deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58356
Published: 2025-10-27
Description: Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.
CWE: CWE-347
References: https://github.com/edgelesssys/constellation/pull/3927; https://github.com/edgelesssys/constellation/releases/tag/v2.24.0; https://github.com/edgelesssys/constellation/security/advisories/GHSA-hq76-6gh2-5g4q
CVE: CVE-2025-59151
Published: 2025-10-27
Description: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface before 6.3 is vulnerable to Carriage Return Line Feed (CRLF) injection. When a request is made to a file ending with the .lp extension, the application performs a redirect without properly sanitizing the input. An attacker can inject carriage return and line feed characters (%0d%0a) to manipulate both the headers and the content of the HTTP response. This enables the injection of arbitrary HTTP response headers, potentially leading to session fixation, cache poisoning, and the weakening or bypassing of browser-based security mechanisms such as Content Security Policy or X-XSS-Protection. This vulnerability is fixed in 6.3.
CVSS Score: 8.2 (HIGH)
CWE: CWE-93, CWE-113
References: https://github.com/pi-hole/web/security/advisories/GHSA-5v79-p56f-x7c4
CVE: CVE-2025-61101
Published: 2025-10-27
Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/issues/19471; https://github.com/FRRouting/frr/pull/19480; https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a[PII_REDACTED]aafc7e6b7c3daf3
CVE: CVE-2025-61102
Published: 2025-10-27
Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/issues/19471; https://github.com/FRRouting/frr/pull/19480; https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a[PII_REDACTED]aafc7e6b7c3daf3
CVE: CVE-2025-61105
Published: 2025-10-27
Description: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/issues/19471; https://github.com/FRRouting/frr/pull/19480; https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a[PII_REDACTED]aafc7e6b7c3daf3
CVE: CVE-2025-62263
Published: 2025-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account Role’s “Title” text field to (1) view account role page, or (2) select account role page.

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 service pack 3 through update 36 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Organization’s “Name” text field to (1) view account page, (2) view account organization page, or (3) select account organization page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62263
CVE: CVE-2025-62516
Published: 2025-10-27
Description: Rejected reason: Further research determined the issue is not a vulnerability.
CVE: CVE-2025-62594
Published: 2025-10-27
Description: ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero, unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119, CWE-191, CWE-369
References: https://github.com/ImageMagick/ImageMagick/commit/7b47fe369eda90483402fcd3d78fa4167d3bb129; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wpp4-vqfq-v4hp
CVE: CVE-2025-12316
Published: 2025-10-27
Description: A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The manipulation of the argument OfficeName leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Abxery/cveee/issues/1; https://vuldb.com/?ctiid.329988
CVE: CVE-2025-12322
Published: 2025-10-27
Description: A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromNatStaticSetting of the file /goform/NatStaticSetting. Executing a manipulation of the argument page can lead to buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/19; https://vuldb.com/?ctiid.330101; https://vuldb.com/?id.330101
CVE: CVE-2025-12325
Published: 2025-10-27
Description: A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/yishengsss/CVE-Best-house-rental-management-system-V1.0-admin_class.php-save_house-SQL-injection/blob/main/report.md; https://vuldb.com/?ctiid.330102; https://vuldb.com/?id.330102
CVE: CVE-2025-12326
Published: 2025-10-27
Description: A vulnerability was found in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This vulnerability affects unknown code of the file /process.php of the component POST Request Handler. The manipulation of the argument un results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.330103; https://vuldb.com/?id.330103; https://vuldb.com/?submit.674322
CVE: CVE-2025-12327
Published: 2025-10-27
Description: A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /description.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.330104; https://vuldb.com/?id.330104; https://vuldb.com/?submit.674349
CVE: CVE-2025-62262
Published: 2025-10-27
Description: Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows local users to view user email address in the log files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62263
CVE: CVE-2025-62523
Published: 2025-10-27
Description: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-942
References: https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8; https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445
CVE: CVE-2025-62524
Published: 2025-10-27
Description: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-497
References: https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8; https://github.com/THM-Health/PILOS/security/advisories/GHSA-q93h-5j6h-j22x
CVE: CVE-2025-62725
Published: 2025-10-27
Description: Docker Compose trusts the path information embedded in remote OCI compose artifacts. When a layer includes the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker‑supplied value from com.docker.compose.file/com.docker.compose.envfile with its local cache directory and writes the file there. This affects any platform or workflow that resolves remote OCI compose artifacts, Docker Desktop, standalone Compose binaries on Linux, CI/CD runners, cloud dev environments is affected. An attacker can escape the cache directory and overwrite arbitrary files on the machine running docker compose, even if the user only runs read‑only commands such as docker compose config or docker compose ps. This issue is fixed in v2.40.2.
