deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-30259
Published: 2025-03-20
Description: The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.
CVSS Score: 3.5 (LOW)
References: https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/; https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/
CVE: CVE-2024-13875
Published: 2025-03-20
Description: The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/82c54fb5-f1d9-4bae-a3de-d4335809b81c/
CVE: CVE-2024-13876
Published: 2025-03-20
Description: The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/d80cd18a-065f-443b-b548-d780b785d68e/
CVE: CVE-2024-13877
Published: 2025-03-20
Description: The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0e8ce3cf-1598-4c5d-b119-99d5f676e619/
CVE: CVE-2024-13878
Published: 2025-03-20
Description: The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/882b2022-4ed6-4d9e-8b35-f48ea1580884/
CVE: CVE-2024-13880
Published: 2025-03-20
Description: The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bee3b002-e808-4402-8bf6-4375ed7b3807/
CVE: CVE-2024-13881
Published: 2025-03-20
Description: The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/900fa2c6-0cac-4920-aef2-e8b94248b62e/
CVE: CVE-2025-1314
Published: 2025-03-20
Description: The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L1014; https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L810; https://plugins.trac.wordpress.org/browser/custom-twitter-feeds/trunk/custom-twitter-feed.php#L833
CVE: CVE-2025-1766
Published: 2025-03-20
Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: http://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.24/core/Order/PaymentController.php#L97; https://plugins.trac.wordpress.org/changeset/3257023/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f2bcaff9-bf04-4d8e-9422-c433264067ff?source=cve
CVE: CVE-2025-1770
Published: 2025-03-20
Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.24/widgets/events-calendar/events-calendar.php#L715; https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.24/widgets/upcoming-event-tab/style/tab-1.php#L53; https://plugins.trac.wordpress.org/changeset/3257023/
CVE: CVE-2025-22228
Published: 2025-03-20
Description: BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
CVSS Score: 7.4 (HIGH)
CWE: CWE-287
References: https://spring.io/security/cve-2025-22228; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-2108
Published: 2025-03-20
Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'title_tag' and 'html_tag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/site-title/layout/frontend.php#L29; https://plugins.trac.wordpress.org/changeset/3255986/; https://www.wordfence.com/threat-intel/vulnerabilities/id/009b9b0d-6cbd-402e-bc81-24661ff16b9d?source=cve
CVE: CVE-2024-12016
Published: 2025-03-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection.This issue affects CM News: through 6.0.





NOTE: The vendor was contacted and it was learned that the product is not supported.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0072
CVE: CVE-2025-1385
Published: 2025-03-20
Description: When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.

You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:

<library_bridge>
   <port>9019</port>
</library_bridge>
CWE: CWE-20
References: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5
CVE: CVE-2025-2505
Published: 2025-03-20
Description: The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/age-gate/trunk/vendor/agegate/common/src/Settings.php#L27; https://plugins.trac.wordpress.org/changeset/3258075/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ac2996-098f-474c-b44e-78d5af7b503a?source=cve
CVE: CVE-2024-47552
Published: 2025-03-20
Description: Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).





This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0.





Severity Justification:

The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating factors. First, the vulnerability is strictly isolated to the Raft cluster mode, an optional and non-default feature introduced in v2.0.0, while most users rely on the unaffected traditional architecture. Second, Seata is an internal middleware; communication between TC and RM/TM occurs entirely within trusted internal networks. An attacker would require prior, unauthorized access to the Intranet to exploit this, making external exploitation highly improbable.





Users are recommended to upgrade to version 2.2.0, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/apache/incubator-seata/commit/20cd9625d23f99b71fefc83b8db96c14092a9950; https://lists.apache.org/thread/652o82vzk9qrtgksk55cfgpbvdgtkch0; http://www.openwall.com/lists/oss-security/2025/03/19/5
CVE: CVE-2024-54016
Published: 2025-03-20
Description: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating).

This issue affects Apache Seata (incubating): through <=2.2.0.

