deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27225
Published: 2025-10-27
Description: TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. This endpoint discloses sensitive internal information including PII to unauthenticated attackers.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27225.txt; https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/; https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise
CVE: CVE-2025-54967
Published: 2025-10-27
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in the process.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54967
CVE: CVE-2025-54968
Published: 2025-10-27
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remote users to submit jobs, or local users to submit jobs that will execute with the permissions of other users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54968
CVE: CVE-2025-54969
Published: 2025-10-27
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not implement CSRF protections. An attacker who social engineers a valid user into clicking a malicious link or visiting a malicious website may be able to submit requests to the Job Status Service without the user's knowledge.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54969
CVE: CVE-2025-54970
Published: 2025-10-27
Description: An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allow remote or local users to abort jobs or read information without the permissions of the job owner.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54970
CVE: CVE-2025-12300
Published: 2025-10-27
Description: A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This manipulation of the argument cname causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/20; https://vuldb.com/?ctiid.329972
CVE: CVE-2025-12301
Published: 2025-10-27
Description: A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/22; https://vuldb.com/?ctiid.329973
CVE: CVE-2025-12302
Published: 2025-10-27
Description: A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /editproduct.php. Performing manipulation of the argument pname/category/price results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/21; https://vuldb.com/?ctiid.329974
CVE: CVE-2025-12303
Published: 2025-10-27
Description: A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profile.php. Executing a manipulation of the argument adminname/email can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/kiyoleee/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.329975
CVE: CVE-2025-12363
Published: 2025-10-27
Description: Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://azure-access.com/security-advisories
CVE: CVE-2025-12364
Published: 2025-10-27
Description: Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://azure-access.com/security-advisories
CVE: CVE-2025-54965
Published: 2025-10-27
Description: An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameter before using it in the job status page. An attacker who is able to social engineer a user into clicking a malicious link may be able to execute arbitrary JavaScript in the victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.baesystems.com/en-us/product/geospatial-exploitation-products; https://www.geospatialexploitationproducts.com/content/socet-gxp/vulnerabilities-disclosure/#cve-2025-54965
CVE: CVE-2025-55752
Published: 2025-10-27
Description: Relative Path Traversal vulnerability in Apache Tomcat.

The fix for bug 60013 introduced a regression where the       rewritten URL was normalized before it was decoded. This introduced the       possibility that, for rewrite rules that rewrite query parameters to the       URL, an attacker could manipulate the request URI to bypass security       constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog; http://www.openwall.com/lists/oss-security/2025/10/27/4; https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerability
CVE: CVE-2025-55754
Published: 2025-10-27
Description: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.

Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-150
References: https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd; http://www.openwall.com/lists/oss-security/2025/10/27/5
CVE: CVE-2025-60982
Published: 2025-10-27
Description: IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object identifiers in API requests. Attackers can exploit this flaw to view or modify sensitive records without proper authorization.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md; https://www.educare.school/; https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md
CVE: CVE-2025-60983
Published: 2025-10-27
Description: Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/handyteddy/Security-Advisories/blob/main/Rubikon-XSS.md; https://github.com/handyteddy/Security-Advisories/blob/main/Rubikon-XSS.md
CVE: CVE-2025-61385
Published: 2025-10-27
Description: SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-89
References: https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140; https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385
CVE: CVE-2025-61795
Published: 2025-10-27
Description: Improper Resource Shutdown or Release vulnerability in Apache Tomcat.

