deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-61857
Published: 2025-10-10
Description: An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61858
Published: 2025-10-10
Description: An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61859
Published: 2025-10-10
Description: An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61860
Published: 2025-10-10
Description: An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61861
Published: 2025-10-10
Description: An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61862
Published: 2025-10-10
Description: An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61863
Published: 2025-10-10
Description: An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-61864
Published: 2025-10-10
Description: A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://jvn.jp/en/vu/JVNVU90008453/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-11579
Published: 2025-10-10
Description: github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789
References: https://github.com/nwaples/rardecode/commit/52fb4e825c936636f251f7e7deded39ab11df9a9
CVE: CVE-2025-7374
Published: 2025-10-10
Description: The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636; https://www.wordfence.com/threat-intel/vulnerabilities/id/12643dd9-3b5e-45ea-9a64-a5b00c9202c8?source=cve
CVE: CVE-2025-7781
Published: 2025-10-10
Description: The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Stored Cross-Site Scripting via the ‘cs_job_title’ parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e3575f8-7adc-4546-9f78-bcb2cf3caa2a?source=cve
CVE: CVE-2025-62237
Published: 2025-10-10
Description: Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 8 through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an Account’s “Name” text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62237
CVE: CVE-2025-62238
Published: 2025-10-10
Description: Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via a crafted payload injected into a Account's “Name“ text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62238
CVE: CVE-2025-62239
Published: 2025-10-10
Description: Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62239
CVE: CVE-2025-60868
Published: 2025-10-10
Description: The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://gist.github.com/kasiasok/870933de18d1400fa8be88e1bcadec6c; https://statamic.com/addons/alt-design/alt-redirects/release-notes
CVE: CVE-2025-61152
Published: 2025-10-10
Description: python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. A malicious actor can craft a forged token with arbitrary claims (e.g., is_admin=true) and bypass authentication checks, leading to privilege escalation or unauthorized access in applications that rely on python-jose for token validation. This issue is exploitable unless developers explicitly reject 'alg=none' tokens, which is not enforced by the library. NOTE: all parties agree that the issue is not relevant because it only occurs in a "verify_signature": False situation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://github.com/javiermorales36/PoC-for-python-jose-alg-none-JWT-bypass-vulnerability/blob/main/CVE-2025-61152_Security_Advisory.md; https://github.com/mpdavis/python-jose/issues/391; https://pypi.org/project/python-jose
CVE: CVE-2025-61319
Published: 2025-10-10
Description: ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. When scanning a target with an XSS payload, the unsanitized payload is rendered in the ReNgine web UI, resulting in arbitrary JavaScript execution in the victim's browser. This can be abused to steal session cookies, perform unauthorized actions, or compromise the ReNgine administrator's account.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/AmalJafarzade/CVE-2025-61319/; https://github.com/yogeshojha/rengine
CVE: CVE-2025-8886
Published: 2025-10-10
Description: Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass.This issue affects Aybs Interaktif: from 2024 through 28082025.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-200, CWE-732, CWE-862, CWE-863
References: https://www.usom.gov.tr/bildirim/tr-25-0329
CVE: CVE-2025-8887
Published: 2025-10-10
Description: Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation.This issue affects Aybs Interaktif: from 2024 through 28082025.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200, CWE-639, CWE-862
References: https://www.usom.gov.tr/bildirim/tr-25-0329
CVE: CVE-2025-60378
Published: 2025-10-10
Description: Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: http://rise.com; https://github.com/ajansha/CVE-2025-60378
CVE: CVE-2025-60869
Published: 2025-10-10
Description: Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site Description" and "Footer Follow Buttons". An attacker can inject arbitrary JavaScript, which is stored in the project and executed in the browsers of remote visitors viewing the generated static site.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://getpublii.com/download/; https://gist.github.com/kasiasok/63f7dcc9c[PII_REDACTED]66ee9738318a9
CVE: CVE-2025-48043
Published: 2025-10-10
Description: Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated with program files lib/ash/policy/authorizer/authorizer.ex and program routines 'Elixir.Ash.Policy.Authorizer':strict_filters/2.

