deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-34270
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-312, CWE-522
References: https://support.nagios.com/kb/article/authenticating-and-importing-users-with-ad-and-ldap-995.html; https://www.nagios.com/changelog/#log-server; https://www.nagios.com/products/security/#log-server-2024R2
CVE: CVE-2025-34271
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://www.nagios.com/changelog/#log-server; https://www.nagios.com/products/security/#log-server-2024R2; https://www.vulncheck.com/advisories/nagios-log-server-cluster-manager-credential-requests-sent-over-plaintext
CVE: CVE-2025-34272
Published: 2025-10-30
Description: In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view. Depending on the product's dashboard sharing and access policies, this behavior may cause information exposure or unexpected privilege exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.nagios.com/changelog/#log-server; https://www.nagios.com/products/security/#log-server-2024R2; https://www.vulncheck.com/advisories/nagios-log-server-non-empty-default-dashboard-fallback
CVE: CVE-2025-34273
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://www.nagios.com/changelog/#log-server; https://www.nagios.com/products/security/#log-server-2024R2; https://www.vulncheck.com/advisories/nagios-log-server-non-admin-dashboard-deletion
CVE: CVE-2025-34274
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. The Logstash service has been altered to run as the lower-privileged 'nagios' user to reduce this risk associated with a network-facing service that can accept untrusted input or load third-party components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-250
References: https://www.nagios.com/changelog/#log-server; https://www.nagios.com/products/security/#log-server-2024R2; https://www.vulncheck.com/advisories/nagios-log-server-logstash-process-root-privileges
CVE: CVE-2025-34277
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbitrary code execution in the context of the Log Server process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.nagios.com/changelog/#log-server-2024R1; https://www.nagios.com/products/security/#log-server; https://www.vulncheck.com/advisories/nagios-log-server-rce-via-malformed-dashboard-id
CVE: CVE-2025-34278
Published: 2025-10-30
Description: Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/#network-analyzer; https://www.nagios.com/products/security/#network-analyzer; https://www.vulncheck.com/advisories/nagios-network-analyzer-source-groups-percentile-calculator-menu-stored-xss
CVE: CVE-2025-34280
Published: 2025-10-30
Description: Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-network-analyzer/; https://www.nagios.com/products/security/#network-analyzer; https://www.vulncheck.com/advisories/nagios-network-analyzer-rce-in-ldap-certificate-removal-function
CVE: CVE-2025-34283
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-api-key-disclosure-via-neptune-themes
CVE: CVE-2025-34284
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to modify configuration, exfiltrate data, disrupt monitoring operations, or execute commands on the underlying host operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-authenticated-command-injection-via-winrm-plugin
CVE: CVE-2025-34286
Published: 2025-10-30
Description: Nagios XI versions prior to 2026R1  contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are executed on the server. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain control of the underlying host operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-rce-via-run-check-command-in-ccm
CVE: CVE-2025-34287
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the nagios user when the script is next run. This improper ownership and permission configuration enables local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-improperly-owned-script
CVE: CVE-2025-34298
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that granted elevated privileges or bypassed intended access controls.
CVSS Score: 8.8 (HIGH)
CWE: CWE-281
References: https://www.nagios.com/changelog/nagios-log-server-2024r1/; https://www.vulncheck.com/advisories/nagios-log-server-set-email-privilege-escalation
CVE: CVE-2025-27208
Published: 2025-10-31
Description: A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser.  The session cookie cannot be accessed, but a number of other operations could be performed.

The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://hackerone.com/reports/3091390; http://seclists.org/fulldisclosure/2025/Oct/20
CVE: CVE-2025-48980
Published: 2025-10-31
Description: In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-565
References: https://hackerone.com/reports/3253725
CVE: CVE-2025-48982
Published: 2025-10-31
Description: This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.veeam.com/kb4771
CVE: CVE-2025-48983
Published: 2025-10-31
Description: A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-284
References: https://www.veeam.com/kb4771
CVE: CVE-2025-48984
Published: 2025-10-31
Description: A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.veeam.com/kb4771
CVE: CVE-2025-52663
Published: 2025-10-31
Description: A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API.


Affected Products:
UniFi Talk Touch (Version 1.21.16 and earlier) 
UniFi Talk Touch Max (Version 2.21.22 and earlier) 
UniFi Talk G3 Phones (Version 3.21.26 and earlier) 
 
Mitigation:
Update the UniFi Talk Touch to Version 1.21.17 or later.
Update the UniFi Talk Touch Max to Version 2.21.23 or later.
Update the UniFi Talk G3 Phones to Version 3.21.27 or later.
CVSS Score: 7.3 (HIGH)
CWE: CWE-489
References: https://community.ui.com/releases/Security-Advisory-Bulletin-055-055/9b65527b-489c-4f16-ac34-2b887754db1e
CVE: CVE-2025-52664
Published: 2025-10-31
Description: SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://hackerone.com/reports/3395221; http://seclists.org/fulldisclosure/2025/Oct/21
CVE: CVE-2025-52665
Published: 2025-10-31
Description: A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. 
 
Affected Products:
UniFi Access Application (Version 3.3.22 through 3.4.31).   

Mitigation:
Update your UniFi Access Application to Version 4.0.21 or later.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://community.ui.com/releases/Security-Advisory-Bulletin-056/ce97352d-91cd-40a7-a2f4-2c73b3b30191
CVE: CVE-2025-6176
Published: 2025-10-31
Description: Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0
CVE: CVE-2025-8849
Published: 2025-10-31
Description: LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/danny-avila/librechat/commit/edf33bedcbb08c33e59df76f06454ed7efd896f9; https://huntr.com/bounties/e9d9404c-cd19-4226-a580-9cba14b7d7d6
CVE: CVE-2025-23050
Published: 2025-10-31
Description: QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2.
CVSS Score: 3.1 (LOW)
CWE: CWE-125
References: https://codereview.qt-project.org/q/QLowEnergyController; https://www.qt.io/blog/security-advisory-qlowenergycontroller-on-linux
CVE: CVE-2025-11806
Published: 2025-10-31
Description: The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'quiz' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/qzzr-shortcode/tags/1.0.1/qzzr.php#L35; https://wordpress.org/plugins/qzzr-shortcode/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b5d5d6ec-bb23-4619-b5d9-9bd965b049b5?source=cve
CVE: CVE-2025-11975
Published: 2025-10-31
Description: The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3383939/fusewp/trunk/src/core/src/Admin/SettingsPage/SyncPage.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6c68e8a1-926f-497f-b9f2-b0a67cd09adf?source=cve
CVE: CVE-2025-11191
Published: 2025-10-31
Description: The RealPress  WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/74f19ff2-d5c0-4bd4-83f2-688ea37022b1/
CVE: CVE-2025-54763
Published: 2025-10-31
Description: FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the Web UI of the product may execute an arbitrary OS command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU98191201/; https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html
CVE: CVE-2025-58152
Published: 2025-10-31
Description: FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://jvn.jp/en/vu/JVNVU98191201/; https://www.centurysys.co.jp/backnumber/common/jvnvu98191201.html
CVE: CVE-2025-5397
Published: 2025-10-31
Description: The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them  This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446; https://www.wordfence.com/threat-intel/vulnerabilities/id/6fa4aa8d-d7f1-4e91-bb2c-c9f80a4bb216?source=cve
CVE: CVE-2025-63675
Published: 2025-10-31
Description: cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-502
References: https://github.com/javiermorales36/cryptidy-analysis; https://github.com/netinvent/cryptidy/blob/cebc9ffd54cc20679d15a1a43ca9a5da645b0c58/cryptidy/symmetric_encryption.py#L220-L238; https://github.com/javiermorales36/cryptidy-analysis
CVE: CVE-2025-7846
Published: 2025-10-31
Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() function in all versions up to, and including, 16.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.8 (HIGH)
CWE: CWE-36
References: https://codecanyon.net/item/user-extra-fields/12949844; https://www.wordfence.com/threat-intel/vulnerabilities/id/c66d0fb4-e2df-4bdb-8ccb-18a96173a55d?source=cve
CVE: CVE-2025-8489
Published: 2025-10-31
Description: The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/king-addons/tags/24.12.93/includes/widgets/Login_Register_Form/Login_Register_Form_Ajax.php#L353; https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.35/includes/widgets/Login_Register_Form/Login_Register_Form_Ajax.php#L160; https://www.wordfence.com/threat-intel/vulnerabilities/id/a1bb2b06-9a3b-4428-8624-26a1202fe3b0?source=cve
CVE: CVE-2025-10897
Published: 2025-10-31
Description: The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a47cdeb-bd05-4e7e-99dc-dca67064182a?source=cve
CVE: CVE-2025-6520
Published: 2025-10-31
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection.This issue affects BAPSIS: before[PII_REDACTED]06.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0365
CVE: CVE-2025-8385
Published: 2025-10-31
Description: The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient input validation in the zf_get_file_by_url function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read arbitrary files on the server, including sensitive system files like /etc/passwd, via a forged request. It's worth noting that successfully exploiting this vulnerability relies on a race condition as the file generated will be deleted immediately.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://themeforest.net/item/boombox-viral-buzz-wordpress-theme/16596434; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef9010e3-f060-4bef-b62b-4a648f5e5577?source=cve
CVE: CVE-2025-12094
Published: 2025-10-31
Description: The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (such as CF-Connecting-IP, X-Forwarded-For, and others) without verifying that those headers originate from legitimate, trusted proxies. This makes it possible for unauthenticated attackers to spoof their IP address and bypass IP-based security controls, including blocked IP lists and rate limiting protections, by sending arbitrary HTTP headers with their requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-693
References: https://plugins.trac.wordpress.org/browser/oopspam-anti-spam/tags/1.2.49/include/helpers.php#L268; https://plugins.trac.wordpress.org/changeset/3386104/oopspam-anti-spam/trunk/include/helpers.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b5137bc2-912b-4e25-966e-515e8d9fc21c?source=cve
CVE: CVE-2025-12175
Published: 2025-10-31
Description: The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'tec_qr_code_modal' AJAX endpoint in all versions up to, and including, 6.15.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view draft event names and generate/view QR codes for them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/the-events-calendar/the-events-calendar/blob/main/src/Events/QR/QR_Code.php; https://plugins.trac.wordpress.org/changeset/3386042/the-events-calendar/tags/6.15.10/src/Events/QR/QR_Code.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab844a05-80e0-42c7-981c-dea3a18cf4d5?source=cve