deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12280
Published: 2025-10-27
Description: A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients.php. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/hellonewbie/tutorial/issues/8; https://vuldb.com/?ctiid.329950
CVE: CVE-2025-12281
Published: 2025-10-27
Description: A vulnerability was determined in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/clientview.php. Executing manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/hellonewbie/tutorial/issues/9; https://vuldb.com/?ctiid.329951
CVE: CVE-2025-12282
Published: 2025-10-27
Description: A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/manage-users.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/hellonewbie/tutorial/issues/10; https://github.com/hellonewbie/tutorial/issues/12
CVE: CVE-2025-12283
Published: 2025-10-27
Description: A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639, CWE-639
References: https://code-projects.org/; https://github.com/hellonewbie/tutorial/issues/11; https://vuldb.com/?ctiid.329953
CVE: CVE-2025-12286
Published: 2025-10-27
Description: A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-428
References: https://github.com/lakshayyverma/CVE-Discovery/blob/main/VeePn.md; https://vuldb.com/?ctiid.329954; https://vuldb.com/?id.329954
CVE: CVE-2025-50055
Published: 2025-10-27
Description: Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://openvpn.net/as-docs/as-3-0-release-notes.html#access-server-3-0-0
CVE: CVE-2025-52263
Published: 2025-10-27
Description: An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-494
References: https://github.com/HaToan/CVEs/blob/main/starcharge/README.md; https://www.starcharge.com/product/artemis/
CVE: CVE-2025-60291
Published: 2025-10-27
Description: An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific routes and modify database connection configurations.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/M00nBack/CVE_Request/blob/main/eSSL%20Security/eTimeTrackLite.md; https://www.esslsecurity.com/; https://github.com/M00nBack/CVE_Request/blob/main/eSSL%20Security/eTimeTrackLite.md
CVE: CVE-2025-61481
Published: 2025-10-27
Description: An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to execute injected JavaScript in the administrator’s browser and intercept credentials.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-200, CWE-319, CWE-1188
References: https://help.mikrotik.com/docs/spaces/ROS/pages/328131/WebFig; https://help.mikrotik.com/docs/spaces/SWOS/pages/328415/SwOS; https://svarthatt.se/cve/mikrotik-swos-cve-2025-61481/
CVE: CVE-2025-9164
Published: 2025-10-27
Description: Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.
CWE: CWE-427
References: https://docs.docker.com/desktop/release-notes/
CVE: CVE-2025-12287
Published: 2025-10-27
Description: A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown function of the file /Admin_dashboard/edit_profile. Such manipulation of the argument first_name/last_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12287.md; https://vuldb.com/?ctiid.329955; https://vuldb.com/?id.329955
CVE: CVE-2025-12288
Published: 2025-10-27
Description: A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User Profile Handler. Performing manipulation results in authorization bypass. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-639, CWE-639
References: https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-12288.md; https://vuldb.com/?ctiid.329956; https://vuldb.com/?id.329956
CVE: CVE-2025-12289
Published: 2025-10-27
Description: A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unknown functionality of the file /Point/index/activity_state/1/category_id/1001. Executing manipulation of the argument category_id can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/1276486/CVE/issues/19; https://vuldb.com/?ctiid.329957; https://vuldb.com/?id.329957
CVE: CVE-2025-12290
Published: 2025-10-27
Description: A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this issue is some unknown functionality of the file /i/359. The manipulation of the argument keywords leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/1276486/CVE/issues/18; https://vuldb.com/?ctiid.329958; https://vuldb.com/?id.329958
CVE: CVE-2025-12351
Published: 2025-10-27
Description: Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-639, CWE-668
References: https://www.honeywell.com/us/en/product-security
CVE: CVE-2025-26862
Published: 2025-10-27
Description: Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.
CWE: CWE-307
References: https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode; https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE: CVE-2025-34292
Published: 2025-10-27
Description: Rox, the software running BeWelcome, contains a PHP object injection vulnerability resulting from deserialization of untrusted data. User-controlled input is passed to PHP's unserialize(): the POST parameter `formkit_memory_recovery` in \\RoxPostHandler::getCallbackAction and the 'memory cookie' read by \\RoxModelBase::getMemoryCookie (bwRemember). (1) If present, `formkit_memory_recovery` is processed and passed to unserialize(), and (2) restore-from-memory functionality calls unserialize() on the bwRemember cookie value. Gadget chains present in Rox and bundled libraries enable exploitation of object injection to write arbitrary files or achieve remote code execution. Successful exploitation can lead to full site compromise. This vulnerability was remediated with commit c60bf04 (2025-06-16).
CWE: CWE-502
References: https://gist.github.com/mcdruid/c0f7c42b28949c7d86cf77d0c674f398; https://github.com/BeWelcome/rox; https://github.com/BeWelcome/rox/commit/c60bf04
CVE: CVE-2025-36121
Published: 2025-10-27
Description: IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80
References: https://www.ibm.com/support/pages/node/7248932
CVE: CVE-2025-52264
Published: 2025-10-27
Description: StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi.