CWE: CWE-22
References: https://github.com/docker/compose/commit/69bcb962bfb2ea53b41aa925333d356b577d6176; https://github.com/docker/compose/security/advisories/GHSA-gv8h-7v7w-r22q
CVE: CVE-2025-62782
Published: 2025-10-27
Description: InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.4-SNAPSHOT.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-837
References: https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494; https://github.com/Phoenix616/InventoryGui/issues/51; https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-rgvh-4m82-fvjq
CVE: CVE-2025-62783
Published: 2025-10-27
Description: InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement  can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-837
References: https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029; https://github.com/Phoenix616/InventoryGui/issues/48; https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-598q-jw82-5w66
CVE: CVE-2025-62784
Published: 2025-10-27
Description: InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-837
References: https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a[PII_REDACTED]4dd8cb9; https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55
CVE: CVE-2025-12328
Published: 2025-10-27
Description: A vulnerability was identified in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. Impacted is an unknown function of the file /contestproblem.php. Such manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.330105; https://vuldb.com/?id.330105; https://vuldb.com/?submit.674399
CVE: CVE-2025-12329
Published: 2025-10-27
Description: A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the file /details.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.330106; https://vuldb.com/?id.330106; https://vuldb.com/?submit.674401
CVE: CVE-2025-12330
Published: 2025-10-27
Description: A security flaw has been discovered in Willow CMS up to 1.4.0. This issue affects some unknown processing of the file /admin/articles/add of the component Add Post Page. The manipulation of the argument title/body results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/matthewdeaves/willow/issues/131; https://vuldb.com/?ctiid.330115; https://vuldb.com/?id.330115
CVE: CVE-2025-12331
Published: 2025-10-27
Description: A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/matthewdeaves/willow/issues/132; https://vuldb.com/?ctiid.330116; https://vuldb.com/?id.330116
CVE: CVE-2025-62260
Published: 2025-10-27
Description: Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number of objects returned from Headless API requests, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing a request that returns a large number of objects.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62260
CVE: CVE-2025-62261
Published: 2025-10-27
Description: Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261
CVE: CVE-2025-62778
Published: 2025-10-27
Description: Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750; https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx
CVE: CVE-2025-62779
Published: 2025-10-27
Description: Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML through input fields in the Job Form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/frappe/lms/commit/75001b494d5d8198eab20b0cd85d5bd719448ea3; https://github.com/frappe/lms/security/advisories/GHSA-j6h8-qg65-3fpx
CVE: CVE-2025-62781
Published: 2025-10-27
Description: PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in 4.8.0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-613
References: https://github.com/THM-Health/PILOS/security/advisories/GHSA-m8w5-8w3h-72wm
CVE: CVE-2025-62793
Published: 2025-10-27
Description: eLabFTW is an open source electronic lab notebook for research labs. The application served uploaded SVG files inline. Because SVG supports active content, an attacker could upload a crafted SVG that executes script when viewed, resulting in stored XSS under the application origin. A victim who opens the SVG URL or any page embedding it could have their session hijacked, data exfiltrated, or actions performed on their behalf. This vulnerability is fixed n 5.3.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/elabftw/elabftw/commit/09b95e38f82f041edac0dd6962c70499e2d8d8e2; https://github.com/elabftw/elabftw/security/advisories/GHSA-rq98-8jh9-684f
CVE: CVE-2025-12333
Published: 2025-10-27
Description: A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation of the argument supp_name/supp_address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://figshare.com/s/b35b6f6f6a10d8fdc131?file=58703836; https://vuldb.com/?ctiid.330120
CVE: CVE-2025-12334
Published: 2025-10-27
Description: A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument prod_name/prod_desc/prod_cost results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://figshare.com/s/026d2a9dffbc7385777b; https://vuldb.com/?ctiid.330121
CVE: CVE-2025-62258
Published: 2025-10-27
Description: CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to execute any Headless API via the `endpoint` parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62258
CVE: CVE-2025-62259
Published: 2025-10-27
Description: Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62259
CVE: CVE-2025-12332
Published: 2025-10-28
Description: A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/sanin-s1r3n/CVE-Research/blob/main/CVE-4; https://vuldb.com/?ctiid.330119; https://vuldb.com/?id.330119
CVE: CVE-2025-12335
Published: 2025-10-28
Description: A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_update.php. This manipulation of the argument supp_name/supp_address causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://figshare.com/s/3e547f5ef85470696c2a; https://vuldb.com/?ctiid.330122