Users are recommended to upgrade to version 2.3.0, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-409
References: https://lists.apache.org/thread/grn0x8tmssx07qc9z50lwgmrkwzrrhzg; http://www.openwall.com/lists/oss-security/2025/03/19/6
CVE: CVE-2024-0245
Published: 2025-03-20
Description: A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a malicious app that hijacks the legitimate Inure app, intercepting and stealing sensitive information when installed on the victim's device. This issue affects all Android versions before Android 11.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/hamza417/inure/commit/a0c3e68b0542bcd7007c93618e0d50a5331de061; https://huntr.com/bounties/2108644e-9e54-4236-932d-f204fc68b607
CVE: CVE-2024-0640
Published: 2025-03-20
Description: A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malicious JavaScript code via the dashboard app settings, which can then be executed by another admin user when they access the affected dashboard app. The issue is fixed in version 3.5.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/chatwoot/chatwoot/commit/e39c14460b860d5e3d23d989dd6af48404ad1bb4; https://huntr.com/bounties/08b3bebf-ce3c-4416-b75e-1927ba61de85
CVE: CVE-2024-10019
Published: 2025-03-20
Description: A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function does not properly sanitize the `app_name` parameter, enabling an attacker to upload a malicious `server.py` file and execute arbitrary code by exploiting the path traversal vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://huntr.com/bounties/3cf80890-2d8a-4fc7-8e0e-6d4bf648b3ea
CVE: CVE-2024-10047
Published: 2025-03-20
Description: parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-36
References: https://huntr.com/bounties/69c3a27c-bd93-4aff-a46b-56798f28a3ce
CVE: CVE-2024-10051
Published: 2025-03-20
Description: Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request causes the server to continuously process each character. This leads to excessive resource consumption and renders the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://huntr.com/bounties/6db72368-e7bc-43ee-a4ae-6092f710c263
CVE: CVE-2024-10096
Published: 2025-03-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-10109
Published: 2025-03-20
Description: A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.
CVSS Score: 8.3 (HIGH)
CWE: CWE-863
References: https://github.com/mintplex-labs/anything-llm/commit/8d302c3f670c582b09d47e96132c248101447a11; https://huntr.com/bounties/ad3c9e76-679d-4775-b203-96947ff73551
CVE: CVE-2024-10110
Published: 2025-03-20
Description: In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://huntr.com/bounties/5ea6cf56-7b4c-4dce-9b6c-3e910fbb1ae4
CVE: CVE-2024-10188
Published: 2025-03-20
Description: A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_eval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/berriai/litellm/commit/21156ff5d0d84a7dd93f951ca033275c77e4f73c; https://huntr.com/bounties/96a32812-213c-4819-ba4e-36143d35e95b
CVE: CVE-2024-10190
Published: 2025-03-20
Description: Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754
CVE: CVE-2024-10225
Published: 2025-03-20
Description: A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each character, rendering the application inaccessible.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://huntr.com/bounties/cd793f83-f122-432b-83e7-1cc8c78817b7
CVE: CVE-2024-10252
Published: 2025-03-20
Description: A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4; https://huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0
CVE: CVE-2024-10264
Published: 2025-03-20
Description: HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://huntr.com/bounties/988247d5-fd60-4d85-845a-e867d62c0d02
CVE: CVE-2024-10267
Published: 2025-03-20
Description: An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all information associated with the existing account. The vulnerable endpoint is located in the user registration functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://huntr.com/bounties/13da8366-4670-4d46-9f5a-ba3f642b692e
CVE: CVE-2024-10272
Published: 2025-03-20
Description: lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://github.com/lunary-ai/lunary/commit/35dd4af0001a54ccb14276a1546eb977f82c0c5e; https://huntr.com/bounties/3de48a54-b5c9-40a1-b794-d59c36d58fb6; https://huntr.com/bounties/3de48a54-b5c9-40a1-b794-d59c36d58fb6
CVE: CVE-2024-10273
Published: 2025-03-20
Description: In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to modify. This vulnerability could lead to unauthorized changes in critical resources, affecting the integrity and reliability of the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc; https://huntr.com/bounties/883d9fe2-5730-41e1-a5c2[PII_REDACTED]6e
CVE: CVE-2024-10274
Published: 2025-03-20
Description: An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing unauthorized users to access sensitive information about all team members in the current organization. This vulnerability can lead to the disclosure of sensitive information such as names, roles, or emails to users without sufficient privileges, resulting in privacy violations and potential reconnaissance for targeted attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc; https://huntr.com/bounties/506459c1-da60-45c5-a10d-8bd540a4b4c1
CVE: CVE-2024-10275
Published: 2025-03-20
Description: In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manage billing, effectively bypassing the intended role-based access control. Only users with the 'owner' role should be allowed to invite members with billing permissions. This flaw allows admins to circumvent those restrictions, gaining unauthorized access and control over billing information, posing a risk to the organization’s financial resources.
CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc; https://huntr.com/bounties/863ee34b-c4c6-4325-bf7a-82a7feebf88f
CVE: CVE-2024-10330
Published: 2025-03-20
Description: In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc; https://huntr.com/bounties/598ecd65-1723-4fb7-a9aa-9c4f56a5a2aa
CVE: CVE-2024-10359
Published: 2025-03-20
Description: In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of another user. The vulnerability arises because the backend saves the entire object received without validating the attributes and their values, impacting both integrity and confidentiality.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-915
References: https://github.com/danny-avila/librechat/commit/e3e52402f69accc35c6d0acd9c3266ae1cb6333f; https://huntr.com/bounties/bba65eb4-4c83-4f33-83c1-ede5ed0d5656
CVE: CVE-2024-10361
Published: 2025-03-20
Description: An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d[PII_REDACTED]9c; https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d
CVE: CVE-2024-10363
Published: 2025-03-20
Description: In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599; https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b
CVE: CVE-2024-10366
Published: 2025-03-20
Description: An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/danny-avila/librechat/commit/a350443661d001ac[PII_REDACTED]9a75d94ca14116; https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e