deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-14834
Published: 2025-12-17
Description: A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://gist.github.com/b1uel0n3/06593fd15acd0f2f61c29c[PII_REDACTED]; https://vuldb.com/?ctiid.336983
CVE: CVE-2025-14836
Published: 2025-12-17
Description: A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS Score: 2.7 (LOW)
CWE: CWE-312, CWE-313
References: https://note-hxlab.wetolink.com/share/bu2KYevoyBm6; https://vuldb.com/?ctiid.336986; https://vuldb.com/?id.336986
CVE: CVE-2025-66029
Published: 2025-12-17
Description: Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.
CVSS Score: 7.6 (HIGH)
CWE: CWE-522, CWE-523
References: https://github.com/OSC/ondemand/security/advisories/GHSA-2cwp-8g29-9q32
CVE: CVE-2025-68143
Published: 2025-12-17
Description: Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/modelcontextprotocol/servers/commit/eac56e7bcde48fb64d5a973924d05d69a7d876e6; https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-5cgr-j3jf-jw3v
CVE: CVE-2025-68144
Published: 2025-12-17
Description: In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.17 resolve this issue when it is released.
CVSS Score: 7.1 (HIGH)
CWE: CWE-88
References: https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-9xwc-hfwc-8w59
CVE: CVE-2025-68145
Published: 2025-12-17
Description: In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.17 upon release to remediate this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-j22h-9j4x-23w5
CVE: CVE-2025-68147
Published: 2025-12-17
Description: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy" configuration field. The application does not properly sanitize user input before saving it to the database or displaying it on receipts. An attacker with access to the "Store Configuration" (such as a rogue administrator or an account compromised via the separate CSRF vulnerability) can inject malicious JavaScript payloads into this field. These payloads are executed in the browser of any user (including other administrators and sales staff) whenever they view a receipt or complete a transaction. This can lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim. The vulnerability has been patched in version 3.4.2 by ensuring the output is escaped using the `esc()` function in the receipt template. As a temporary mitigation, administrators should ensure the "Return Policy" field contains only plain text and strictly avoid entering any HTML tags. There is no code-based workaround other than applying the patch.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/Nixon-H/CVE-2025-68147-OSPOS-Stored-XSS; https://github.com/opensourcepos/opensourcepos/commit/22297a; https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xgr7-7pvw-fpmh
CVE: CVE-2025-68429
Published: 2025-12-17
Description: Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.
CVSS Score: 7.3 (HIGH)
CWE: CWE-200, CWE-538, CWE-541
References: https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6; https://storybook.js.org/blog/security-advisory
CVE: CVE-2025-68432
Published: 2025-12-17
Description: Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry.  A concerted effort by an attacker to seed a project settings file (`./zed/settings.json`) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
CVSS Score: 7.7 (HIGH)
CWE: CWE-77
References: https://github.com/zed-industries/zed/security/advisories/GHSA-29cp-2hmh-hcxj; https://zed.dev/blog/secure-by-default
CVE: CVE-2025-68433
Published: 2025-12-17
Description: Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious MCP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered automatically without any user interaction besides opening the project in the IDE. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.
CVSS Score: 7.7 (HIGH)
CWE: CWE-77
References: https://github.com/zed-industries/zed/security/advisories/GHSA-cv6g-cmxc-vw8j; https://zed.dev/blog/secure-by-default
CVE: CVE-2025-68434
Published: 2025-12-17
Description: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection line. However, this is not recommended without applying the full patch, as it may cause functionality breakage in the Sales module due to token synchronization issues.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Nixon-H/CVE-2025-68434-OSPOS-CSRF-Unauthorized-Administrator-Creation; https://github.com/opensourcepos/opensourcepos/commit/d575c8da9a1d7af8313a1e758e000e243f5614ef; https://github.com/opensourcepos/opensourcepos/pull/4349
CVE: CVE-2025-68435
Published: 2025-12-17
Description: Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix has been applied in both version 0.19.0 and 0.18.5. If immediate upgrade is not possible, restrict network access to the Zerobyte instance to trusted networks only using firewall rules or network segmentation. This is only a temporary mitigation; upgrading is strongly recommended.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-305
References: https://github.com/nicotsx/zerobyte/commit/13e080a18967705bd2b4e110e5f7693fdca1c692; https://github.com/nicotsx/zerobyte/issues/161; https://github.com/nicotsx/zerobyte/security/advisories/GHSA-x539-c98q-38gv
CVE: CVE-2025-14202
Published: 2025-12-18
Description: A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark, JavaScript executes in the admin’s browser, retrieves the CSRF token, and sends a request to change the admin's password resulting in a full account takeover.
