deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54488
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8850 of biosig.c on the current master branch (35a819fa), when the Tag is 13:

                else if (tag==13) {
                    if (len>8) fprintf(stderr,"Warning MFER tag13 incorrect length %i>8\n",len);
                    curPos += ifread(&buf,1,len,hdr);
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2025-54489
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8970 of biosig.c on the current master branch (35a819fa), when the Tag is 63:

                else if (tag==63) {
                    uint8_t tag2=255, len2=255;

                    count = 0;
                    while ((count<len) && !(FlagInfiniteLength && len2==0 && tag2==0)){
                        curPos += ifread(&tag2,1,1,hdr);
                        curPos += ifread(&len2,1,1,hdr);
                        if (VERBOSE_LEVEL==9)
                            fprintf(stdout,"MFER: tag=%3i chan=%2i len=%-4i tag2=%3i len2=%3i curPos=%i %li count=%4i\n",tag,chan,len,tag2,len2,curPos,iftell(hdr),(int)count);

                        if (FlagInfiniteLength && len2==0 && tag2==0) break;

                        count  += (2+len2);
                        curPos += ifread(&buf,1,len2,hdr);

Here, the number of bytes read is not the Data Length decoded from the current frame in the file (`len`) but rather is a new length contained in a single octet read from the same input file (`len2`). Despite this, a stack-based buffer overflow condition can still occur, as the destination buffer is still `buf`, which has a size of only 128 bytes, while `len2` can be as large as 255.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2025-54490
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9090 of biosig.c on the current master branch (35a819fa), when the Tag is 64:

                else if (tag==64)     //0x40
                {
                    // preamble
                    char tmp[256];  // [1]
                    curPos += ifread(tmp,1,len,hdr);

In this case, the overflowed buffer is the newly-declared `tmp` \[1\] instead of `buf`. While `tmp` is larger than `buf`, having a size of 256 bytes, a stack overflow can still occur in cases where `len` is encoded using multiple octets and is greater than 256.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2025-54491
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9191 of biosig.c on the current master branch (35a819fa), when the Tag is 65:

                else if (tag==65)     //0x41: patient event
                {
                    // event table

                    curPos += ifread(buf,1,len,hdr);
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2025-54492
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9141 of biosig.c on the current master branch (35a819fa), when the Tag is 67:

                else if (tag==67)     //0x43: Sample skew
                {
                    int skew=0;     // [1]
                    curPos += ifread(&skew, 1, len,hdr);

In this case, the address of the newly-defined integer `skew` \[1\] is overflowed instead of `buf`. This means a stack overflow can occur using much smaller values of `len` in this code path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2025-54493
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9184 of biosig.c on the current master branch (35a819fa), when the Tag is 131:

                else if (tag==131)    //0x83
                {
                    // Patient Age
                    if (len!=7) fprintf(stderr,"Warning MFER tag131 incorrect length %i!=7\n",len);
                    curPos += ifread(buf,1,len,hdr);
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2025-54494
Published: 2025-08-25
Description: A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9205 of biosig.c on the current master branch (35a819fa), when the Tag is 133:

