deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6264
Published: 2025-06-20
Description: Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.

The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. 

This can lead to arbitrary command execution and endpoint takeover.

To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/; https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/; https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
CVE: CVE-2025-6299
Published: 2025-06-20
Description: A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boa/formWSC. The manipulation of the argument targetAPSsid leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://docs.google.com/document/d/1meuD3WLzPE0HHQAm_Ar6zx1NDyO29zsK/edit?usp=sharing&ouid=[PII_REDACTED][PII_REDACTED]&rtpof=true&sd=true; https://vuldb.com/?ctiid.313299; https://vuldb.com/?id.313299
CVE: CVE-2025-6300
Published: 2025-06-20
Description: A vulnerability classified as critical was found in PHPGurukul Employee Record Management System 1.3. This vulnerability affects unknown code of the file /admin/editempeducation.php. The manipulation of the argument yopgra leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/GarminYoung/myCVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.313300
CVE: CVE-2025-6301
Published: 2025-06-20
Description: A vulnerability, which was classified as problematic, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the file /admin/manage-notices.php of the component Add Notice. The manipulation of the argument Title/Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.313301; https://vuldb.com/?id.313301
CVE: CVE-2025-6302
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Comment leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://kn0sinna.notion.site/TOTOLINK-EX1200T-stack-based-BufferOverflow-vulnerability-20fb1876cd6e80d5b4d1f7ec16de4ec2; https://vuldb.com/?ctiid.313302; https://vuldb.com/?id.313302
CVE: CVE-2025-6303
Published: 2025-06-20
Description: A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /contactus1.php. The manipulation of the argument Message leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/trinity273-max/cve/issues/2; https://vuldb.com/?ctiid.313303
CVE: CVE-2025-6304
Published: 2025-06-20
Description: A vulnerability was found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /cart.php. The manipulation of the argument qty[] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/trinity273-max/cve/issues/1; https://vuldb.com/?ctiid.313304
CVE: CVE-2025-6305
Published: 2025-06-20
Description: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_feature.php. The manipulation of the argument product_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kali-001/cve/issues/3; https://vuldb.com/?ctiid.313305
CVE: CVE-2025-6306
Published: 2025-06-20
Description: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/admin_index.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kali-001/cve/issues/2; https://vuldb.com/?ctiid.313306
CVE: CVE-2025-6307
Published: 2025-06-20
Description: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /function/edit_customer.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/kali-001/cve/issues/1; https://vuldb.com/?ctiid.313307
CVE: CVE-2025-6308
Published: 2025-06-20
Description: A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/bwdates-request-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/68; https://phpgurukul.com/; https://vuldb.com/?ctiid.313308
CVE: CVE-2025-6309
Published: 2025-06-20
Description: A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add-ambulance.php. The manipulation of the argument ambregnum leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/69; https://phpgurukul.com/; https://vuldb.com/?ctiid.313309
CVE: CVE-2025-6310
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Message leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/70; https://phpgurukul.com/; https://vuldb.com/?ctiid.313310
CVE: CVE-2025-5125
Published: 2025-06-20
Description: The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/aaf9e3f8-b312-432d-a635-6fe89ff8d13f/; https://wpscan.com/vulnerability/aaf9e3f8-b312-432d-a635-6fe89ff8d13f/
CVE: CVE-2025-6311
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /pages/account_add.php. The manipulation of the argument id/amount leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dragonghost2025/cve/issues/1; https://vuldb.com/?ctiid.313311; https://vuldb.com/?id.313311
CVE: CVE-2025-6312
Published: 2025-06-20
Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/cash_transaction.php. The manipulation of the argument cid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dragonghost2025/cve/issues/3; https://vuldb.com/?ctiid.313312; https://vuldb.com/?id.313312
CVE: CVE-2025-50054
Published: 2025-06-20
Description: Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://community.openvpn.net/Downloads#openvpn-27_alpha2-released-19-june-2025; https://community.openvpn.net/Security%20Announcements/CVE-2025-50054
CVE: CVE-2025-6313
Published: 2025-06-20
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/cat_add.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dragonghost2025/cve/issues/4; https://vuldb.com/?ctiid.313313; https://vuldb.com/?id.313313
CVE: CVE-2025-6314
Published: 2025-06-20
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/cat_update.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dragonghost2025/cve/issues/5; https://vuldb.com/?ctiid.313314; https://vuldb.com/?id.313314
CVE: CVE-2025-6315
Published: 2025-06-20
Description: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /cart2.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/vphcc/cve1/issues/1; https://vuldb.com/?ctiid.313315
CVE: CVE-2025-6316
Published: 2025-06-20
Description: A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. The manipulation of the argument qty leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/vphcc/cve1/issues/2; https://vuldb.com/?ctiid.313316
CVE: CVE-2025-6317
Published: 2025-06-20
Description: A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/confirm.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/vphcc/cve1/issues/3; https://vuldb.com/?ctiid.313317
CVE: CVE-2025-6318
Published: 2025-06-20
Description: A vulnerability classified as critical was found in PHPGurukul Pre-School Enrollment System 1.0. This vulnerability affects unknown code of the file /admin/check_availability.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/71; https://phpgurukul.com/; https://vuldb.com/?ctiid.313318
CVE: CVE-2025-6319
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Pre-School Enrollment System 1.0. This issue affects some unknown processing of the file /admin/add-teacher.php. The manipulation of the argument tsubject leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/72; https://phpgurukul.com/; https://vuldb.com/?ctiid.313319
CVE: CVE-2025-6257
Published: 2025-06-20
Description: The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/joostdekeijzer/wp_eurofxref/commit/131108428f0d88dab[PII_REDACTED]bdd54f10c36a0; https://plugins.trac.wordpress.org/changeset/3314562; https://wordpress.org/plugins/euro-fxref-currency-converter/#developers
CVE: CVE-2025-6320
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Pre-School Enrollment System 1.0. Affected is an unknown function of the file /admin/add-class.php. The manipulation of the argument classname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/73; https://phpgurukul.com/; https://vuldb.com/?ctiid.313320
CVE: CVE-2025-6321
Published: 2025-06-20
Description: A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-subadmin.php. The manipulation of the argument sadminusername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/74; https://phpgurukul.com/; https://vuldb.com/?ctiid.313321
CVE: CVE-2025-6322
Published: 2025-06-20
Description: A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /visit.php. The manipulation of the argument gname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/75; https://phpgurukul.com/; https://vuldb.com/?ctiid.313322
CVE: CVE-2025-6323
Published: 2025-06-20
Description: A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /enrollment.php. The manipulation of the argument fathername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/76; https://phpgurukul.com/; https://vuldb.com/?ctiid.313323
CVE: CVE-2025-5255
Published: 2025-06-20
Description: The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

