deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10071
Published: 2025-09-07
Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /cancelar-enturmacao-em-lote/. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20Vulnerability%20%20in%20%60.cancelar-enturmacao-em-lote.(ID)%60%20Endpoint.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10071.md; https://vuldb.com/?ctiid.323019
CVE: CVE-2025-10072
Published: 2025-09-07
Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /matricula/[ID_STUDENT]/enturmar/. Performing manipulation results in improper access controls. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Access%20Control%20%20in%20.matricula.(ID_STUDENT).enturmar.(ID_CLASS)%60%20Endpoint.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10072.md; https://vuldb.com/?ctiid.323020
CVE: CVE-2025-10073
Published: 2025-09-08
Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/Broken%20Object%20Level%20Authorization%20(BOLA)%20allows%20enumeration%20of%20classes%20informations%20via%20.module.Api.turma.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10073.md; https://vuldb.com/?ctiid.323021
CVE: CVE-2025-10074
Published: 2025-09-08
Description: A vulnerability was identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /usuarios/tipos/. The manipulation of the argument Tipos de Usuário/Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10074.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Cross-Site%20Scripting%20(XSS)%20Stored%20endpoint%20%60.usuarios.tipos.(ID)%60%20parameters%20%60Tipos%20de%20Usu%C3%A1rio%60,%20%60Descri%C3%A7%C3%A3o%60.md; https://vuldb.com/?ctiid.323022
CVE: CVE-2025-10075
Published: 2025-09-08
Description: A security flaw has been discovered in SourceCodester Online Polling System 1.0. The impacted element is an unknown function of the file /manage-profile.php. The manipulation of the argument firstname results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/ganzhi-qcy/cve/issues/18; https://vuldb.com/?ctiid.323023; https://vuldb.com/?id.323023
CVE: CVE-2025-10076
Published: 2025-09-08
Description: A weakness has been identified in SourceCodester Online Polling System 1.0. This affects an unknown function of the file /manage-profile.php. This manipulation of the argument email causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/19; https://vuldb.com/?ctiid.323024; https://vuldb.com/?id.323024
CVE: CVE-2025-10077
Published: 2025-09-08
Description: A security vulnerability has been detected in SourceCodester Online Polling System 1.0. This impacts an unknown function of the file /registeracc.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/20; https://vuldb.com/?ctiid.323025; https://vuldb.com/?id.323025
CVE: CVE-2025-10078
Published: 2025-09-08
Description: A vulnerability was detected in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/candidates.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/21; https://vuldb.com/?ctiid.323026; https://vuldb.com/?id.323026
CVE: CVE-2025-10079
Published: 2025-09-08
Description: A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulation of the argument Contact can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f000x0/cve/issues/2; https://phpgurukul.com/; https://vuldb.com/?ctiid.323027
CVE: CVE-2025-10080
Published: 2025-09-08
Description: A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file datart/security/src/main/java/datart/security/util/AESUtil.java of the component API. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.1 (LOW)
CWE: CWE-320, CWE-321
References: https://github.com/yjk12/Elephant-Datart-/tree/main; https://vuldb.com/?ctiid.323028; https://vuldb.com/?id.323028
CVE: CVE-2025-10081
Published: 2025-09-08
Description: A flaw has been found in SourceCodester Pet Management System 1.0. This impacts an unknown function of the file /admin/profile.php. This manipulation of the argument website_image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/drew-byte/Pet-Grooming-Management-RCE; https://vuldb.com/?ctiid.323036; https://vuldb.com/?id.323036
CVE: CVE-2025-10082
Published: 2025-09-08
Description: A vulnerability has been found in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/manage-admins.php. Such manipulation of the argument email leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ganzhi-qcy/cve/issues/22; https://vuldb.com/?ctiid.323037; https://vuldb.com/?id.323037
CVE: CVE-2025-10083
Published: 2025-09-08
Description: A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/profile.php. Executing manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/chen[PII_REDACTED]/CVE/issues/8; https://vuldb.com/?ctiid.323039; https://vuldb.com/?id.323039
CVE: CVE-2025-10084
Published: 2025-09-08
Description: A vulnerability was identified in elunez eladmin up to 2.7. This affects the function queryErrorLogDetail of the file /api/logs/error/1 of the component SysLogController. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.323040; https://vuldb.com/?id.323040; https://vuldb.com/?submit.644658
CVE: CVE-2025-58422
Published: 2025-09-08
Description: RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product’s management tool.
CVSS Score: 3.1 (LOW)
CWE: CWE-348
References: https://jvn.jp/en/jp/JVN75307484/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000010
CVE: CVE-2025-10085
Published: 2025-09-08
Description: A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file manage_website.php. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/chen[PII_REDACTED]/CVE/issues/9; https://vuldb.com/?ctiid.323041; https://vuldb.com/?id.323041
CVE: CVE-2025-10086
Published: 2025-09-08
Description: A weakness has been identified in fuyang_lipengjun platform 1.0.0. This issue affects the function queryAll of the file /adposition/queryAll of the component AdPositionController. This manipulation causes improper authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. Affects another part than CVE-2025-9936.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.323042; https://vuldb.com/?id.323042; https://vuldb.com/?submit.644661
CVE: CVE-2025-8085
Published: 2025-09-08
Description: The Ditty  WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://wpscan.com/vulnerability/f42c37bb-1ae0-49ab-bd81-7864dff0fcff/
CVE: CVE-2025-10087
Published: 2025-09-08
Description: A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/profit_report.php. Such manipulation of the argument product_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://medium.com/@kuldeepsahoo877/vulnerability-report-sql-injection-in-pet-grooming-management-system-76bd514224ee; https://vuldb.com/?ctiid.323043; https://vuldb.com/?id.323043
CVE: CVE-2025-10088
Published: 2025-09-08
Description: A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/drew-byte/Personal-Time-Tracker-V1-POC; https://vuldb.com/?ctiid.323044; https://vuldb.com/?id.323044
CVE: CVE-2025-41664
Published: 2025-09-08
Description: A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate privileges and modify firmware.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://certvde.com/de/advisories/VDE-2025-048
CVE: CVE-2025-41682
Published: 2025-09-08
Description: An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://certvde.com/de/advisories/VDE-2025-061
CVE: CVE-2025-41708
Published: 2025-09-08
Description: Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319
References: https://certvde.com/de/advisories/VDE-2025-084
CVE: CVE-2025-58782
Published: 2025-09-08
Description: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data.
Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-502
References: https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v; http://www.openwall.com/lists/oss-security/2025/09/06/3
CVE: CVE-2019-25225
Published: 2025-09-08
Description: `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225; https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3; https://github.com/apostrophecms/sanitize-html/issues/293
CVE: CVE-2025-10090
Published: 2025-09-08
Description: A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Cstarplus/CVE/issues/1; https://vuldb.com/?ctiid.323045; https://vuldb.com/?id.323045
CVE: CVE-2014-125128
Published: 2025-09-08
Description: 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference (`href`) attribute in anchor tags (`<a>`), allowing bypasses that contain different casings, whitespace characters, or hexadecimal encodings.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125128; https://github.com/apostrophecms/sanitize-html/commit/423b90e06e1e85245eccedaabeb3a82840c6cd86; https://github.com/apostrophecms/sanitize-html/commit/889d4ec968e175f1905b2eb9d33f1fa89217cb02
CVE: CVE-2025-10091
Published: 2025-09-08
Description: A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-610, CWE-611, CWE-611
References: https://github.com/Cstarplus/CVE/issues/2; https://vuldb.com/?ctiid.323046; https://vuldb.com/?id.323046
CVE: CVE-2025-5993
Published: 2025-09-08
Description: ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.
CWE: CWE-22
References: https://cert.pl/posts/2025/07/CVE-2025-5993; https://itcube.pl/modul-crm
CVE: CVE-2025-10092
Published: 2025-09-08
Description: A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-610, CWE-611, CWE-611
References: https://github.com/Cstarplus/CVE/issues/3; https://vuldb.com/?ctiid.323047; https://vuldb.com/?id.323047
CVE: CVE-2025-10093
Published: 2025-09-08
Description: A vulnerability was identified in D-Link DIR-852 up to 1.00CN B09. Affected by this vulnerability is the function phpcgi_main of the file /getcfg.php of the component Device Configuration Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/i-Corner/cve/issues/21; https://vuldb.com/?ctiid.323049; https://vuldb.com/?id.323049
CVE: CVE-2025-40641
Published: 2025-09-08
Description: Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the product_name parameter in /Controller_Products/update. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-multi-purpose-inventory-management-system
CVE: CVE-2025-40642
Published: 2025-09-08
Description: Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request parameters in /search.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-webwork
CVE: CVE-2025-3212
Published: 2025-09-08
Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p4, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p4, from r50p0 through r54p0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-416
References: https://developer.arm.com/documentation/110627/latest
CVE: CVE-2025-22956
Published: 2025-09-08
Description: OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead to privilege escalation if any ProductPropertyState contains a secret only intended to be accessible by a subset of clients. One example of this is a domain join account password for the windomain package.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://opsi.org/en/product/releases/#4.3[PII_REDACTED]4911
CVE: CVE-2025-36853
Published: 2025-09-08
Description: A vulnerability (CVE-2025-21172) exists in msdia140.dll due to integer overflow and heap-based overflow.