CVSS Score: 8.0 (HIGH)
CWE: CWE-119
References: https://github.com/HaToan/CVEs/blob/main/starcharge/README.md; https://www.starcharge.com/product/artemis/
CVE: CVE-2025-52268
Published: 2025-10-27
Description: StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid login tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/HaToan/CVEs/blob/main/starcharge/README.md; https://www.starcharge.com/product/artemis/
CVE: CVE-2025-61482
Published: 2025-10-27
Description: Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentication. By hooking into app crypto routines and intercepting decryption paths, attacker can recover plaintext secrets, enabling generation of valid one-time passwords, and bypassing authentication for enrolled accounts.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200, CWE-522, CWE-922
References: https://github.com/ReversecLabs/android-keystore-audit/blob/master/frida-scripts/tracer-cipher.js; https://svarthatt.se/cve/cve-2025-61482-pulling-otp-secrets-from-privacyidea-authenticator/
CVE: CVE-2023-37749
Published: 2025-10-27
Description: Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://app.hubspot.com/api/external-options/v2/pagedFetch/0-1/OWNER?useIndexOffset=true&portalId=22152277&clienttimeout=14000&hs_static_app=settings-ui-users&hs_static_app_version=1.43001&limit=200&q=&offset=0&includeDeleted=true; https://gist.github.com/0xDBJ/28072f7eea42571d5b4ebaabdcb21cce; https://owasp.org/Top10/A01_2021-Broken_Access_Control/
CVE: CVE-2023-49440
Published: 2025-10-27
Description: AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter."
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://ahnlab.com; https://github.com/KernelCipher/CVE-2023-49440-POC; https://github.com/NyaMeeEain/CVE-2023-49440
CVE: CVE-2025-10023
Published: 2025-10-27
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) 

allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from 24.10.0 before 24.10.9, from 24.04.0 before 24.04.16, from 23.10.0 before 23.10.26.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-10023-centreon-web-all-versions-medium-severity-5179
CVE: CVE-2025-12291
Published: 2025-10-27
Description: A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.php?add_product of the component Add Product Page. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Lianhaorui/Report/blob/main/FileUpload-1.docx; https://vuldb.com/?ctiid.329959; https://vuldb.com/?id.329959
CVE: CVE-2025-12292
Published: 2025-10-27
Description: A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/J-Fy2767/CVE/issues/2; https://vuldb.com/?ctiid.329960; https://vuldb.com/?id.329960
CVE: CVE-2025-12293
Published: 2025-10-27
Description: A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/J-Fy2767/CVE/issues/4; https://vuldb.com/?ctiid.329961; https://vuldb.com/?id.329961
CVE: CVE-2025-12294
Published: 2025-10-27
Description: A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/J-Fy2767/CVE/issues/6; https://vuldb.com/?ctiid.329962; https://vuldb.com/?id.329962
CVE: CVE-2025-34133
Published: 2025-10-27
Description: Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery (CSRF) vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrf_token' without validating the field’s value; only the presence of the field is checked. An attacker can craft a cross-site request that causes a logged-in victim’s browser to submit a JSON POST containing an arbitrary or empty 'csrf_token', and the API will execute the request with the victim’s privileges. Successful exploitation can allow an attacker to perform privileged actions as the victim potentially resulting in account takeover, privilege escalation, or service disruption.
CWE: CWE-352
References: https://www.vulncheck.com/advisories/wimi-teamwork-csrf; https://www.wimi-teamwork.com/; https://www.wimi-teamwork.com/product-news/release-7-38/
CVE: CVE-2025-60424
Published: 2025-10-27
Description: A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
CVSS Score: 7.6 (HIGH)
CWE: CWE-287, CWE-307
References: https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack; https://github.com/aakashtyal/2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424; https://www.nagios.com/changelog/#fusion
CVE: CVE-2025-60425
Published: 2025-10-27
Description: Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
CVSS Score: 8.6 (HIGH)
CWE: CWE-491
References: https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA; https://github.com/aakashtyal/Session-Persistence-After-Enabling-2FA-CVE-2025-60425; https://www.nagios.com/changelog/#fusion
CVE: CVE-2025-60791
Published: 2025-10-27
Description: Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-316
References: https://packetstorm.news/files/id/210832; https://sourceforge.net/projects/easyworkaccounting/
CVE: CVE-2025-61247
Published: 2025-10-27
Description: indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://github.com/suyashksawant/CVEs/blob/main/CVE-2025-61247%3A%20SQL%20Injection%20in%20Online%20Shopping%20System
CVE: CVE-2025-12295
Published: 2025-10-27
Description: A weakness has been identified in D-Link DAP-2695 2.00RC13. The affected element is the function sub_40C6B8 of the component Firmware Update Handler. Executing manipulation can lead to improper verification of cryptographic signature. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-345, CWE-347, CWE-347
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_Inte.md; https://vuldb.com/?ctiid.329963; https://vuldb.com/?id.329963
CVE: CVE-2025-12296
Published: 2025-10-27
Description: A security vulnerability has been detected in D-Link DAP-2695 2.00RC13. The impacted element is the function sub_4174B0 of the component Firmware Update Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/IOTRes/IOT_Firmware_Update/blob/main/Dlink/DAP-2695_Injection.md; https://vuldb.com/?ctiid.329964; https://vuldb.com/?id.329964
CVE: CVE-2025-12297
Published: 2025-10-27
Description: A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://vuldb.com/?ctiid.329965; https://vuldb.com/?id.329965; https://vuldb.com/?submit.675906
CVE: CVE-2025-12298
Published: 2025-10-27
Description: A vulnerability was identified in code-projects Simple Food Ordering System 1.0. This affects an unknown part of the file /editcategory.php. The manipulation of the argument pname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/19; https://vuldb.com/?ctiid.329970
CVE: CVE-2025-12299
Published: 2025-10-27
Description: A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument pname/category/price results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/18; https://vuldb.com/?ctiid.329971
CVE: CVE-2025-27222
Published: 2025-10-27
Description: TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22, CWE-35
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27222.txt; https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/; https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise
CVE: CVE-2025-27223
Published: 2025-10-27
Description: TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1004
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27223.txt; https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/; https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise
CVE: CVE-2025-27224
Published: 2025-10-27
Description: TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to write to any filename with any file type at any location on the local server, ultimately allowing execution of arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-27224.txt; https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/; https://www.rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise