deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-55625
Published: 2025-08-22
Description: An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior that supports redirection to Alexa URLs, which are not guaranteed to remain at the same domain indefinitely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-601
References: https://cwe.mitre.org/data/definitions/601.html; https://relieved-knuckle-264.notion.site/Reolink-Deeplink-Redirect-21b[PII_REDACTED]04a865af2fb02942f66
CVE: CVE-2025-55626
Published: 2025-08-22
Description: An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] allows unauthorized attackers to access the Admin-only settings and edit the session storage.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://relieved-knuckle-264.notion.site/Access-the-Administrator-Settings-page-with-IDOR-23c[PII_REDACTED]0c3a8fccc2bbdcda78c?source=copy_link
CVE: CVE-2025-55627
Published: 2025-08-22
Description: Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] allows authenticated attackers to create accounts with elevated privileges.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269
References: https://relieved-knuckle-264.notion.site/Account-Takeover-Create-Account-23c[PII_REDACTED]0c2b0bddba94a9362ed
CVE: CVE-2025-55629
Published: 2025-08-22
Description: Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] allow attackers to arbitrarily change other users' passwords via manipulation of the userName value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-378
References: https://relieved-knuckle-264.notion.site/Account-Takeover-Change-password-23c[PII_REDACTED]06bb821fec983aedb9f?source=copy_link
CVE: CVE-2025-55630
Published: 2025-08-22
Description: A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] when entering the wrong username and password allows attackers to enumerate existing accounts.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://relieved-knuckle-264.notion.site/User-Enumeration-Vulnerability-23c[PII_REDACTED]0b6a46ae6302818b77e?source=copy_link
CVE: CVE-2025-55631
Published: 2025-08-22
Description: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] was discovered to manage users' sessions system wide instead of an account-by-account basis, potentially leading to a Denial of Service (DoS) via resource exhaustion. NOTE: the Supplier reports that the system-wide limit is intentional.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-400
References: https://relieved-knuckle-264.notion.site/Token-max-Dos-23c[PII_REDACTED]04db673cbd5449fcc67?source=copy_link
CVE: CVE-2025-55634
Published: 2025-08-22
Description: Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] allows unauthorized attackers to cause a Denial of Service (DoS) via initiating a large number of simultaneous ffmpeg-based stream pushes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cwe.mitre.org/data/definitions/306.html; https://cwe.mitre.org/data/definitions/400.html; https://relieved-knuckle-264.notion.site/RTMP-Injection-DoS-through-Unauthenticated-Stream-Publish-23c[PII_REDACTED]00297c8c128b6117885?pvs=74
CVE: CVE-2025-55637
Published: 2025-08-22
Description: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_[PII_REDACTED] was discovered to contain a command injection vulnerability via the setddns_pip_system() function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://cwe.mitre.org/data/definitions/78.html; https://relieved-knuckle-264.notion.site/Reolink-camera-command-injection-Ddns-username-23f[PII_REDACTED]00f83aef6b07f914212?pvs=74
CVE: CVE-2025-55745
Published: 2025-08-22
Description: UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection, also known as formula injection, in the Quick Export feature. This vulnerability allows attackers to inject malicious content into exported CSV files. When the CSV file is opened in spreadsheet applications such as Microsoft Excel, the malicious input may be interpreted as a formula or command, potentially resulting in the execution of arbitrary code on the victim's device. Successful exploitation can lead to remote code execution, including the establishment of a reverse shell. Users are advised to upgrade to version 0.3.1 or later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://github.com/unopim/unopim/commit/b25db9496fc147842a519d1dd42ec03c3bf00a34; https://github.com/unopim/unopim/security/advisories/GHSA-74rg-6f92-g6wx
CVE: CVE-2025-57105
Published: 2025-08-22
Description: The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 function in in mng_platform.asp, and sub_4A12DC function in wayos_ac_server.asp of the jhttpd program, with the parameter ac_mng_srv_host.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://di-7400.com; https://github.com/xyh4ck/iot_poc; https://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DI-7400G%2B
CVE: CVE-2025-57770
Published: 2025-08-22
