deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-66323
Published: 2025-12-08
Description: Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-358
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66324
Published: 2025-12-08
Description: Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.
CVSS Score: 8.4 (HIGH)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66326
Published: 2025-12-08
Description: Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-12956
Published: 2025-12-08
Description: A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://www.3ds.com/trust-center/security/security-advisories/cve-2025-12956
CVE: CVE-2025-14224
Published: 2025-12-08
Description: A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.334666; https://vuldb.com/?id.334666; https://vuldb.com/?submit.701673
CVE: CVE-2025-26487
Published: 2025-12-08
Description: Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows 
remote unauthenticated users to gain access to other network resources 
using HTTPS requests through the appliance used as a bridge.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26487
CVE: CVE-2025-26488
Published: 2025-12-08
Description: Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a 
reboot of the appliance, thus causing a DoS condition, via crafted XML 
payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26488
CVE: CVE-2025-26489
Published: 2025-12-08
Description: Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and 
reboot the appliance, thus causing a DoS condition, via crafted XML 
payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.cve.org/CVERecord?id=CVE-2025-26489
CVE: CVE-2025-58279
Published: 2025-12-08
Description: Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66325
Published: 2025-12-08
Description: Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66327
Published: 2025-12-08
Description: Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66328
Published: 2025-12-08
Description: Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66329
Published: 2025-12-08
Description: Permission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66330
Published: 2025-12-08
Description: App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66331
Published: 2025-12-08
Description: Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-494
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66332
Published: 2025-12-08
Description: Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-494
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66333
Published: 2025-12-08
Description: Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-494
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-66334
Published: 2025-12-08
Description: Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 3.3 (LOW)
CWE: CWE-494
References: https://consumer.huawei.com/en/support/bulletin/2025/12/
CVE: CVE-2025-14225
Published: 2025-12-08
Description: A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-1/D-Link%20Vulnerability.md; https://vuldb.com/?ctiid.334667; https://vuldb.com/?id.334667
CVE: CVE-2025-14226
Published: 2025-12-08
Description: A vulnerability was identified in itsourcecode Student Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php. The manipulation of the argument fname leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ltranquility/CVE/issues/17; https://itsourcecode.com/; https://vuldb.com/?ctiid.334668
CVE: CVE-2025-14227
Published: 2025-12-08
Description: A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. This issue affects some unknown processing of the file /edit.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/woshinenbaba/CVE-/issues/1; https://vuldb.com/?ctiid.334669; https://vuldb.com/?id.334669
CVE: CVE-2025-14262
Published: 2025-12-08
Description: A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the catalog service using the wrong owner permissions. Therefore it may have been possible to save into spaces where the attacker does not have write permissions.

There is no workaround.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-708
References: https://www.knime.com/security/advisories#CVE-2025-11239
CVE: CVE-2025-27019
Published: 2025-12-08
Description: Remote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows
 an attacker to utilize password-less user accounts and obtain 
system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27019
CVE: CVE-2025-27020
Published: 2025-12-08
Description: Improper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system

.


This issue affects MTC-9: from R22.1.1.0275 before R23.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27020
CVE: CVE-2025-66461
Published: 2025-12-08
Description: FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers  two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN59242986/; https://ps.gs-yuasa.com/technicalinfo/pdf/failure/FMP_info20251201_TEX48214-993.pdf
CVE: CVE-2025-14228
Published: 2025-12-08
Description: A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://drive.google.com/file/d/1vptRtEeoS1AZgnqow1yPrsgsBkw4jXc2/view?usp=sharing; https://vuldb.com/?ctiid.334670; https://vuldb.com/?id.334670
CVE: CVE-2025-14229
Published: 2025-12-08
Description: A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-1236, CWE-1236
References: https://vuldb.com/?ctiid.334671; https://vuldb.com/?id.334671; https://vuldb.com/?submit.702119
CVE: CVE-2025-14230
Published: 2025-12-08
Description: A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php. Performing manipulation of the argument detail_Id results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/woshilaiyi/cve/issues/6; https://vuldb.com/?ctiid.334672
CVE: CVE-2025-14244
Published: 2025-12-08
Description: A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/b1uel0n3/83f9965b3499a2abfee30c77458f718a; https://vuldb.com/?ctiid.334754; https://vuldb.com/?id.334754
CVE: CVE-2025-42615
Published: 2025-12-08
Description: In affected versions, vulnerability-lookup did not track or limit failed
 One-Time Password (OTP) attempts during Two-Factor Authentication (2FA)
 verification. An attacker who already knew or guessed a valid username 
and password could submit an arbitrary number of OTP codes without 
causing the account to be locked or generating any specific alert for 
administrators.


This lack of rate-limiting and lockout on OTP failures significantly 
lowers the cost of online brute-force attacks against 2FA codes and 
increases the risk of successful account takeover, especially if OTP 
entropy is reduced (e.g. short numeric codes, user reuse, or predictable
 tokens). Additionally, administrators had no direct visibility into 
accounts experiencing repeated 2FA failures, making targeted attacks 
harder to detect and investigate.


The patch introduces a persistent failed_otp_attempts counter on user 
accounts, locks the user after 5 invalid OTP submissions, resets the 
counter on successful verification, and surfaces failed 2FA attempts in 
the admin user list. This enforces an account lockout policy for OTP 
brute-force attempts and improves monitoring capabilities for suspicious
 2FA activity.This issue affects Vulnerability-Lookup: before 2.18.0.
CWE: CWE-307
References: https://vulnerability.circl.lu/vuln/gcve-1-2025-0033
CVE: CVE-2025-14245
Published: 2025-12-08
Description: A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the argument params leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/rassec2/dbcve/issues/17; https://vuldb.com/?ctiid.334755; https://vuldb.com/?id.334755
CVE: CVE-2025-42616
Published: 2025-12-08
Description: Some endpoints in vulnerability-lookup that modified 
application state (e.g. changing database entries, user data, 
configurations, or other privileged actions) may have been accessible 
via HTTP GET requests without requiring a CSRF token. This flaw leaves 
the application vulnerable to Cross-Site Request Forgery (CSRF) attacks:
 an attacker who tricks a logged-in user into visiting a malicious 
website could cause the user’s browser to issue GET requests that 
perform unintended state-changing operations in the context of their 
authenticated session.


Because the server would treat these GET requests as valid (since no 
CSRF protection or POST method enforcement was in place), the attacker 
could exploit this to escalate privileges, change settings, or carry out
 other unauthorized actions without needing the user’s explicit consent 
or awareness. 
The fix ensures that all state-changing endpoints now require HTTP POST 
requests and include a valid CSRF token. This enforces that state 
changes cannot be triggered by arbitrary cross-site GET requests. This issue affects Vulnerability-Lookup: before 2.18.0.
CWE: CWE-352
References: https://vulnerability.circl.lu/vuln/gcve-1-2025-0034
CVE: CVE-2025-42620
Published: 2025-12-08
Description: In affected versions, vulnerability-lookup handled user-controlled 
content in comments and bundles in an unsafe way, which could lead to 
stored Cross-Site Scripting (XSS).




On the backend, the related_vulnerabilities field of bundles accepted 
arbitrary strings without format validation or proper sanitization. On 
the frontend, comment and bundle descriptions were converted from 
Markdown to HTML and then injected directly into the DOM using string 
templates and innerHTML. This combination allowed an attacker who could 
create or edit comments or bundles to store crafted HTML/JavaScript 
payloads which would later be rendered and executed in the browser of 
any user visiting the affected profile page (user.html). 







This issue affects Vulnerability-Lookup: before 2.18.0.
CWE: CWE-79
References: https://vulnerability.circl.lu/vuln/gcve-1-2025-0035
CVE: CVE-2025-14246
Published: 2025-12-08
Description: A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settings.php. Performing manipulation of the argument user_id results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/90; https://vuldb.com/?ctiid.334756
CVE: CVE-2025-14247
Published: 2025-12-08
Description: A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/additems.php. Executing manipulation of the argument item_name can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/91; https://vuldb.com/?ctiid.334757
CVE: CVE-2025-14248
Published: 2025-12-08
Description: A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The manipulation of the argument admin_username leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/92; https://vuldb.com/?ctiid.334758
CVE: CVE-2025-14249
Published: 2025-12-08
Description: A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The manipulation of the argument product_id results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/93; https://vuldb.com/?ctiid.334759
CVE: CVE-2025-60912
Published: 2025-12-08
Description: phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an administrator has an active session.
CVSS Score: 3.3 (LOW)
CWE: CWE-352
References: https://gist.github.com/amandrei/a8377d9b71c55156d22aaaf485463d15; https://github.com/phpipam/phpipam
CVE: CVE-2025-14250
Published: 2025-12-08
Description: A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_contact.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/94; https://vuldb.com/?ctiid.334760
CVE: CVE-2025-14251
Published: 2025-12-08
Description: A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/ of the component Admin Login. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/95; https://vuldb.com/?ctiid.334761
CVE: CVE-2025-14271
Published: 2025-12-08
Description: Rejected reason: This CVE ID has been withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-61318
Published: 2025-12-08
Description: Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-24
References: https://github.com/AndyNull/em/blob/main/emlog%20pro%20-%20del%20vuln.md
CVE: CVE-2025-65796
Published: 2025-12-08
Description: Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://memos.com; http://usememos.com; https://github.com/usememos/memos/pull/5217
CVE: CVE-2025-65798
Published: 2025-12-08
Description: Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://memos.com; http://usememos.com; https://github.com/usememos/memos/pull/5217
CVE: CVE-2025-14256
Published: 2025-12-08
Description: A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/J0kkeR/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.334762
CVE: CVE-2025-14257
Published: 2025-12-08
Description: A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/J0kkeR/cve/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.334763
CVE: CVE-2025-22420
Published: 2025-12-08
Description: In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/frameworks/base/+/fb8f76eca9079c34af3e14ee0a58bc10a580ec42; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-22432
Published: 2025-12-08
Description: In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79; https://source.android.com/security/bulletin/2025-12-01