deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-66403
Published: 2025-12-01
Description: FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is later rendered directly in the browser whenever viewed within the application. Because SVGs are XML-based and allow scripting, they execute in the origin context of the application, enabling full stored XSS. This vulnerability is fixed in 2.2.3.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/error311/FileRise/commit/f2ce43f18f0444f8f63f7c33758d1837dd5ba91e; https://github.com/error311/FileRise/security/advisories/GHSA-qrcv-vjvf-fr29
CVE: CVE-2025-66405
Published: 2025-12-01
Description: Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends the client-specified path to perform an external fetch. This can be maliciously used by users for SSRF attacks. This vulnerability is fixed in 1.14.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://github.com/Portkey-AI/gateway/commit/b5a7825ba5f4e6918deb32d9969899ce2229a885; https://github.com/Portkey-AI/gateway/pull/1372; https://github.com/Portkey-AI/gateway/security/advisories/GHSA-hhh5-2cvx-vmfp
CVE: CVE-2025-66410
Published: 2025-12-01
Description: Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/flipped-aurora/gin-vue-admin/commit/ee8d8d7e04d9c38a35a6969f20e75213e84f57c6; https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-jrhg-82w2-vvj7
CVE: CVE-2025-66412
Published: 2025-12-01
Description: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/angular/angular/commit/1c6b0704fb63d051fab8acff84d076abfbc4893a; https://github.com/angular/angular/security/advisories/GHSA-v4hv-rgfq-gp49
CVE: CVE-2025-66415
Published: 2025-12-01
Description: fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could access routes that are not allowed, even though the reply.from is defined for specific routes in @fastify/reply-from. This vulnerability is fixed in 12.5.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-441
References: https://github.com/fastify/fastify-reply-from/commit/4d9795cd5b57a36756d37b7f036eae369f69fa66; https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-2q7r-29rg-6m5h
CVE: CVE-2025-66448
Published: 2025-12-01
Description: vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94
References: https://github.com/vllm-project/vllm/commit/ffb08379d8870a1a81ba82b72797f196838d0c86; https://github.com/vllm-project/vllm/pull/28126; https://github.com/vllm-project/vllm/security/advisories/GHSA-8fr4-5q9j-m8gm
CVE: CVE-2025-21072
Published: 2025-12-02
Description: Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-21080
Published: 2025-12-02
Description: Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-55129
Published: 2025-12-02
Description: HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne users, such as  itz_hari_ and khoof.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-176
References: https://hackerone.com/reports/3434156
CVE: CVE-2025-58475
Published: 2025-12-02
Description: Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 5.6 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-58476
Published: 2025-12-02
Description: Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-58477
Published: 2025-12-02
Description: Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-58478
Published: 2025-12-02
Description: Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-58479
Published: 2025-12-02
Description: Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-58480
Published: 2025-12-02
Description: Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=12
CVE: CVE-2025-58481
Published: 2025-12-02
Description: Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service.
CVSS Score: 7.3 (HIGH)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58482
Published: 2025-12-02
Description: Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service.
CVSS Score: 7.3 (HIGH)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58483
Published: 2025-12-02
Description: Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary application on Galaxy Store.
CVSS Score: 5.9 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58484
Published: 2025-12-02
Description: Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58485
Published: 2025-12-02
Description: Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58486
Published: 2025-12-02
Description: Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary script.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58487
Published: 2025-12-02
Description: Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung Account privilege.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2025-58488
Published: 2025-12-02
Description: Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is required for triggering this vulnerability.
CVSS Score: 4.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=12
CVE: CVE-2024-45675
Published: 2025-12-02
Description: IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password.
CVSS Score: 8.4 (HIGH)
CWE: CWE-309
References: https://www.ibm.com/support/pages/node/7252704
CVE: CVE-2025-12529
Published: 2025-12-02
Description: The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L262; https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.1/includes/classes/CCBOrderController.php#L513; https://www.wordfence.com/threat-intel/vulnerabilities/id/4154684d-3f9b-418f-b9d1-a5d22d4d84d3?source=cve
CVE: CVE-2025-13697
Published: 2025-12-02
Description: The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘timestamp’ attribute in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3404884/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b91364fa-7046-427f-84ee-6a36d49bb80f?source=cve
CVE: CVE-2025-20750
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661199; Issue ID: MSV-4296.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20751
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661195; Issue ID: MSV-4297.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20752
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01270690; Issue ID: MSV-4301.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20753
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689252; Issue ID: MSV-4841.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20754
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689251; Issue ID: MSV-4840.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-248
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20755
Published: 2025-12-02
Description: In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00628396; Issue ID: MSV-4775.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20756
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673749; Issue ID: MSV-4643.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20757
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673751; Issue ID: MSV-4644.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20758
Published: 2025-12-02
Description: In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673755; Issue ID: MSV-4647.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-248
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20759
Published: 2025-12-02
Description: In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673760; Issue ID: MSV-4650.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20763
Published: 2025-12-02
Description: In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267218; Issue ID: MSV-5032.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20764
Published: 2025-12-02
Description: In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20765
Published: 2025-12-02
Description: In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20766
Published: 2025-12-02
Description: In display, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4820.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20767
Published: 2025-12-02
Description: In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4807.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20768
Published: 2025-12-02
Description: In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20769
Published: 2025-12-02
Description: In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4804.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20770
Published: 2025-12-02
Description: In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4803.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20771
Published: 2025-12-02
Description: In display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4802.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-457
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20772
Published: 2025-12-02
Description: In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20773
Published: 2025-12-02
Description: In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4797.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20774
Published: 2025-12-02
Description: In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4796.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20775
Published: 2025-12-02
Description: In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://corp.mediatek.com/product-security-bulletin/December-2025
CVE: CVE-2025-20776
Published: 2025-12-02
Description: In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/December-2025