Description: The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6, and all versions prior to 2.71.15 are vulnerable to a username enumeration issue in the login interface. The login UI includes a security feature, Ignoring unknown usernames, that is intended to prevent username enumeration by returning a generic response for both valid and invalid usernames. This vulnerability allows an unauthenticated attacker to bypass this protection by submitting arbitrary userIDs to the select account page and distinguishing between valid and invalid accounts based on the system's response. For effective exploitation, an attacker needs to iterate through possible userIDs, but the impact can be limited by implementing rate limiting or similar measures. The issue has been patched in versions 4.0.3, 3.4.0, and 2.71.15.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/zitadel/zitadel/commit/7abe759c95cb360524d88b51744d03cbb6e4dcdb; https://github.com/zitadel/zitadel/releases/tag/v2.71.15; https://github.com/zitadel/zitadel/releases/tag/v3.4.0
CVE: CVE-2025-57771
Published: 2025-08-22
Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution for a command such as ls, an attacker who can submit crafted prompts to the agent may inject arbitrary commands to be executed alongside the intended command. Exploitation requires attacker access to submit prompts and for the user to have enabled auto-approved command execution, which is disabled by default. This vulnerability could allow an attacker to execute arbitrary code. The issue is fixed in version 3.25.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://github.com/RooCodeInc/Roo-Code/commit/de359a465c67aefc67553aa2b464591b602c4bdc; https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-wrh9-463x-7wvv
CVE: CVE-2025-57800
Published: 2025-08-22
Description: Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs. This vulnerability impacts all Audiobookshelf deployments using OIDC; no IdP misconfiguration is required. The issue is fixed in version 2.28.0. No known workarounds exist.
CVSS Score: 8.8 (HIGH)
CWE: CWE-523, CWE-598, CWE-601
References: https://github.com/advplyr/audiobookshelf/commit/99a3867ce934b797e21e6ba5390d4b679e35f7cb; https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-vpc2-w73p-39px
CVE: CVE-2024-50645
Published: 2025-08-22
Description: MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gitee.com/fushuling/cve/blob/master/CVE-2024-50645.md; https://github.com/zongzibinbin/MallChat; https://github.com/zongzibinbin/MallChat/issues/179
CVE: CVE-2024-52786
Published: 2025-08-22
Description: An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-287
References: https://gitee.com/anji-plus/report/issues/IB3ED6; https://gitee.com/fushuling/cve/blob/master/CVE-2024-52786.md
CVE: CVE-2024-53496
Published: 2025-08-22
Description: Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://gitee.com/fushuling/cve/blob/master/CVE-2024-53496.md; https://github.com/5kywa1ker/mall/issues/19
CVE: CVE-2024-53499
Published: 2025-08-22
Description: Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.huayi-tec.com/; https://gitee.com/erzhongxmu/JEEWMS/issues/IB2XZG; https://gitee.com/fushuling/cve/blob/master/CVE-2024-53499.md
CVE: CVE-2025-43760
Published: 2025-08-22
Description: A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43760
CVE: CVE-2025-52085
Published: 2025-08-22
Description: An SQL injection vulnerability in Yoosee application v6.32.4 allows authenticated users to inject arbitrary SQL queries via a request to a backend API endpoint. Successful exploitation enables extraction of sensitive database information, including but not limited to, the database server banner and version, current database user and schema, the current DBMS user privileges, and arbitrary data from any table.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21; https://yoosee.app
CVE: CVE-2025-52287
Published: 2025-08-22
Description: OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://gist.github.com/ChangeYourWay/5bf54a234611f14fba1af03ad91e62f8; https://github.com/ChangeYourWay/post/blob/main/ELite
CVE: CVE-2025-55581
Published: 2025-08-22
Description: D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the `dcp` and `signalc` binaries without validating their integrity, origin, or permissions. An attacker with filesystem access (e.g., via UART or firmware modification) may replace these binaries to achieve persistent arbitrary code execution with root privileges. The issue stems from improper handling of executable trust and absence of integrity checks in the watchdog logic.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269, CWE-306, CWE-494
References: https://cybermaya.in/posts/Post-42/; https://legacy.us.dlink.com/pages/product.aspx?id=f9c0458bfe7b4ff3bf7fad1cf6fcc9a1; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-55613
Published: 2025-08-22
Description: Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_58/58.md
CVE: CVE-2022-45134
Published: 2025-08-22
Description: Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://bugs.launchpad.net/mahara/+bug/1993082; https://mahara.org/interaction/forum/topic.php?id=9353
CVE: CVE-2024-48988
Published: 2025-08-22
Description: SQL Injection vulnerability in Apache StreamPark.

