deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-20010
Published: 2025-08-20
Description: Foxit PDF Reader before 4.2.0.0928 does not properly bound-check the /Title entry in the PDF Info dictionary. A specially crafted PDF with an overlong Title string can overflow a fixed-size stack buffer, corrupt the Structured Exception Handler (SEH) chain, and lead to arbitrary code execution in the context of the user who opens the file.
CWE: CWE-121
References: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/foxit_title_bof.rb; https://www.exploit-db.com/exploits/15514/; https://www.exploit-db.com/exploits/15532
CVE: CVE-2024-50640
Published: 2025-08-20
Description: jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/jeecgboot/jeewx-boot/issues/46
CVE: CVE-2025-20131
Published: 2025-08-20
Description: A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device.

This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload using the Cisco ISE GUI. A successful exploit could allow the attacker to upload arbitrary files to an affected system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-qksX6C8g
CVE: CVE-2025-20269
Published: 2025-08-20
Description: A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to retrieve arbitrary files from the underlying file system on an affected device.

This vulnerability is due to insufficient input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface on an affected device. A successful exploit could allow the attacker to access&nbsp;sensitive files from the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-TET4GxBX
CVE: CVE-2025-20345
Published: 2025-08-20
Description: A vulnerability in the debug logging function of Cisco Duo Authentication Proxy could allow an authenticated, high-privileged, remote attacker to view sensitive information in a system log file.

This vulnerability is due to insufficient masking of sensitive information before it is written to system log files. An attacker could exploit this vulnerability by accessing logs on an affected system. A successful exploit could allow the attacker to view sensitive information that should be restricted.&nbsp;
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd36820; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-authproxlog-SxczXQ63
CVE: CVE-2025-28041
Published: 2025-08-20
Description: Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication.
CVSS Score: 8.6 (HIGH)
CWE: CWE-284
References: https://github.com/michaelliao/itranswarp/issues/73
CVE: CVE-2025-46849
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-46852
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-46856
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a specially crafted web page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-46932
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-46936
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-46962
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-46998
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-50901
Published: 2025-08-20
Description: JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gitee.com/erzhongxmu/JEEWMS/issues/IC8RPM; https://gitee.com/erzhongxmu/JEEWMS/issues/IC8RPM
CVE: CVE-2025-50904
Published: 2025-08-20
Description: There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /admin/ API without any token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://github.com/WinterChenS/my-site/issues/95
CVE: CVE-2025-55444
Published: 2025-08-20
Description: A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-89
References: https://gist.github.com/Anudeepkadambala/88c6065f1de1597be96e50a573cde56e; https://github.com/Anudeepkadambala/CVE-Reports/blob/main/CVE-2025-55444_Disclosure.md; https://github.com/Anudeepkadambala/CVE-Reports/security/advisories/GHSA-r4mf-mr9h-f27m
CVE: CVE-2025-6180
Published: 2025-08-20
Description: The StrongDM Client insufficiently protected a pre-authentication token. Attackers could exploit this to intercept and reuse the token, potentially redeeming valid authentication credentials through a race condition.
CWE: CWE-319
References: https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE: CVE-2025-6181
Published: 2025-08-20
Description: The StrongDM Windows service incorrectly handled input validation. Authenticated attackers could potentially exploit this leading to privilege escalation.
CWE: CWE-78
References: https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE: CVE-2025-6182
Published: 2025-08-20
Description: The StrongDM Windows service incorrectly handled communication related to system certificate management. Attackers could exploit this behavior to install untrusted root certificates or remove trusted ones.
CWE: CWE-269
References: https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE: CVE-2025-6183
Published: 2025-08-20
Description: The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious JSON message.
CWE: CWE-78
References: https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
CVE: CVE-2025-8309
Published: 2025-08-20
Description: There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. 

This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://www.manageengine.com/products/service-desk/cve-2025-8309.html
CVE: CVE-2025-8415
Published: 2025-08-20
Description: A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-289
References: https://access.redhat.com/errata/RHSA-2025:14919; https://access.redhat.com/security/cve/CVE-2025-8415; https://bugzilla.redhat.com/show_bug.cgi?id=2385773
CVE: CVE-2025-8610
Published: 2025-08-20
Description: AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the StorageNode service, which listens on TCP port 9075 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-26156.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-25-808/
CVE: CVE-2025-8611
Published: 2025-08-20
Description: AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DaoService service, which listens on TCP port 9074 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-26158.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-25-807/
CVE: CVE-2025-8612
Published: 2025-08-20
Description: AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AOMEI Backupper Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is needed additionally.