CWE: CWE-79
References: https://www.cve.org/cverecord?id=CVE-2025-14202
CVE: CVE-2025-14837
Published: 2025-12-18
Description: A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://note-hxlab.wetolink.com/share/ekNgcv2wVBya; https://vuldb.com/?ctiid.336987; https://vuldb.com/?id.336987
CVE: CVE-2025-14841
Published: 2025-12-18
Description: A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://github.com/DCMTK/dcmtk/commit/ffb1a4a37d2c876e3feeb31df4930f2aed7fa030; https://github.com/DCMTK/dcmtk/releases/tag/DCMTK-3.7.0; https://support.dcmtk.org/redmine/issues/1183
CVE: CVE-2025-14856
Published: 2025-12-18
Description: A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-94
References: https://github.com/ltranquility/CVE/issues/26; https://vuldb.com/?ctiid.337047; https://vuldb.com/?id.337047
CVE: CVE-2025-12885
Published: 2025-12-18
Description: The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src function regex bypass in all versions up to, and including, 2.7.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3406443/; https://www.wordfence.com/threat-intel/vulnerabilities/id/efbdf0f0-6b38-418c-b3fb-396f89ada34f?source=cve
CVE: CVE-2025-68460
Published: 2025-12-18
Description: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-116
References: https://github.com/roundcube/roundcubemail/commit/08de250fba731b634bed188bbe18d2f6ef3c7571; https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12
CVE: CVE-2025-68461
Published: 2025-12-18
Description: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb; https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68461
CVE: CVE-2025-27063
Published: 2025-12-18
Description: Memory corruption during video playback when video session open fails with time out error.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47319
Published: 2025-12-18
Description: Information disclosure while exposing internal TA-to-TA communication APIs to HLOS
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-497
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47320
Published: 2025-12-18
Description: Memory corruption while processing MFC channel configuration during music playback.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47321
Published: 2025-12-18
Description: Memory corruption while copying packets received from unix clients.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47322
Published: 2025-12-18
Description: Memory corruption while handling IOCTL calls to set mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47323
Published: 2025-12-18
Description: Memory corruption while routing GPR packets between user and root when handling large data packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47325
Published: 2025-12-18
Description: Information disclosure while processing system calls with invalid parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-822
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47350
Published: 2025-12-18
Description: Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47372
Published: 2025-12-18
Description: Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-120, CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47382
Published: 2025-12-18
Description: Memory corruption while loading an invalid firmware in boot loader.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-47387
Published: 2025-12-18
Description: Memory Corruption when processing IOCTLs for JPEG data without verification.
CVSS Score: 7.8 (HIGH)
CWE: CWE-822
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/december-2025-bulletin.html
CVE: CVE-2025-68459
Published: 2025-12-18
Description: RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS command may be executed on the product by an attacker who logs in to the CLI service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU94068946/; https://www.ruijie.com.cn/gy/xw-aqtg-gw/930282/
CVE: CVE-2025-68462
Published: 2025-12-18
Description: Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.
CVSS Score: 3.2 (LOW)
CWE: CWE-732
References: https://salsa.debian.org/freedombox-team/freedombox/-/commit/8ba444990b4af6eec4b6b2b26482b107d
CVE: CVE-2025-68463
Published: 2025-12-18
Description: Bio.Entrez in Biopython through 186 allows doctype XXE.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611
References: https://github.com/biopython/biopython/blob/master/NEWS.rst; https://github.com/biopython/biopython/commit/736c96f37b190732ecca9da80ad0cb9d4967214d; https://github.com/biopython/biopython/issues/5109
CVE: CVE-2025-10019
Published: 2025-12-18
Description: Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-to-email/vulnerability/wordpress-contact-form-email-plugin-1-3-59-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-12976
Published: 2025-12-18
Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list_grouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/classes/em-events.php#L423; https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/em-functions.php#L933; https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/em-shortcode.php#L119
CVE: CVE-2025-13498
Published: 2025-12-18
Description: The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L26; https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L275; https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L299