This issue affects Apache StreamPark: from 2.1.4 before 2.1.6.

Users are recommended to upgrade to version 2.1.6, which fixes the issue.


This vulnerability is present only in the distribution package (SpringBoot platform) and does not involve Maven artifacts.
It can only be exploited after a user has successfully logged into the platform (implying that the attacker would first need to compromise the login authentication). 
As a result, the associated risk is considered relatively low.
CVSS Score: 7.6 (HIGH)
CWE: CWE-564, CWE-89
References: https://lists.apache.org/thread/26ng8388l93zwjrst560cbjz9x7wpq1s; http://www.openwall.com/lists/oss-security/2025/08/22/1
CVE: CVE-2025-43758
Published: 2025-08-22
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43758
CVE: CVE-2025-43759
Published: 2025-08-22
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.
CVSS Score: 2.7 (LOW)
CWE: CWE-732
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43759
CVE: CVE-2025-43762
Published: 2025-08-22
Description: Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43762
CVE: CVE-2025-4650
Published: 2025-08-22
Description: User with high privileges is able to introduce a SQLi using the Meta Service indicator page. Caused by an Improper Neutralization of Special Elements used in an SQL Command.This issue affects web: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-4650-centreon-web-all-versions-high-severity-4901
CVE: CVE-2025-50858
Published: 2025-08-22
Description: Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstorm.news/files/id/208533; https://www.ehcp.net/?p=402
CVE: CVE-2025-50859
Published: 2025-08-22
Description: Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the template parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstorm.news/files/id/208533; https://www.ehcp.net/?p=402
CVE: CVE-2025-51092
Published: 2025-08-22
Description: The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn() and signUp() build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareData() function exists, it is insufficient to prevent SQL injection and does not sanitize the table name.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://abimelsbk.hashnode.dev/sql-injection-vulnerability-at-login-signup-php-project
CVE: CVE-2025-54812
Published: 2025-08-22
Description: Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.


When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file.
If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user.
In order to activate this, the following sequence must occur:



  *  Log4cxx is configured to use HTMLLayout.

  *  Logger name comes from an untrusted string

  *  Logger with compromised name logs a message

  *  User opens the generated HTML log file in their browser, leading to potential XSS


Because logger names are generally constant strings, we assess the impact to users as LOW


This issue affects Apache Log4cxx: before 1.5.0.


Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-117
References: https://github.com/apache/logging-log4cxx/pull/509; https://github.com/apache/logging-log4cxx/pull/514; https://logging.apache.org/security.html#CVE-2025-54812
CVE: CVE-2025-54813
Published: 2025-08-22
Description: Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.

When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.

This issue affects Apache Log4cxx: before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-117
References: https://github.com/apache/logging-log4cxx/pull/512; https://logging.apache.org/security.html#CVE-2025-54813; http://www.openwall.com/lists/oss-security/2025/08/22/3
CVE: CVE-2025-55454
Published: 2025-08-22
Description: An authenticated arbitrary file upload vulnerability in the component /msg/sendfiles of DooTask v1.0.51 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.notion.so/Dootask-Arbitrary-file-upload-vulnerability-2162818a9e118053a586cf4bc05fd1fa
CVE: CVE-2025-6791
Published: 2025-08-22
Description: In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon web (Monitoring event logs modules) allows SQL Injection.This issue affects web: 24.10.0, 24.04.0, 23.10.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-6791-centreon-web-all-versions-high-severity-4900
CVE: CVE-2022-31491
Published: 2025-08-22
Description: Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can use this to run arbitrary code immediately regardless of any managed UPS state or presence.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94, CWE-749
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-05; https://www.ready2disclose.com/vpow-31491-43110/
CVE: CVE-2022-43110
Published: 2025-08-22
Description: Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface. An unauthenticated remote attacker can make changes to the system including: changing the web interface admin password, view/change system configuration, enumerate connected UPS devices and shut down connected UPS devices. This extends to being able to configure operating system commands that should run if the system detects a connected UPS shutting down.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-306, CWE-425
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-182-05; https://www.ready2disclose.com/vpow-31491-43110/
CVE: CVE-2025-57801
Published: 2025-08-22
Description: gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value from a signature without asserting that 0 ≤ S < order, leading to a signature malleability vulnerability. Because gnark’s native EdDSA and ECDSA circuits lack essential constraints, multiple distinct witnesses can satisfy the same public inputs. In protocols where nullifiers or anti-replay checks are derived from R and S, this enables signature malleability and may allow double spending. This issue has been addressed in version 0.14.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347
References: https://github.com/Consensys/gnark/commit/0ba6730f05537a351517998add89a61a0d82716e; https://github.com/Consensys/gnark/security/advisories/GHSA-95v9-hv42-pwrj
CVE: CVE-2022-45133
Published: 2025-08-22
Description: Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the server to obtain access to secure files or cause code execution based on the payload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-26
References: https://bugs.launchpad.net/mahara/+bug/1995819; https://mahara.org/interaction/forum/topic.php?id=9353
CVE: CVE-2025-26496
Published: 2025-08-22
Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-843
References: https://help.salesforce.com/s/articleView?id=005132575&type=1; https://www.cve.org/CVERecord?id=CVE-2022-1364