deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12245
Published: 2025-03-14
Description: Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
CWE: CWE-89
References: https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE: CVE-2024-29409
Published: 2025-03-14
Description: File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: https://gist.github.com/aydinnyunus/[PII_REDACTED]84d1491c67a820a714f53f; https://github.com/nestjs/nest/issues/13311#issuecomment[PII_REDACTED]
CVE: CVE-2024-54445
Published: 2025-03-14
Description: Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
CWE: CWE-89
References: https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE: CVE-2024-54446
Published: 2025-03-14
Description: Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
CWE: CWE-89
References: https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE: CVE-2024-54447
Published: 2025-03-14
Description: Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.
CWE: CWE-89
References: https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE: CVE-2024-54448
Published: 2025-03-14
Description: The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE: CVE-2024-54449
Published: 2025-03-14
Description: The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
CVSS Score: 8.8 (HIGH)
CWE: CWE-23
References: https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
CVE: CVE-2025-26312
Published: 2025-03-14
Description: SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter.
CWE: CWE-472
References: https://medium.com/@retro.metro/cve-2025-26312-captcha-bypass-vulnerability-in-sendquick-entera-devices-68708e203216; https://www.sendquick.com/products/sendquick-entera/
CVE: CVE-2025-29775
Published: 2025-03-14
Description: xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.
CWE: CWE-347
References: https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed; https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98; https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
CVE: CVE-2025-29779
Published: 2025-03-14
Description: Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `secure_redundant_execution` function in feldman_vss.py attempts to mitigate fault injection attacks by executing a function multiple times and comparing results. However, several critical weaknesses exist. Python's execution environment cannot guarantee true isolation between redundant executions, the constant-time comparison implementation in Python is subject to timing variations, the randomized execution order and timing provide insufficient protection against sophisticated fault attacks, and the error handling may leak timing information about partial execution results. These limitations make the protection ineffective against targeted fault injection attacks, especially from attackers with physical access to the hardware. A successful fault injection attack could allow an attacker to bypass the redundancy check mechanisms, extract secret polynomial coefficients during share generation or verification, force the acceptance of invalid shares during verification, and/or manipulate the commitment verification process to accept fraudulent commitments. This undermines the core security guarantees of the Verifiable Secret Sharing scheme. As of time of publication, no patched versions of Post-Quantum Secure Feldman's Verifiable Secret Sharing exist, but other mitigations are available. Long-term remediation requires reimplementing the security-critical functions in a lower-level language like Rust. Short-term mitigations include deploying the software in environments with physical security controls, increasing the redundancy count (from 5 to a higher number) by modifying the source code, adding external verification of cryptographic operations when possible, considering using hardware security modules (HSMs) for key operations.
CWE: CWE-1240, CWE-1279
References: https://en.wikipedia.org/wiki/Fault_attack; https://eprint.iacr.org/2004/100.pdf; https://github.com/DavidOsipov/PostQuantum-Feldman-VSS/security/advisories/GHSA-r8gc-qc2c-c7vh
CVE: CVE-2025-29780
Published: 2025-03-14
Description: Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `feldman_vss` library contains timing side-channel vulnerabilities in its matrix operations, specifically within the `_find_secure_pivot` function and potentially other parts of `_secure_matrix_solve`. These vulnerabilities are due to Python's execution model, which does not guarantee constant-time execution. An attacker with the ability to measure the execution time of these functions (e.g., through repeated calls with carefully crafted inputs) could potentially recover secret information used in the Verifiable Secret Sharing (VSS) scheme. The `_find_secure_pivot` function, used during Gaussian elimination in `_secure_matrix_solve`, attempts to find a non-zero pivot element. However, the conditional statement `if matrix[row][col] != 0 and row_random < min_value:` has execution time that depends on the value of `matrix[row][col]`. This timing difference can be exploited by an attacker. The `constant_time_compare` function in this file also does not provide a constant-time guarantee. The Python implementation of matrix operations in the _find_secure_pivot and _secure_matrix_solve functions cannot guarantee constant-time execution, potentially leaking information about secret polynomial coefficients. An attacker with the ability to make precise timing measurements of these operations could potentially extract secret information through statistical analysis of execution times, though practical exploitation would require significant expertise and controlled execution environments. Successful exploitation of these timing side-channels could allow an attacker to recover secret keys or other sensitive information protected by the VSS scheme. This could lead to a complete compromise of the shared secret. As of time of publication, no patched versions of Post-Quantum Secure Feldman's Verifiable Secret Sharing exist, but other mitigations are available. As acknowledged in the library's documentation, these vulnerabilities cannot be adequately addressed in pure Python. In the short term, consider using this library only in environments where timing measurements by attackers are infeasible. In the medium term, implement your own wrappers around critical operations using constant-time libraries in languages like Rust, Go, or C. In the long term, wait for the planned Rust implementation mentioned in the library documentation that will properly address these issues.
CWE: CWE-203, CWE-208, CWE-385
References: https://en.wikipedia.org/wiki/Side-channel_attack; https://github.com/DavidOsipov/PostQuantum-Feldman-VSS/security/advisories/GHSA-q65w-fg65-79f4; https://www.rambus.com/wp-content/uploads/2015/08/TimingAttacks.pdf
CVE: CVE-2025-29771
Published: 2025-03-14
Description: HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. The issue is patched in version 2.0.3.
