description: The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wise-chat/tags/3.3.3/src/admin/WiseChatKicksTab.php#L11; https://www.wordfence.com/threat-intel/vulnerabilities/id/34fd5045-cd38-4eab-9e97-98f1e3d7423a?source=cve
CVE: CVE-2025-4775
Published: 2025-06-17
Description: The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ajax-load-more/tags/7.3.1.2/build/frontend/ajax-load-more.min.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/614bdce2-bd87-4516-b1a5-028ffc08b238?source=cve
CVE: CVE-2025-5673
Published: 2025-06-17
Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter in all versions up to, and including, 8.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/blog2social/tags/8.4.4/includes/PRG/Post/Item.php#L50; https://www.wordfence.com/threat-intel/vulnerabilities/id/65b48fc0-27fd-4a37-afb8-2213ca0d4746?source=cve
CVE: CVE-2025-6152
Published: 2025-06-17
Description: A vulnerability, which was classified as critical, was found in Steel Browser up to 0.1.3. This affects the function handleFileUpload of the file api/src/modules/files/files.routes.ts. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The patch is named 7ba93a10000fb77ee01731478ef40551a27bd5b9. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/steel-dev/steel-browser/commit/7ba93a10000fb77ee01731478ef40551a27bd5b9; https://github.com/steel-dev/steel-browser/issues/129; https://github.com/steel-dev/steel-browser/issues/129#issuecomment[PII_REDACTED]
CVE: CVE-2024-21856
Published: 2025-06-17
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2024.
CVE: CVE-2024-43422
Published: 2025-06-17
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2024.
CVE: CVE-2024-45065
Published: 2025-06-17
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2024.
CVE: CVE-2024-45069
Published: 2025-06-17
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2024.
CVE: CVE-2024-45380
Published: 2025-06-17
Description: Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2024.
CVE: CVE-2025-49823
Published: 2025-06-17
Description: (conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action. This issue has been patched in version 3.11.3.
CVSS Score: 0.0 (NONE)
CWE: CWE-77
References: https://github.com/conda/constructor/commit/ce4c2d58cfcde2f62d038fb8aba013176c77a0b1; https://github.com/conda/constructor/security/advisories/GHSA-44q9-rg2q-5g99
CVE: CVE-2025-6153
Published: 2025-06-17
Description: A vulnerability has been found in PHPGurukul Hostel Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/students.php. The manipulation of the argument search_box leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.312628
CVE: CVE-2025-6154
Published: 2025-06-17
Description: A vulnerability was found in PHPGurukul Hostel Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /includes/login.inc.php. The manipulation of the argument student_roll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.312629
CVE: CVE-2025-6155
Published: 2025-06-17
Description: A vulnerability was found in PHPGurukul Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /includes/login-hm.inc.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.312630
CVE: CVE-2025-6156
Published: 2025-06-17
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bwdates-report-ds.php. The manipulation of the argument testtype leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/66; https://phpgurukul.com/; https://vuldb.com/?ctiid.312631
CVE: CVE-2025-6157
Published: 2025-06-17
Description: A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registered-user-testing.php. The manipulation of the argument testtype leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/67; https://phpgurukul.com/; https://vuldb.com/?ctiid.312632
CVE: CVE-2025-3493
Published: 2025-06-17
Description: Rejected reason: This CVE ID has been rejected by its CNA as it was not a security issue.
CVE: CVE-2025-3494
Published: 2025-06-17
Description: Rejected reason: This CVE ID has been rejected by its CNA as it was not a security issue.
CVE: CVE-2025-6158
Published: 2025-06-17
Description: A vulnerability classified as critical has been found in D-Link DIR-665 1.00. This affects the function sub_AC78 of the component HTTP POST Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir665-dlink; https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir665-dlink#poc; https://vuldb.com/?ctiid.312633
CVE: CVE-2025-6159
Published: 2025-06-17
Description: A vulnerability classified as critical was found in code-projects Hostel Management System 1.0. This vulnerability affects unknown code of the file /allocate_room.php. The manipulation of the argument search_box leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Aalok-zz/cve/issues/1; https://vuldb.com/?ctiid.312634
CVE: CVE-2025-6160
Published: 2025-06-17
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /user_customer_create_order.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yitianweiming/cve/issues/1; https://vuldb.com/?ctiid.312635; https://vuldb.com/?id.312635
CVE: CVE-2025-6161
Published: 2025-06-17
Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/kakalalaww/CVE/issues/17; https://vuldb.com/?ctiid.312636; https://vuldb.com/?id.312636
CVE: CVE-2025-6162
Published: 2025-06-17
Description: A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/688/8.md; https://github.com/Lena-lyy/cve/blob/main/688/8.md#poc; https://vuldb.com/?ctiid.312637
CVE: CVE-2025-6163
Published: 2025-06-17
Description: A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20[PII_REDACTED] and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/688/9.md; https://github.com/Lena-lyy/cve/blob/main/688/9.md#poc; https://vuldb.com/?ctiid.312638
CVE: CVE-2025-5209
Published: 2025-06-17
Description: The Ivory Search  WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8b51dc46-62c8-45b5-96ce-fb774b430388/