deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8302
Published: 2025-09-02
Description: Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26553.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-879/
CVE: CVE-2025-8613
Published: 2025-09-02
Description: Vacron Camera ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vacron Camera devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the webs.cgi endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-25892.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.zerodayinitiative.com/advisories/ZDI-25-805/
CVE: CVE-2025-8614
Published: 2025-09-02
Description: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine.  An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-26766.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://kb.nomachine.com/TR04W11314; https://www.zerodayinitiative.com/advisories/ZDI-25-835/
CVE: CVE-2025-9273
Published: 2025-09-02
Description: CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of CData API Server. Authentication is required to exploit this vulnerability.

The specific flaw exists within the usage of MySQL connections. When connecting to a MySQL server, the product enables an option that gives the MySQL server permission to request local files from the MySQL client. An attacker can leverage this vulnerability to disclose information in the context of NETWORK SERVICE. Was ZDI-CAN-23950.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552
References: https://www.zerodayinitiative.com/advisories/ZDI-25-852/
CVE: CVE-2025-9274
Published: 2025-09-02
Description: Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21657.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.zerodayinitiative.com/advisories/ZDI-25-853/
CVE: CVE-2025-9275
Published: 2025-09-02
Description: Oxford Instruments Imaris Viewer IMS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21655.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-854/
CVE: CVE-2025-9276
Published: 2025-09-02
Description: Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cert container image.

The specific flaw exists within the configuration of the system shadow file. The issue results from a blank password setting for the root user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22195.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-258
References: https://www.zerodayinitiative.com/advisories/ZDI-25-855/
CVE: CVE-2025-9830
Published: 2025-09-02
Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids[] results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiaoxinkaishi/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.322177
CVE: CVE-2025-9323
Published: 2025-09-02
Description: Foxit PDF Reader JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-27101.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-869/
CVE: CVE-2025-9324
Published: 2025-09-02
Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26802.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-868/
CVE: CVE-2025-9325
Published: 2025-09-02
Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26785.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-867/
CVE: CVE-2025-9326
Published: 2025-09-02
Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26784.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-866/
CVE: CVE-2025-9327
Published: 2025-09-02
Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26774.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-865/
CVE: CVE-2025-9328
Published: 2025-09-02
Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26773.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-864/
CVE: CVE-2025-9329
Published: 2025-09-02
Description: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26772.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-863/
CVE: CVE-2025-9330
Published: 2025-09-02
Description: Foxit PDF Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Foxit Reader Update Service. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. Was ZDI-CAN-25709.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.foxit.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-870/
CVE: CVE-2025-9831
Published: 2025-09-02
Description: A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiaoxinkaishi/cve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.322178
CVE: CVE-2025-9832
Published: 2025-09-02
Description: A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register-router.php. Such manipulation of the argument phone leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/lrjbsyh/CVE_Hunter/issues/11; https://github.com/lrjbsyh/CVE_Hunter/issues/11#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322179
CVE: CVE-2025-9833
Published: 2025-09-02
Description: A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/login.php. Performing manipulation of the argument uname results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/17; https://vuldb.com/?ctiid.322180; https://vuldb.com/?id.322180
CVE: CVE-2025-9834
Published: 2025-09-02
Description: A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Executing manipulation of the argument Username can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/YoSheep/cve/blob/main/PHPGurukul%20Small%20CRM%20in%20PHP%20V4.0%20Multiple%20Stored%20Cross-Site%20Scripting%20(XSS)%20Vulnerabilities.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.322181
CVE: CVE-2025-9835
Published: 2025-09-02
Description: A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639, CWE-863
References: https://github.com/ez-lbz/poc/issues/46; https://github.com/ez-lbz/poc/issues/46#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322182
CVE: CVE-2025-9836
Published: 2025-09-02
Description: A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderId results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639
References: https://github.com/ez-lbz/poc/issues/47; https://github.com/ez-lbz/poc/issues/47#issue[PII_REDACTED]; https://vuldb.com/?ctiid.322183
CVE: CVE-2025-9837
Published: 2025-09-02
Description: A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the file /admin/modules/student/index.php. This manipulation of the argument studentId causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hjsjbsg/record-for-own/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.322184
CVE: CVE-2024-40653
Published: 2025-09-02
Description: In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://android.googlesource.com/platform/packages/services/Telecomm/+/12016109c473d8d[PII_REDACTED]26b1dcbce041e41; https://android.googlesource.com/platform/packages/services/Telecomm/+/9211d16c49de08a87e2e09380f6076ffd5196987; https://android.googlesource.com/platform/packages/services/Telecomm/+/c6e005381b8f0b80f2a1e0ea6e8093e990e1790e
CVE: CVE-2024-49720
Published: 2025-09-02
Description: In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: https://android.googlesource.com/platform/packages/modules/Permission/+/e02775c62a81b99ba4cc693dd1885cc70c0bd5cf; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2024-49722
Published: 2025-09-02
Description: In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-610
References: https://android.googlesource.com/platform/frameworks/base/+/2b4d662a462c6b0269a6e6035ce443ec29fd860e; https://android.googlesource.com/platform/frameworks/base/+/8cba0e8bcfc291977f33f14fba0bd2b7f7fe8f6c; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2024-49728
Published: 2025-09-02
Description: In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-610
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4b65cbb339db4d3a7a9a6100cb2e7c9f1ece9271; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2024-49730
Published: 2025-09-02
Description: In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://android.googlesource.com/platform/packages/providers/MediaProvider/+/961c8cbd2a489277876aeffa40ebdee5eae29f1f; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22416
Published: 2025-09-02
Description: In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/frameworks/base/+/82aa8527b7da3dbbc2f19c869b4ded106e140452; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22417
Published: 2025-09-02
Description: In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://android.googlesource.com/platform/frameworks/base/+/89e32320207c1f332dd84024a13b001320d8c63d; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22418
Published: 2025-09-02
Description: In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/packages/apps/Settings/+/ad9fb985df470bed5f77da4701f2aebe45af5ff3; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22419
Published: 2025-09-02
Description: In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1021
References: https://android.googlesource.com/platform/packages/services/Telephony/+/92f47baf4505e474376c0550e8b8cd25d19e74e2; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22421
Published: 2025-09-02
Description: In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-209
References: https://android.googlesource.com/platform/frameworks/base/+/3b0704fd381a1ea32591aba99be3a9e4e6830be2; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22422
Published: 2025-09-02
Description: In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-639
References: https://android.googlesource.com/platform/frameworks/base/+/6894ba3da6da99eb0ef63d95bf1b19080d302eda; https://android.googlesource.com/platform/packages/apps/Settings/+/1c0ab9c696d736da0176aa00f7effa31c905430e; https://source.android.com/security/bulletin/2025-04-01
CVE: CVE-2025-22423
Published: 2025-09-02
Description: In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://android.googlesource.com/platform/external/dng_sdk/+/748dbd7dfcecb19f3a19caaba4285e059f32d2dd; https://source.android.com/security/bulletin/2025-04-01