CWE: CWE-79
References: https://github.com/jitbit/HtmlSanitizer/commit/af6d2a78877e7277cd01c825b7fb50edb5956963; https://github.com/jitbit/HtmlSanitizer/security/advisories/GHSA-vhv4-fh94-jm5x
CVE: CVE-2025-29782
Published: 2025-03-14
Description: WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpoint in versions of the WeGIA application prior to 3.2.17. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.2.17 contains a patch for the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/v3.2.17; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5x5w-5c99-vr8h
CVE: CVE-2025-2308
Published: 2025-03-14
Description: A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc2.md; https://vuldb.com/?ctiid.299721; https://vuldb.com/?id.299721
CVE: CVE-2025-2309
Published: 2025-03-14
Description: A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc3.md; https://vuldb.com/?ctiid.299722; https://vuldb.com/?id.299722
CVE: CVE-2025-2310
Published: 2025-03-14
Description: A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor plans to fix this issue in an upcoming release.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc4.md; https://vuldb.com/?ctiid.299723; https://vuldb.com/?id.299723
CVE: CVE-2025-2295
Published: 2025-03-14
Description: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
CVSS Score: 3.5 (LOW)
CWE: CWE-190
References: https://github.com/tianocore/edk2/security/advisories/GHSA-8522-69fh-w74x
CVE: CVE-2025-2320
Published: 2025-03-14
Description: A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit of the file /api/blade-user/submit of the component User Handler. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.299749; https://vuldb.com/?id.299749; https://vuldb.com/?submit.505689
CVE: CVE-2025-1653
Published: 2025-03-15
Description: The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://wordpress.org/plugins/ulisting/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4181b26e-89c7-4020-a3d4-29bdc88d7438?source=cve
CVE: CVE-2025-1657
Published: 2025-03-15
Description: The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized. A capability check was added in 2.1.8, but the unserialize is still present.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3261184/ulisting/trunk/includes/classes/StmListing.php; https://wordpress.org/plugins/ulisting/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e70184f-94b6-4742-b99b-6eec9d28f17c?source=cve
CVE: CVE-2024-12336
Published: 2025-03-15
Description: The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_all_data' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive affiliate data, including personally identifiable information (PII).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wc-affiliate/trunk/src/AJAX.php#L903; https://plugins.trac.wordpress.org/changeset/3256435/wc-affiliate/trunk/src/AJAX.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0fb349-4cb8-4cf3-ae7c-5c4dcc6fd4f7?source=cve
CVE: CVE-2024-13847
Published: 2025-03-15
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-1667
Published: 2025-03-15
Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to update arbitrary user details including email which makes it possible to request a password reset and access arbitrary user accounts, including administrators.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-862
References: https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks-teacher.php#L544; https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.17/lib/wpsp-ajaxworks-teacher.php#L544; https://www.wordfence.com/threat-intel/vulnerabilities/id/e54f98bc-c538-4f3c-b24a-6e778a3748ef?source=cve
CVE: CVE-2025-1668
Published: 2025-03-15
Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access and above, to delete arbitrary user accounts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L22; https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.17/lib/wpsp-ajaxworks.php#L22; https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5638b6-134d-4386-af40-6ac961a915d7?source=cve
CVE: CVE-2025-1669
Published: 2025-03-15
Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with teacher-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/lib/wpsp-ajaxworks.php#L4304; https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.18/lib/wpsp-ajaxworks.php#L4304; https://www.wordfence.com/threat-intel/vulnerabilities/id/b7413d90-aed1-4f78-a17c-bed76efb48f8?source=cve
CVE: CVE-2025-1670
Published: 2025-03-15
Description: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.16/pages/wpsp-exams.php#L186; https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.17/pages/wpsp-exams.php#L186; https://www.wordfence.com/threat-intel/vulnerabilities/id/f38c28f4-e73a-4eb2-8bbd-73c849385c4e?source=cve
CVE: CVE-2025-2163
Published: 2025-03-15
Description: The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on  the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L18; https://plugins.trac.wordpress.org/browser/zoorum-comments/tags/0.9/zoorum-comments-admin.php#L38; https://wordpress.org/plugins/zoorum-comments/
CVE: CVE-2025-2164
Published: 2025-03-15
Description: The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/pixelstats/tags/0.8.2/pixelstats.php#L331; https://plugins.trac.wordpress.org/browser/pixelstats/tags/0.8.2/pixelstats.php#L664; https://wordpress.org/plugins/pixelstats/
CVE: CVE-2025-2267
Published: 2025-03-15
Description: The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-30567 is a duplicate of this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp01/trunk/inc/class-wp01.php#L109; https://wordpress.org/plugins/wp01/; https://www.wordfence.com/threat-intel/vulnerabilities/id/900d09e8-ded5-49b9-81bf-ddfc85d3cf2b?source=cve
CVE: CVE-2024-13497
Published: 2025-03-15
Description: The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-80, CWE-79
References: https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/attachments.php#L46; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3251202%40tripetto%2Ftrunk&old=3231968%40tripetto%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbe006c-1afc-4c8b-a9f3-ffb21cdabb54?source=cve