The specific flaw exists within the restore functionality. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27059.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-25-806/
CVE: CVE-2025-9234
Published: 2025-08-20
Description: A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. The manipulation of the argument Alias results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9234.md; https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20maintenance_events.shtm%20parameter%20Alias.md#poc; https://vuldb.com/?ctiid.320767
CVE: CVE-2025-9235
Published: 2025-08-20
Description: A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9235.md; https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20compound_events.shtm%20parameter%20name.md#poc; https://vuldb.com/?ctiid.320768
CVE: CVE-2024-53495
Published: 2025-08-20
Description: Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/WinterChenS/my-site/issues/88
CVE: CVE-2025-47054
Published: 2025-08-20
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a specially crafted web page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-55746
Published: 2025-08-20
Description: Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in the file update mechanism which allows an unauthenticated actor to modify existing files with arbitrary contents (without changes being applied to the files' database-resident metadata) and / or upload new files, with arbitrary content and extensions, which won't show up in the Directus UI. This vulnerability is fixed in 11.9.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-73, CWE-434
References: https://github.com/directus/directus/commit/d84dcc36f75fc5c858d43746b8f9c426c38d696b; https://github.com/directus/directus/security/advisories/GHSA-mv33-9f6j-pfmc
CVE: CVE-2025-9236
Published: 2025-08-20
Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql injection. The attack may be performed from a remote location. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-9236.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20nm_tipo%20Parameter%20on%20educar_tipo_usuario_lst.php%20Endpoint.md#poc; https://vuldb.com/?ctiid.320769
CVE: CVE-2025-9237
Published: 2025-08-20
Description: A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_account of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://codeastro.com/; https://gist.github.com/0xSebin/bb6781e5977bda36610fda20861a5bbe; https://gist.github.com/0xSebin/bb6781e5977bda36610fda20861a5bbe#steps-to-reproduce
CVE: CVE-2025-9238
Published: 2025-08-20
Description: A vulnerability was determined in Swatadru Exam-Seating-Arrangement up to 97335ccebf95468d92525f4255a2241d2b0b002f. Affected is an unknown function of the file /student.php of the component Student Login. Executing manipulation of the argument email can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://gist.github.com/0xSebin/81ce7a296b4220db5ebfdb22fa78c3b3; https://gist.github.com/0xSebin/81ce7a296b4220db5ebfdb22fa78c3b3#steps-to-reproduce; https://vuldb.com/?ctiid.320771
CVE: CVE-2025-9239
Published: 2025-08-20
Description: A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The manipulation of the argument STR_PARAM with the input Passw0rd leads to inadequate encryption strength. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation appears to be difficult.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-326
References: https://github.com/elunez/eladmin/issues/884; https://vuldb.com/?ctiid.320772; https://vuldb.com/?id.320772
CVE: CVE-2024-57152
Published: 2025-08-20
Description: Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen.interceptor.BaseInterceptor class
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/WinterChenS/my-site/issues/92
CVE: CVE-2025-43746
Published: 2025-08-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43746
CVE: CVE-2025-9240
Published: 2025-08-20
Description: A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/elunez/eladmin/issues/885; https://github.com/elunez/eladmin/issues/885#issue[PII_REDACTED]; https://vuldb.com/?ctiid.320773
CVE: CVE-2024-57154
Published: 2025-08-20
Description: Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/qiguliuxing/dts-shop/issues/29
CVE: CVE-2025-43757
Published: 2025-08-20
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43757
CVE: CVE-2025-50902
Published: 2025-08-20
Description: Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attackers to gain sensitive information via crafted HTTP Post message.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gitee.com/old-peanut/wechat_applet__open_source/issues/IC95QM
CVE: CVE-2025-54988
Published: 2025-08-20
Description: Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.

Users are recommended to upgrade to version 3.2.2, which fixes this issue.
CVSS Score: 8.4 (HIGH)
CWE: CWE-611
References: https://lists.apache.org/thread/8xn3rqy6kz5b3l1t83kcofkw0w4mmj1w; http://www.openwall.com/lists/oss-security/2025/08/20/2; http://www.openwall.com/lists/oss-security/2025/08/20/3