                else if (tag==133)    //0x85
                {
                    curPos += ifread(buf,1,len,hdr);
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2234; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2234
CVE: CVE-2024-46412
Published: 2025-08-25
Description: Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/RacerZ-fighting/CVE-vulns/blob/main/rebuild%203.7.5.md; https://github.com/RacerZ-fighting/rebuild-vulns/blob/main/rebuild%203.7.7.md
CVE: CVE-2024-46413
Published: 2025-08-25
Description: Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-918
References: https://github.com/RacerZ-fighting/CVE-vulns/blob/main/rebuild%203.7.7.md; https://github.com/RacerZ-fighting/rebuild-vulns/blob/main/rebuild%203.7.7.md
CVE: CVE-2025-29519
Published: 2025-08-25
Description: A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR[PII_REDACTED]0 allows attackers to execute arbitrary commands via supplying a crafted GET request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/stevenyu113228/5cf73b94dd0f32a72f0b33b17429a423; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-29520
Published: 2025-08-25
Description: Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR[PII_REDACTED]0 allows authenticated attackers with low-level privileges to arbitrarily change the high-privileged account passwords and escalate privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://gist.github.com/stevenyu113228/da01c377030fd8c92274feca54661202; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-29521
Published: 2025-08-25
Description: Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR[PII_REDACTED]0 allows attackers to escalate privileges via a bruteforce attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1392
References: https://gist.github.com/stevenyu113228/73f06459df5ac3257ff451e382497832; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-29522
Published: 2025-08-25
Description: D-Link DSL-7740C with firmware DSL7740C.V6.TR[PII_REDACTED]0 was discovered to contain a command injection vulnerability via the ping function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/stevenyu113228/f44abd7f660a73b0c7f23b7b215d2e05; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-29524
Published: 2025-08-25
Description: Incorrect access control in the component /cgi-bin/system_diagnostic_main.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://gist.github.com/stevenyu113228/fd09d[PII_REDACTED]25f5957c4e4046386
CVE: CVE-2025-29525
Published: 2025-08-25
Description: DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1392
References: https://gist.github.com/stevenyu113228/20ecc24a10e2b1b7038634b838503d7c
CVE: CVE-2025-32468
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2216; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2216
CVE: CVE-2025-35984
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding the image data from a specially crafted .pcx file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2217; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2217
CVE: CVE-2025-44178
Published: 2025-08-25
Description: DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information and modify its configuration via the UPnP protocol WAN sides without any authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://gist.github.com/stevenyu113228/a1fab78fa34a86f7416aa2aa33284fd1
CVE: CVE-2025-44179
Published: 2025-08-25
Description: Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service. The issue arises due to improper input validation within the telnet command handling mechanism. An attacker can exploit this vulnerability by injecting arbitrary commands through the telnet interface when prompted for inputs or commands. Successful exploitation could lead to remote code execution (RCE) under the privileges of the telnet user, potentially allowing unauthorized access to system settings and sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/stevenyu113228/d4271c2d5243e515e8a35a8e224de103
CVE: CVE-2025-46407
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .bmp file, an integer overflow can be made to occur which will cause a heap-based buffer to overflow when reading the palette from the image. These conditions can allow for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2215; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2215
CVE: CVE-2025-50129
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding the image data from a specially crafted .tga file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2220; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2220
CVE: CVE-2025-50900
Published: 2025-08-25
Description: An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preHandle In the filter code, use CodecUtils.urlDecode(request.getRequestURI()) to obtain the URL-decoded request path, and then determine whether the path endsWith /error. If so, execute return true to skip this Interceptor. Else, redirect to /user/login api. Allowing unauthenticated attackers to gain sensitive information or escalated privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://racerz.notion.site/Rebuild-Vulnerability-1ede0e0074f280d8a906c38442a393f0; https://www.notion.so/racerz/Rebuild-Vulnerability-1ede0e0074f280d8a906c38442a393f0?pvs=4
CVE: CVE-2025-51281
Published: 2025-08-25
Description: D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en`, `val and id parameters in the qj_asp function. This vulnerability allows authenticated attackers to cause a Denial of Service (DoS) by sending crafted GET requests with overly long values for these parameters.
CVSS Score: 7.0 (HIGH)
CWE: CWE-120
References: https://github.com/BinaryHK/CVE/blob/main/CVE-2025-51281/CVE-2025-51281.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-52456
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .webp animation an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2224; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2224
CVE: CVE-2025-52930
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing the image data from a specially crafted .bmp file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2221; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2221
CVE: CVE-2025-53085
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the PSD RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decompressing the image data from a specially crafted .psd file, a heap-based buffer overflow can occur which allows for remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2219; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2219
CVE: CVE-2025-53510
Published: 2025-08-25
Description: A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When loading a specially crafted .psd file, an integer overflow can be made to occur when calculating the stride for decoding. Afterwards, this will cause a heap-based buffer to overflow when decoding the image which can lead to remote code execution. An attacker will need to convince the library to read a file to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2218; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2218
CVE: CVE-2025-56212
Published: 2025-08-25
Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-11896/20b47e0ff9d894d; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-56212.md
CVE: CVE-2025-56214
Published: 2025-08-25
Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-11996/43458c7f19aa2e0; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-56214.md
CVE: CVE-2025-56215
Published: 2025-08-25
Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in contact.php via the pagetitle parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-11976/fdd8631102e9985; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-56215.md
CVE: CVE-2025-56216
Published: 2025-08-25
Description: phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-11876/0a7da72fe66f76a; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-56216.md
CVE: CVE-2025-5302
Published: 2025-08-25
Description: A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This results in high resource consumption and potential crashes of the Python process. The issue is resolved in version 0.12.38.
CVSS Score: 8.6 (HIGH)
CWE: CWE-674
References: https://github.com/run-llama/llama_index/commit/c032843a02ce38fd8f284b2aa5a37fd1c17ae635; https://huntr.com/bounties/70041b81-de9e-4046-8c0e-6ccd557048a6
CVE: CVE-2025-29523
Published: 2025-08-25
Description: D-Link DSL-7740C with firmware DSL7740C.V6.TR[PII_REDACTED]0 was discovered to contain a command injection vulnerability via the ping6 function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://gist.github.com/stevenyu113228/6dbc5eb4311390e4e9a8f89fdb659406; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-3478
Published: 2025-08-25
Description: A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited.
CWE: CWE-79
References: https://portal.microfocus.com/s/article/KM000042483
CVE: CVE-2025-53118
Published: 2025-08-25
Description: An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE: CVE-2025-53119
Published: 2025-08-25
Description: An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE: CVE-2025-55301
Published: 2025-08-25
Description: The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username locally. This issue has been patched in version 1.1.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://github.com/The-Scratch-Channel/tsc-web-client/discussions/77; https://github.com/The-Scratch-Channel/tsc-web-client/releases/tag/v1.1; https://github.com/The-Scratch-Channel/tsc-web-client/security/advisories/GHSA-9q4f-4vjm-7gp2
CVE: CVE-2025-55409
Published: 2025-08-25
Description: FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://foxcms.com; https://www.notion.so/CVE-2025-55409-2222b2fd0210804facb7cfe5d9db1ebd
CVE: CVE-2025-55574
Published: 2025-08-25
Description: Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/docmost/docmost
CVE: CVE-2025-55575
Published: 2025-08-25
Description: SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=service_detail.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Aether-0/CVE-2025-55575
CVE: CVE-2025-9409
Published: 2025-08-25
Description: A security flaw has been discovered in lostvip-com ruoyi-go up to 2.1. Impacted is the function DownloadTmp/DownloadUpload of the file modules/system/controller/CommonController.go. Performing manipulation of the argument fileName results in path traversal. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/on-theway/cve/issues/1; https://github.com/on-theway/cve/issues/2; https://vuldb.com/?ctiid.321250
CVE: CVE-2025-29420
Published: 2025-08-25
Description: PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/147536951/Qiany1/blob/main/Perfreeblog_1.pdf
CVE: CVE-2025-29421
Published: 2025-08-25
Description: PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/147536951/Qiany1/blob/main/Perfreeblog_2.pdf