If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp; http://www.openwall.com/lists/oss-security/2025/10/27/6
CVE: CVE-2025-12304
Published: 2025-10-27
Description: A vulnerability has been found in dulaiduwang003 TIME-SEA-PLUS up to fb299162f18498dd9cf17da906886d80a077d53b. This affects the function alipayIsSucceed of the file PayController.java of the component Order Status Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/Hwwg/cve/issues/3; https://vuldb.com/?ctiid.329976; https://vuldb.com/?id.329976
CVE: CVE-2025-12305
Published: 2025-10-27
Description: A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobController.java of the component Job Handler. The manipulation results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/dongodid/cve-sub/blob/main/shiyi-blog/RCE.md; https://vuldb.com/?ctiid.329977; https://vuldb.com/?id.329977
CVE: CVE-2025-12306
Published: 2025-10-27
Description: A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/yuan466/CVE/blob/main/one/report.md; https://vuldb.com/?ctiid.329978
CVE: CVE-2025-12307
Published: 2025-10-27
Description: A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/yuan466/CVE/blob/main/two/report.md; https://vuldb.com/?ctiid.329979
CVE: CVE-2025-12308
Published: 2025-10-27
Description: A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/yuan466/CVE/blob/main/three/report.md; https://vuldb.com/?ctiid.329980
CVE: CVE-2025-12309
Published: 2025-10-27
Description: A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/daojian1/Nero-Social-Networking-Site-V1.0_002; https://vuldb.com/?ctiid.329981
CVE: CVE-2025-12365
Published: 2025-10-27
Description: Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://azure-access.com/security-advisories
CVE: CVE-2025-32785
Published: 2025-10-27
Description: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions prior to 6.3 are vulnerable to cross-site scripting (XSS) via the Address field in the Subscribed Lists group management section. An authenticated user can inject malicious JavaScript by adding a payload to the Address field when creating or editing a list entry. The vulnerability is triggered when another user navigates to the Tools section and performs a gravity database update. The Address field does not properly sanitize input, allowing special characters and script tags to bypass validation. This has been patched in version 6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pi-hole/web/security/advisories/GHSA-7w6h-3gwc-qhq5
CVE: CVE-2025-36007
Published: 2025-10-27
Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://www.ibm.com/support/pages/node/7249277
CVE: CVE-2025-36138
Published: 2025-10-27
Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7249278
CVE: CVE-2025-36170
Published: 2025-10-27
Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7249278
CVE: CVE-2025-46602
Published: 2025-10-27
Description: Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-538
References: https://www.dell.com/support/kbdoc/en-us/000382443/dsa-2025-403
CVE: CVE-2025-53533
Published: 2025-10-27
Description: Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting (XSS) via a malformed URL path. The 404 error page includes the requested path in the class attribute of the body tag without proper sanitization or escaping. An attacker can craft a URL containing an onload attribute that will execute arbitrary JavaScript code in the browser when a victim visits the malicious link. If an attacker sends a crafted pi-hole link to a victim and the victim visits it, attacker-controlled JavaScript code is executed in the browser of the victim. This has been patched in version 6.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pi-hole/web/security/advisories/GHSA-w8f8-92rx-4f6w
CVE: CVE-2025-61099
Published: 2025-10-27
Description: FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opaque.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted LS Update packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/issues/19471; https://github.com/FRRouting/frr/pull/19480; https://github.com/FRRouting/frr/pull/19480/commits/0042fbe8ca5aba866b4f0d166e54066bba5ab14e
CVE: CVE-2025-61100
Published: 2025-10-27
Description: FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_opaque.c. This vulnerability allows attackers to cause a Denial of Service (DoS) under specific malformed LSA conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/FRRouting/frr/issues/19471; https://github.com/FRRouting/frr/pull/19480; https://github.com/FRRouting/frr/pull/19480/commits/cda5ddac0940562d1dca7cbef34d0ce5b00f160b
CVE: CVE-2025-62253
Published: 2025-10-27
Description: Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62253
CVE: CVE-2025-12310
Published: 2025-10-27
Description: A security vulnerability has been detected in VirtFusion up to 6.0.2. This vulnerability affects unknown code of the file /account/_settings of the component Email Change Handler. The manipulation leads to improper restriction of excessive authentication attempts. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-799
References: https://vuldb.com/?ctiid.329982; https://vuldb.com/?id.329982; https://vuldb.com/?submit.676825
CVE: CVE-2025-12311
Published: 2025-10-27
Description: A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-category-detail.php. The manipulation of the argument catname results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/kiyoleee/CVE/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.329983
CVE: CVE-2025-12312
Published: 2025-10-27
Description: A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. This manipulation of the argument Fullname/Category causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/kiyoleee/CVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.329984
CVE: CVE-2025-12313
Published: 2025-10-27
Description: A vulnerability has been found in D-Link DI-7001 MINI 19.09.19A1/24.04.18B1. The affected element is an unknown function of the file /msp_info.htm. Such manipulation of the argument cmd leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/DavCloudz/cve/issues/7; https://vuldb.com/?ctiid.329985; https://vuldb.com/?id.329985
CVE: CVE-2025-12314
Published: 2025-10-27
Description: A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/kaka00666/food-ordering-cve/issues/1; https://vuldb.com/?ctiid.329986
CVE: CVE-2025-12315
Published: 2025-10-27
Description: A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulation of the argument itemPrice can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/kaka00666/food-ordering-cve/issues/2; https://vuldb.com/?ctiid.329987