deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-40593
Published: 2025-12-11
Description: A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiOS 7.6.0, FortiOS 7.4.4, FortiOS 7.2.7, FortiOS 7.0.14, FortiPortal 6.0 all versions may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-320
References: https://fortiguard.fortinet.com/psirt/FG-IR-24-133
CVE: CVE-2025-13124
Published: 2025-12-11
Description: Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers.This issue affects ApplyLogic: through 01.12.2025.
CVSS Score: 7.6 (HIGH)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0447
CVE: CVE-2025-14265
Published: 2025-12-11
Description: In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-494
References: https://www.connectwise.com/company/trust/security-bulletins/screenconnect-2025.8-security-patch
CVE: CVE-2025-14518
Published: 2025-12-11
Description: A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/PowerJob/PowerJob/; https://github.com/PowerJob/PowerJob/issues/1144; https://github.com/PowerJob/PowerJob/issues/1144#issue[PII_REDACTED]
CVE: CVE-2025-14519
Published: 2025-12-11
Description: A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admin/index.php/advtext/add of the component advtext Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20advtext%20add%20Stored%20Cross-Site%20Scripting(XSS).md; https://vuldb.com/?ctiid.335857; https://vuldb.com/?id.335857
CVE: CVE-2025-14520
Published: 2025-12-11
Description: A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/datafile/delfile. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20delfile%20filename%20Arbitrary%20file%20delete.md; https://vuldb.com/?ctiid.335858; https://vuldb.com/?id.335858
CVE: CVE-2025-14521
Published: 2025-12-11
Description: A security vulnerability has been detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The affected element is an unknown function of the file /admin/index.php/datafile/download. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20download%20filename%20Arbitrary%20file%20reading.md; https://vuldb.com/?ctiid.335859; https://vuldb.com/?id.335859
CVE: CVE-2025-14522
Published: 2025-12-11
Description: A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kindeditor/php/upload_json.php. Performing manipulation of the argument imgFile results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20upload_json.php%20imgFile%20XSS-File-Upload.md; https://vuldb.com/?ctiid.335860; https://vuldb.com/?id.335860
CVE: CVE-2025-55307
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query() with a crafted cDIPath parameter (e.g., "/") may cause an out-of-bounds read in internal path-parsing logic, potentially leading to information disclosure or memory corruption.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55308
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that calls closeDoc() while internal objects are still in use can cause premature release of these objects. This use-after-free vulnerability may lead to memory corruption, potentially resulting in information disclosure when the PDF is opened.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55309
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an OnBlur action on a form field that destroys an annotation. During user right-click interaction, the program's internal focus change handling prematurely releases the annotation object, resulting in a use-after-free vulnerability that may cause memory corruption or application crashes.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55310
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML files used by the StartPage feature can cause the application to load malicious or compromised content upon startup. This may result in information disclosure, unauthorized data access, or other security impacts.
CVSS Score: 7.3 (HIGH)
CWE: CWE-494
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55311
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript to alter annotation content and subsequently clear the file's modification status via JavaScript interfaces. This circumvents digital signature verification by hiding document modifications, allowing an attacker to mislead users about the document's integrity and compromise the trustworthiness of signed PDFs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55312
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereference of invalid or released memory. This can lead to memory corruption, application crashes, and potentially allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55313
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when processing crafted PDF files. The vulnerability stems from insufficient handling of memory allocation failures after assigning an extremely large value to a form field's charLimit property via JavaScript. This can result in memory corruption and may allow an attacker to execute arbitrary code by persuading a user to open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-55314
Published: 2025-12-11
Description: An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application may fail to properly update internal states. Subsequent annotation management operations assume these states are valid, causing dereference of invalid or released memory. This can lead to memory corruption, application crashes, and potentially allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-59802
Published: 2025-12-11
Description: Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is runtime-only and not included in the digital signature computation buffer. An attacker can leverage JavaScript or PDF triggers to dynamically change the visibility of OCG content after signing (Post-Sign), allowing the visual content of a signed PDF to be modified without invalidating the signature. This may result in a mismatch between the signed content and what the signer or verifier sees, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-59803
Published: 2025-12-11
Description: Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that execute during the signing process. When a signer reviews the document, the content appears normal. However, once the signature is applied, the triggers modify content on other pages or optional content layers without explicit warning. This can cause the signed PDF to differ from what the signer saw, undermining the trustworthiness of the digital signature. The fixed versions are 2025.2.1, 14.0.1, and 13.2.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2025-67739
