deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-42939
Published: 2025-10-14
Description: SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://me.sap.com/notes/3625683; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-10357
Published: 2025-10-14
Description: The Simple SEO WordPress plugin before 2.0.32 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/24fcf8ef-603f-4e1f-905d-fbaf989a617f/
CVE: CVE-2025-10732
Published: 2025-10-14
Description: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L314; https://plugins.trac.wordpress.org/browser/sureforms/tags/1.12.0/inc/global-settings/global-settings.php#L64; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368400%40sureforms&new=3368400%40sureforms&sfp_email=&sfph_mail=
CVE: CVE-2025-11731
Published: 2025-10-14
Description: A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.
CVSS Score: 3.1 (LOW)
CWE: CWE-843
References: https://access.redhat.com/errata/RHSA-2026:11015; https://access.redhat.com/security/cve/CVE-2025-11731; https://bugzilla.redhat.com/show_bug.cgi?id=2403688
CVE: CVE-2025-59889
Published: 2025-10-14
Description: Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the software package. 

This security issue has been fixed in the latest version of IPP which is available on the Eaton download center.
CVSS Score: 8.6 (HIGH)
CWE: CWE-427
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1009.pdf
CVE: CVE-2025-8594
Published: 2025-10-14
Description: The Pz-LinkCard WordPress plugin before 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attack.
CVSS Score: 3.8 (LOW)
References: https://wpscan.com/vulnerability/17104590-d84e-41b7-83ac-9b15fcfb537a/; https://wpscan.com/vulnerability/17104590-d84e-41b7-83ac-9b15fcfb537a/
CVE: CVE-2025-41703
Published: 2025-10-14
Description: An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://certvde.com/de/advisories/VDE-2025-072; http://seclists.org/fulldisclosure/2025/Oct/12
CVE: CVE-2025-41704
Published: 2025-10-14
Description: An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://certvde.com/de/advisories/VDE-2025-072; http://seclists.org/fulldisclosure/2025/Oct/12
CVE: CVE-2025-41705
Published: 2025-10-14
Description: An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-523
References: https://certvde.com/de/advisories/VDE-2025-072; http://seclists.org/fulldisclosure/2025/Oct/12
CVE: CVE-2025-41706
Published: 2025-10-14
Description: The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://certvde.com/de/advisories/VDE-2025-072; http://seclists.org/fulldisclosure/2025/Oct/12
CVE: CVE-2025-41707
Published: 2025-10-14
Description: The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://certvde.com/de/advisories/VDE-2025-072; http://seclists.org/fulldisclosure/2025/Oct/12
CVE: CVE-2025-55078
Published: 2025-10-14
Description: In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is outside the module memory region.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-233
References: https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-wcfg-5jpf-hhxq
CVE: CVE-2025-41699
Published: 2025-10-14
Description: An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection').
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-074.json
CVE: CVE-2025-41718
Published: 2025-10-14
Description: A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-091.json
CVE: CVE-2025-46581
Published: 2025-10-14
Description: ZTE's ZXCDN product  is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]734546826
CVE: CVE-2011-20001
Published: 2025-10-14
Description: A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All versions < V2.0.3), SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants) (All versions < V2.0.3). The web server interface of affected devices improperly processes incoming malformed HTTP traffic at high rate. This could allow an unauthenticated remote attacker to force the device entering the stop/defect state, thus creating a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-625789.html
CVE: CVE-2011-20002
Published: 2025-10-14
Description: A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All versions < V2.0.2), SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants) (All versions < V2.0.2). Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This could allow an on-path attacker between the engineering software and the controller to execute any previously recorded commands at a later time (e.g. set the controller to STOP), regardless whether or not the controller had a password configured.
CVSS Score: 7.4 (HIGH)
CWE: CWE-294
References: https://cert-portal.siemens.com/productcert/html/ssa-625789.html
CVE: CVE-2025-10228
Published: 2025-10-14
Description: Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking.This issue affects Agentis: before 4.44.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://www.usom.gov.tr/bildirim/tr-25-0336
CVE: CVE-2025-20709
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415809; Issue ID: MSV-3405.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20710
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418785; Issue ID: MSV-3515.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20711
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422399; Issue ID: MSV-3748.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20712
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20713
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432661; Issue ID: MSV-3904.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20714
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432659; Issue ID: MSV-3902.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20715
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00421152; Issue ID: MSV-3731.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20716
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00421149; Issue ID: MSV-3728.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20717
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00419946; Issue ID: MSV-3582.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20718
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00419945; Issue ID: MSV-3581.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20719
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418955; Issue ID: MSV-3570.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20720
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418954; Issue ID: MSV-3569.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20721
Published: 2025-10-14
Description: In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20722
Published: 2025-10-14
Description: In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20723
Published: 2025-10-14
Description: In gnss driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920033; Issue ID: MSV-3797.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-20724
Published: 2025-10-14
Description: In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418894; Issue ID: MSV-3475.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-bulletin/October-2025
CVE: CVE-2025-40755
Published: 2025-10-14
Description: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. (ZDI-CAN-26570)
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://cert-portal.siemens.com/productcert/html/ssa-318832.html
CVE: CVE-2025-40765
Published: 2025-10-14
Description: A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-062309.html
CVE: CVE-2025-40771
Published: 2025-10-14
Description: A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.4.24), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.4.24), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.4.24). Affected devices do not properly authenticate configuration connections. This could allow an unauthenticated remote attacker to access the configuration data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://cert-portal.siemens.com/productcert/html/ssa-486936.html
CVE: CVE-2025-40772
Published: 2025-10-14
Description: A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications are vulnerable to stored Cross-Site Scripting (XSS), allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page.

Successful exploitation allows an attacker to impersonate other users within the application and steal their session data. This could enable unauthorized access to accounts and potentially lead to privilege escalation.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-599451.html
CVE: CVE-2025-40773
Published: 2025-10-14
Description: A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request.

Successful exploitation allows an attacker to potentially manipulate data belonging to other users.
CVSS Score: 3.5 (LOW)
CWE: CWE-639
References: https://cert-portal.siemens.com/productcert/html/ssa-599451.html
CVE: CVE-2025-40774
Published: 2025-10-14
Description: A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. Decryption keys are accessible to users with administrative privileges, allowing them to recover passwords.

Successful exploitation of this vulnerability allows an attacker to obtain and use valid user passwords. This can lead to unauthorized access to user accounts, data breaches, and potential system compromise.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-257
References: https://cert-portal.siemens.com/productcert/html/ssa-599451.html
CVE: CVE-2025-40809
Published: 2025-10-14
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-541582.html
CVE: CVE-2025-40810
Published: 2025-10-14
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-541582.html
CVE: CVE-2025-40811
Published: 2025-10-14
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-541582.html
CVE: CVE-2025-40812
Published: 2025-10-14
Description: A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-541582.html
CVE: CVE-2025-9437
Published: 2025-10-14
Description: A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, resulting in denial-of-service. This vulnerability is possible due to the input of invalid values into Component Object Model (COM) methods.
CWE: CWE-755
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1751.html
CVE: CVE-2025-10610
Published: 2025-10-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection.This issue affects Winsure: through Version dated 21.08.2025.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0337
CVE: CVE-2025-11498
Published: 2025-10-14
Description: An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1236
References: https://www.br-automation.com/fileadmin/SA25P003-178b6a20.pdf
CVE: CVE-2025-11708
Published: 2025-10-14
Description: Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1988931; https://www.mozilla.org/security/advisories/mfsa2025-81/; https://www.mozilla.org/security/advisories/mfsa2025-83/