This issue affects ash: from pkg:hex/ash@0 before pkg:hex/ash@3.6.2, before 3.6.2, before 66d81300065b970da0d2f[PII_REDACTED]d2418c7ae.
CWE: CWE-863
References: https://cna.erlef.org/cves/CVE-2025-48043.html; https://github.com/ash-project/ash/commit/66d81300065b970da0d2f[PII_REDACTED]d2418c7ae; https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7
CVE: CVE-2025-59530
Published: 2025-10-10
Description: quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-755
References: https://github.com/quic-go/quic-go/blob/v0.55.0/connection.go#L2682-L2685; https://github.com/quic-go/quic-go/pull/5354; https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw
CVE: CVE-2025-60305
Published: 2025-10-10
Description: SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. The application contains a logic flaw which allows low privilege users can forge high privileged sessions and perform sensitive operations.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://sourcecodester.com; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60305.md; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60305.md
CVE: CVE-2025-60307
Published: 2025-10-10
Description: code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can bypass login attempts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://code-projects.com; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60307.md; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60307.md
CVE: CVE-2025-60269
Published: 2025-10-10
Description: JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExportExcelController.java file.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/erzhongxmu/JEEWMS; https://github.com/int-ux/report/issues/5
CVE: CVE-2025-60306
Published: 2025-10-10
Description: code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive operations.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-284, CWE-287
References: http://code-projects.com; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60306.md
CVE: CVE-2025-60308
Published: 2025-10-10
Description: code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the online hotel reservation system. Malicious JavaScript code is entered in the Description field, which can leak the administrator's cookie information when browsing this room information
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: http://code-projects.com; https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60308.md
CVE: CVE-2025-61689
Published: 2025-10-10
Description: HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header injection, leading to cache poisoning, XSS, session fixation, and more. This issue is fixed in HTTP.jl  `v1.10.19`.
CWE: CWE-113
References: https://github.com/JuliaWeb/HTTP.jl/releases/tag/v1.10.19; https://github.com/JuliaWeb/HTTP.jl/security/advisories/GHSA-h3x8-ppwj-6vcj
CVE: CVE-2025-61780
Published: 2025-10-10
Description: Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sendfile` when running behind a proxy that supports `x-sendfile` headers (such as Nginx). Specially crafted headers could cause `Rack::Sendfile` to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. When `Rack::Sendfile` received untrusted `x-sendfile-type` or `x-accel-mapping` headers from a client, it would interpret them as proxy configuration directives. This could cause the middleware to send a "redirect" response to the proxy, prompting it to reissue a new internal request that was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted `x-sendfile-type: x-accel-redirect` header, setting a crafted `x-accel-mapping` header, and requesting a path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected (such as administrative pages). The vulnerability did not allow arbitrary file reads but could expose sensitive application routes. This issue only affected systems meeting all of the following conditions: The application used `Rack::Sendfile` with a proxy that supports `x-accel-redirect` (e.g., Nginx); the proxy did **not** always set or remove the `x-sendfile-type` and `x-accel-mapping` headers; and the application exposed an endpoint that returned a body responding to `.to_path`. Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable `x-accel-redirect`. Alternatively, configure the proxy to always set or strip the header, or in Rails applications, disable sendfile completely.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200, CWE-441, CWE-913
References: https://github.com/rack/rack/commit/57277b7741581fa827472c5c666f6e6a33abd784; https://github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a; https://github.com/rack/rack/commit/fba2c8bc63eb787ff4b19bc612d315fda6126d85
CVE: CVE-2025-11580
Published: 2025-10-10
Description: A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://github.com/PowerJob/PowerJob/; https://github.com/PowerJob/PowerJob/issues/1127; https://vuldb.com/?ctiid.327902
CVE: CVE-2025-11616
Published: 2025-10-10
Description: A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. These issues only affect applications using IPv6.

Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-126
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-023/; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-8j9h-xjm9-8j6j
CVE: CVE-2025-11617
Published: 2025-10-10
Description: A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6.

We recommend users upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-126
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-023/; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-wmjr-wm93-cvv2
CVE: CVE-2025-11618
Published: 2025-10-10
Description: A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. This issue only affects applications using IPv6.

We recommend upgrading to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-023/; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4; https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-6fh9-mqxj-hmwj
CVE: CVE-2025-23280
Published: 2025-10-10
Description: NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23280; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23280
CVE: CVE-2025-23282
Published: 2025-10-10
Description: NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
CVSS Score: 7.0 (HIGH)
CWE: CWE-415
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23282; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23282
CVE: CVE-2025-23309
Published: 2025-10-10
Description: NVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation of privileges, code execution, and data tampering.
CVSS Score: 8.2 (HIGH)
CWE: CWE-427
References: https://nvd.nist.gov/vuln/detail/CVE-2025-23309; https://nvidia.custhelp.com/app/answers/detail/a_id/5703; https://www.cve.org/CVERecord?id=CVE-2025-23309
CVE: CVE-2025-60268
Published: 2025-10-10
Description: An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in /jeewms/cgUploadController.do. An attacker with normal privileges was able to upload a malicious file that would lead to remote code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://gitee.com/erzhongxmu/JEEWMS; https://github.com/int-ux/report/issues/4
CVE: CVE-2025-60838
Published: 2025-10-10
Description: An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://mcms.com; https://gist.github.com/xuzhiwei66666666/8a990104861ce31cf73ea38e7eb32a7d; https://gitee.com/mingSoft/MCMS
CVE: CVE-2025-11581
Published: 2025-10-10
Description: A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAPIController. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-863
References: https://github.com/PowerJob/PowerJob/; https://github.com/PowerJob/PowerJob/issues/1128; https://vuldb.com/?ctiid.327903
CVE: CVE-2025-60880
Published: 2025-10-10
Description: An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98; https://github.com/Shenal01/CVE-2025-60880