Published: 2025-12-11
Description: In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
CVSS Score: 3.1 (LOW)
CWE: CWE-939
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-67740
Published: 2025-12-11
Description: In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
CVSS Score: 2.7 (LOW)
CWE: CWE-863, CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-67741
Published: 2025-12-11
Description: In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-67742
Published: 2025-12-11
Description: In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
CVSS Score: 3.8 (LOW)
CWE: CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-8273
Published: 2025-12-11
Description: Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-290
References: https://www.hypr.com/trust-center/security-advisories
CVE: CVE-2025-14526
Published: 2025-12-11
Description: A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/maximdevere/CVE2/issues/5; https://github.com/maximdevere/CVE2/issues/5#issue[PII_REDACTED]; https://vuldb.com/?ctiid.335866
CVE: CVE-2025-14527
Published: 2025-12-11
Description: A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /view_book.php. Executing a manipulation of the argument book_id can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Sunhaobin318/CVE/issues/8; https://vuldb.com/?ctiid.335867; https://vuldb.com/?id.335867
CVE: CVE-2025-14528
Published: 2025-12-11
Description: A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The manipulation of the argument AUTHORIZED_GROUP results in information disclosure. The attack may be performed from remote. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-2/DIR-803%20Authentication%20Bypass.md; https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/D-Link/vuln-2/DIR-803%20Authentication%20Bypass.md#poc; https://vuldb.com/?ctiid.335869
CVE: CVE-2025-65471
Published: 2025-12-11
Description: An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://congsec.cn/?id=[PII_REDACTED]3546-i712jss; https://gist.github.com/CongSec/cd3d3ee57b8e6f83c7038e2263c15120
CVE: CVE-2025-65472
Published: 2025-12-11
Description: A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Administrator via user interaction with a malicious web page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://congsec.cn/?id=[PII_REDACTED]5007-yjddwx1; https://gist.github.com/CongSec/a6c8b15878f19647dbd26c22b47bac65
CVE: CVE-2025-65473
Published: 2025-12-11
Description: An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-73
References: https://congsec.cn?id=[PII_REDACTED]5610-7t4en7j; https://gist.github.com/CongSec/107b9cab6dd1cb297a738f11e2b2dbb6
CVE: CVE-2025-65474
Published: 2025-12-11
Description: An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via renaming a PHP file to a SVG format.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-706, CWE-434
References: https://congsec.cn?id=[PII_REDACTED]4511-9418dk9; https://gist.github.com/CongSec/3cf968621f71a7da35dcc9b8f0b29bb2
CVE: CVE-2025-66043
Published: 2025-12-11
Description: Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 3
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296
CVE: CVE-2025-66044
Published: 2025-12-11
Description: Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 64
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296
CVE: CVE-2025-66045
Published: 2025-12-11
Description: Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 65
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296
CVE: CVE-2025-66046
Published: 2025-12-11
Description: Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 67
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296
CVE: CVE-2025-66047
Published: 2025-12-11
Description: Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 131
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296
CVE: CVE-2025-66048
Published: 2025-12-11
Description: Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 133
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296; https://talosintelligence.com/vulnerability_reports/TALOS-2025-2296
CVE: CVE-2025-13912
Published: 2025-12-11
Description: Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimizations, which can potentially result in observable timing discrepancies and lead to information disclosure through timing side-channel attacks.
CWE: CWE-203
References: https://github.com/wolfSSL/wolfssl/pull/9148
CVE: CVE-2025-14046
Published: 2025-12-11
Description: An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed user-supplied HTML to inject DOM elements with IDs that collided with server-initialized data islands. These collisions could overwrite or shadow critical application state objects used by certain Project views, leading to unintended server-side POST requests or other unauthorized backend interactions. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a privileged user to view crafted malicious content that includes conflicting HTML elements. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.3, 3.17.9, 3.16.12, 3.15.16, and 3.14.21.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.21; https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.16; https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.12
CVE: CVE-2025-14529
Published: 2025-12-11
Description: A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/admin_running.php. This manipulation of the argument pid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Rowantu/CVE/issues/7; https://vuldb.com/?ctiid.335870; https://vuldb.com/?id.335870
CVE: CVE-2025-14530
Published: 2025-12-11
Description: A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/zzdzz7/cve/issues/2; https://vuldb.com/?ctiid.335871; https://vuldb.com/?id.335871
CVE: CVE-2025-56077
Published: 2025-12-11
Description: OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST request to the module_set in file /usr/local/lua/dev_sta/nbr_cwmp.lua.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://1drv.ms/f/c/12406a392c92914b/EvnzTspA23NAl-T9w70dG4MBnWWojsrzAeM1i-ed2EauAA?e=AYOxPM; https://1drv.ms/t/c/12406a392c92914b/EURTWAoIJNRMtvzNPi08CToB780nsKPNHZ2Fdmcf9xsoRA?e=jHygdj; https://github.com/flegoity/Ruijie-Multiple-Devices-Vulnerability-Reports-for-CVE/blob/main/CVE-2025-56077.md