This issue was fixed in commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da
CWE: CWE-276
References: https://cert.pl/en/posts/2025/06/tcc-bypass/; https://github.com/phcode-dev/phoenix-desktop/commit/ab5d5ffd04fbbab770c1ef6250cd0ec5323289c2; https://phcode.dev/
CVE: CVE-2025-5963
Published: 2025-06-20
Description: The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

The original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure.
CWE: CWE-276
References: https://cert.pl/en/posts/2025/06/tcc-bypass/; https://www.postbox-inc.com/
CVE: CVE-2025-6328
Published: 2025-06-20
Description: A vulnerability was found in D-Link DIR-815 1.01. It has been declared as critical. This vulnerability affects the function sub_403794 of the file hedwig.cgi. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/Thir0th/Thir0th-CVE/blob/main/D-Link%20DIR-815%20RevA%20v1.01.md; https://vuldb.com/?ctiid.313324; https://vuldb.com/?id.313324
CVE: CVE-2025-6329
Published: 2025-06-20
Description: A vulnerability was found in ScriptAndTools Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file userdelete.php of the component User Delete Handler. The manipulation of the argument ID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-639
References: https://vuldb.com/?ctiid.313325; https://vuldb.com/?id.313325; https://vuldb.com/?submit.596472
CVE: CVE-2025-6330
Published: 2025-06-20
Description: A vulnerability classified as critical has been found in PHPGurukul Directory Management System 1.0. Affected is an unknown function of the file /searchdata.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/77; https://phpgurukul.com/; https://vuldb.com/?ctiid.313326
CVE: CVE-2025-6331
Published: 2025-06-20
Description: A vulnerability classified as critical was found in PHPGurukul Directory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search-directory.php. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/78; https://phpgurukul.com/; https://vuldb.com/?ctiid.313327
CVE: CVE-2025-4981
Published: 2025-06-20
Description: Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-427
References: https://mattermost.com/security-updates
CVE: CVE-2025-6332
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown functionality of the file /admin/manage-directory.php. The manipulation of the argument del leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/79; https://phpgurukul.com/; https://vuldb.com/?ctiid.313328
CVE: CVE-2025-6333
Published: 2025-06-20
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Directory Management System 2.0. This affects an unknown part of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/80; https://phpgurukul.com/; https://vuldb.com/?ctiid.313329
CVE: CVE-2025-6334
Published: 2025-06-20
Description: A vulnerability has been found in D-Link DIR-867 1.0 and classified as critical. This vulnerability affects the function strncpy of the component Query String Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/Thir0th/Thir0th-CVE/blob/main/DIR-867%20AC1750.md; https://vuldb.com/?ctiid.313330; https://vuldb.com/?id.313330