 Per CWE-122: Heap-based Buffer Overflow, a heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().‍

 Per CWE-190: Integer Overflow or Wraparound, is when a product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

 NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21172; https://www.herodevs.com/vulnerability-directory/cve-2025-21172
CVE: CVE-2025-36854
Published: 2025-09-08
Description: A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead to use-after-free, resulting in Remote Code Execution.

  Per  CWE-416: Use After Free https://cwe.mitre.org/data/definitions/416.html , Use After Free is when a product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.8, 9.0.0-preview.1.24081.5 <= 9.0.0.RC.1 as represented in  CVE-2024-38229 https://www.cve.org/CVERecord .

  Additionally, if you've deployed  self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd  targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

   NOTE: This CVE only represents End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38229; https://www.herodevs.com/vulnerability-directory/cve-2024-38229
CVE: CVE-2025-36855
Published: 2025-09-08
Description: A vulnerability ( CVE-2025-21176 https://www.cve.org/CVERecord ) exists in DiaSymReader.dll due to buffer over-read.

 Per  CWE-126: Buffer Over-read https://cwe.mitre.org/data/definitions/126.html , Buffer Over-read is when a product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

  This issue affects EOL ASP.NET 6.0.0 <= 6.0.36 as represented in this CVE, as well as 8.0.0 <= 8.0.11 & <= 9.0.0 as represented in CVE-2025-21176.

 

 Additionally, if you've deployed  self-contained applications https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd  targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

 NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
CVSS Score: 8.8 (HIGH)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21176; https://www.herodevs.com/vulnerability-directory/cve-2025-21176