deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-45784
Published: 2025-06-18
Description: D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially leading to unauthorized access to device functions or user accounts. This vulnerability exists due to insecure storage of sensitive information in the firmware binary.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cybermaya.in/posts/Post-37/; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-46157
Published: 2025-06-18
Description: An issue in EfroTech Time Trax v.1.0 allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: http://efrotech.com; http://timetrax.com; https://github.com/morphine009/CVE-2025-46157
CVE: CVE-2025-49015
Published: 2025-06-18
Description: The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-297
References: https://docs.couchbase.com/server/current/release-notes/relnotes.html; https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts/
CVE: CVE-2025-45786
Published: 2025-06-18
Description: Real Estate Management 1.0 is vulnerable to Cross Site Scripting (XSS) in /store/index.php.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://gist.github.com/0xKunAlx0/a80bc7ec5acb2f19daa36257fedbcf11; https://updategadh.com/free-projects/real-estate-management/
CVE: CVE-2025-46109
Published: 2025-06-18
Description: SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET request
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://cocr.cc/2025/04/17/pbootcms/; https://github.com/pbootcmspro/PbootCMS/issues/22
CVE: CVE-2025-6240
Published: 2025-06-18
Description: Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issue affects Profisee: from 2020R1 before 2024R2.
CWE: CWE-20
References: https://profisee.com/security/vulnerabilities/detail/
CVE: CVE-2024-54183
Published: 2025-06-18
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7237060
CVE: CVE-2025-36048
Published: 2025-06-18
Description: IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-250
References: https://www.ibm.com/support/pages/node/7237144
CVE: CVE-2025-36049
Published: 2025-06-18
Description: IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 

is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://www.ibm.com/support/pages/node/7237146
CVE: CVE-2025-44951
Published: 2025-06-18
Description: A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow by changing the `session.dev` field with a value with length greater than 32.
CVSS Score: 7.1 (HIGH)
CWE: CWE-120
References: https://gist.github.com/scmdcs/6d878d6074f0e2f4a8fb69e9864068b7; https://github.com/open5gs/open5gs/commit/e3dd98cd291fba233a46adb2881213fc6e38b924; https://github.com/open5gs/open5gs/issues/3775
CVE: CVE-2025-44952
Published: 2025-06-18
Description: A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a local attacker to cause a Buffer Overflow by changing the `session.dnn` field with a value with length greater than 101.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://gist.github.com/scemodicecosa/8643fbfc9490f40e955e9f9e9b0d9077; https://gist.github.com/scmdcs/8643fbfc9490f40e955e9f9e9b0d9077; https://github.com/open5gs/open5gs/issues/3775
CVE: CVE-2025-4820
Published: 2025-06-18
Description: Impact

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support.



Patches


quiche 0.24.4 is the earliest version containing the fix for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://github.com/cloudflare/quiche/security/advisories/GHSA-2v9p-3p3h-w56j
CVE: CVE-2025-4821
Published: 2025-06-18
Description: Impact

Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support.

An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical expectations and allow more bytes in flight than the path might really support. In extreme cases, the window might grow beyond the limit of the internal variable's type, leading to an overflow panic.



Patches


quiche 0.24.4 is the earliest version containing the fix for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/cloudflare/quiche/security/advisories/GHSA-6m38-4r9r-5c4m
CVE: CVE-2024-54172
Published: 2025-06-18
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.ibm.com/support/pages/node/7237059
CVE: CVE-2025-1348
Published: 2025-06-18
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allow a local user to obtain sensitive information from a user’s web browser cache due to not using a suitable caching policy.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-525
References: https://www.ibm.com/support/pages/node/7237068
CVE: CVE-2025-1349
Published: 2025-06-18
Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 

is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7237109
CVE: CVE-2025-20234
Published: 2025-06-18
Description: A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to a memory overread during UDF file scanning. An attacker could exploit this vulnerability by submitting a crafted file containing UDF content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process, resulting in a DoS condition on the affected software.
For a description of this vulnerability, see the .
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-udf-hmwd9nDy
CVE: CVE-2025-20271
Published: 2025-06-18
Description: A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition in the Cisco AnyConnect service on an affected device.

This vulnerability is due to&nbsp;variable initialization errors when an SSL VPN session is established. An attacker could exploit this vulnerability by sending a sequence of crafted HTTPS requests to an affected device. A successful exploit could allow the attacker to cause the Cisco AnyConnect VPN server to restart, resulting in the failure of all established SSL VPN sessions and forcing remote users to initiate a new VPN connection and re-authenticate. A sustained attack could prevent new SSL VPN connections from being established, effectively making the Cisco AnyConnect VPN service unavailable for all legitimate users.
CVSS Score: 8.6 (HIGH)
CWE: CWE-457
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-sM5GCfm7
CVE: CVE-2025-20260
Published: 2025-06-18
Description: A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffer overflow condition, cause a denial of service (DoS) condition, or execute arbitrary code on an affected device.

This vulnerability exists because memory buffers are allocated incorrectly when PDF files are processed. An attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to trigger a buffer overflow, likely resulting in the termination of the ClamAV scanning process and a DoS condition on the affected software. Although unproven, there is also a possibility that an attacker could leverage the buffer overflow to execute arbitrary code with the privileges of the ClamAV process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html; https://lists.debian.org/debian-lts-announce/2025/09/msg00006.html
CVE: CVE-2025-26198
Published: 2025-06-18
Description: CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5e; https://github.com/tansique-17/CVE-2025-26198/
CVE: CVE-2025-29646
Published: 2025-06-18
Description: An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and (teid = 0 or teid >= ogs_pfcp_pdr_teid_pool.size).
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://gist.github.com/scmdcs/581fa485f957239ea5551daa173d0189; https://github.com/open5gs/open5gs/issues/3747
CVE: CVE-2025-6191
Published: 2025-06-18
Description: Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-472, CWE-190
References: https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/420697404
CVE: CVE-2025-6192
Published: 2025-06-18
Description: Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html; https://issues.chromium.org/issues/421471016
CVE: CVE-2025-26199
Published: 2025-06-18
Description: CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transmits passwords over unencrypted HTTP during the login process, exposing sensitive credentials to potential interception by network-based attackers. A remote attacker with access to the same network (e.g., public Wi-Fi or compromised router) can capture login credentials via Man-in-the-Middle (MitM) techniques. If the attacker subsequently uses the credentials to log in and exploit administrative functions (e.g., file upload), this may lead to remote code execution depending on the environment.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://gist.github.com/tansique-17/6e01bb1b8a09ef499a9b8484a8dc2487; https://github.com/tansique-17/CVE-2025-26199/tree/main
CVE: CVE-2025-49590
Published: 2025-06-18
Description: CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-692
References: https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95; https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607; https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj
CVE: CVE-2025-49591
Published: 2025-06-18
Description: CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284, CWE-287
References: https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/lib/http-worker.js#L356-L364; https://github.com/cryptpad/cryptpad/commit/0c5d4bbf5e5206d53470ea86a664fa2b703fb611; https://github.com/cryptpad/cryptpad/commit/f624f9d457d36040f57c7598d98a8b9461b79837
CVE: CVE-2024-45208
Published: 2025-06-19
Description: The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Directors communicate over TCP ports 4566 and 4570 to exchange High Availability (HA) information using a shared password. Affected versions of Versa Director bound to these ports on all interfaces. An attacker that can access the Versa Director could access the NCS service on port 4566 and exploit it to perform unauthorized administrative actions and perform remote code execution. Customers are recommended to follow the hardening guide.

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://docs.versa-networks.com/Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Director#Harden_Port_4566; https://security-portal.versa-networks.com/emailbulletins/68526c3cdc94d6b9f2faf718; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]3-release-21-2-3
CVE: CVE-2025-23121
Published: 2025-06-19
Description: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.veeam.com/kb4743
CVE: CVE-2025-23168
Published: 2025-06-19
Description: The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the OTP delivery (SMS/email) to their own device. OTP/TOTP codes are not invalidated after use, enabling reuse by an attacker who has previously intercepted or obtained a valid code. In addition, the 2FA system does not adequately restrict the number or frequency of login attempts. The OTP values are generated from a relatively small keyspace, making brute-force attacks more feasible. 

Exploitation Status: 

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.  

Workarounds or Mitigation: 

Versa recommends that Director be upgraded to one of the remediated software versions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-290
References: https://security-portal.versa-networks.com/emailbulletins/68526512dc94d6b9f2faf715; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]3-release-21-2-3; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]0-release-22-1-2
CVE: CVE-2025-23169
Published: 2025-06-19
Description: The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. 

Exploitation Status: 

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.  

Workarounds or Mitigation: 

There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security-portal.versa-networks.com/emailbulletins/68526a08dc94d6b9f2faf716; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]3-release-21-2-3; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]0-release-22-1-2
CVE: CVE-2025-23170
Published: 2025-06-19
Description: The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via Shell-In-A-Box. The underlying Python script, shell-connect.py, is vulnerable to command injection through the user argument. This allows an attacker to execute arbitrary commands on the system. 

Exploitation Status: 

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.  

Workarounds or Mitigation: 

There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: https://security-portal.versa-networks.com/emailbulletins/68526bc7dc94d6b9f2faf717; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]3-release-21-2-3; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]0-release-22-1-2
CVE: CVE-2025-23171
Published: 2025-06-19
Description: The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly limit file upload permissions. The UI appears not to allow file uploads but uploads still succeed. In addition, the Versa Director discloses the full filename of uploaded temporary files, including the UUID prefix. Insecure UCPE image upload in Versa Director allows an authenticated attacker to upload a webshell. 

Exploitation Status: 

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.  

Workarounds or Mitigation: 

There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://security-portal.versa-networks.com/emailbulletins/68526dbbdc94d6b9f2faf71a; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]3-release-21-2-3; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]0-release-22-1-2
CVE: CVE-2025-23172
Published: 2025-06-19
Description: The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, the "Add Webhook" and "Test Webhook" functionalities can be abused by an authenticated user to send crafted HTTP requests to localhost. This can be leveraged to execute commands on behalf of the versa user, who has sudo privileges, potentially leading to privilege escalation or remote code execution.  
 
Exploitation Status: 

Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers.  

Workarounds or Mitigation: 

There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://security-portal.versa-networks.com/emailbulletins/68526e7bdc94d6b9f2faf71b; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]3-release-21-2-3; https://support.versa-networks.com/support/solutions/articles/[PII_REDACTED]0-release-22-1-2