deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-30480
Published: 2025-07-30
Description: Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.dell.com/support/kbdoc/en-us/000349609/dsa-2025-304-security-update-for-dell-powerprotect-data-manager-multiple-security-vulnerabilities
CVE: CVE-2025-8327
Published: 2025-07-30
Description: A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s8.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/[PII_REDACTED]/CVE/issues/1; https://vuldb.com/?ctiid.318277
CVE: CVE-2025-8328
Published: 2025-07-30
Description: A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument USN leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/1lusanbao9/cve/issues/1; https://vuldb.com/?ctiid.318278
CVE: CVE-2025-30103
Published: 2025-07-30
Description: Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-552
References: https://www.dell.com/support/kbdoc/en-us/000346195/dsa-2025-259-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-36608
Published: 2025-07-30
Description: Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.dell.com/support/kbdoc/en-us/000346195/dsa-2025-259-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-36609
Published: 2025-07-30
Description: Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 2.5 (LOW)
CWE: CWE-259
References: https://www.dell.com/support/kbdoc/en-us/000346195/dsa-2025-259-security-update-for-dell-networking-os10-vulnerabilities
CVE: CVE-2025-50464
Published: 2025-07-30
Description: A buffer overflow vulnerability exists in the upload.cgi module of the iptime NAS firmware v1.5.04. The vulnerability arises due to the unsafe use of the strcpy function to copy attacker-controlled data from the CONTENT_TYPE HTTP header into a fixed-size stack buffer (v8, allocated 8 bytes) without bounds checking. Since this operation occurs before authentication logic is executed, the vulnerability is exploitable pre-authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/lafdrew/IOT/blob/main/iptime_nas_1.5.04/Buffer-Overflow-in-upload-cgi-of-iptime-nas-1-5-04.md; https://lafdrew.github.io/2025/04/25/Buffer-Overflow-in-upload-cgi-of-iptime-nas-1-5-04/
CVE: CVE-2025-50777
Published: 2025-07-30
Description: The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows local attackers to gain root shell access. Once accessed, the device exposes critical data including Wi-Fi credentials and ONVIF service credentials stored in plaintext, enabling further compromise of the network and connected systems.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284, CWE-312
References: http://aziot.com; https://github.com/veereshgadige/aziot-cctv-cve-2025-50777
CVE: CVE-2025-51951
Published: 2025-07-30
Description: andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://andisearch.com/; https://github.com/Secsys-FDU/LLMCVE/blob/main/CVE-2025-51951/CVE_detail.md
CVE: CVE-2025-8329
Published: 2025-07-30
Description: A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /filter3.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zgqsdx/cve/issues/2; https://vuldb.com/?ctiid.318279
CVE: CVE-2024-48916
Published: 2025-07-30
Description: Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has yet to be published.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345
References: https://github.com/ceph/ceph/security/advisories/GHSA-5g9m-mmp6-93mq
CVE: CVE-2025-51954
Published: 2025-07-30
Description: playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Secsys-FDU/LLMCVE/blob/main/CVE-2025-51954/CVE_detail.md; https://playground.electronhub.ai/; https://secsys.fudan.edu.cn/
CVE: CVE-2025-52187
Published: 2025-07-30
Description: GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my_profile_update_form1.php.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/GetProjectsIdea/Create-School-Management-System-with-PHP-MySQL; https://medium.com/@sanjay70023/cve-2025-52187-stored-xss-in-school-management-system-php-mysql-79cadcd6340f; http://seclists.org/fulldisclosure/2025/Jul/28
CVE: CVE-2025-53022
Published: 2025-07-30
Description: TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.
CVSS Score: 8.6 (HIGH)
CWE: CWE-121
References: https://git.trustedfirmware.org/plugins/gitiles/TF-M/trusted-firmware-m.git/+/refs/heads/main/secure_fw/partitions/firmware_update/bootloader/mcuboot/tfm_mcuboot_fwu.c#257; https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/fwu_tlv_payload_out_of_bounds_vulnerability.html; https://www.trustedfirmware.org/projects/tf-m/
CVE: CVE-2025-54575
Published: 2025-07-30
Description: ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial of service. Applications processing untrusted GIF input should upgrade to a patched version. This issue is fixed in versions 2.1.11 and 3.1.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/SixLabors/ImageSharp/commit/55e49262df9a057dff9b7807ed1b7bdb49187c3f; https://github.com/SixLabors/ImageSharp/commit/833f3ceec35af6b775950e06f03b934546cefbf6; https://github.com/SixLabors/ImageSharp/issues/2953
CVE: CVE-2025-54576
Published: 2025-07-30
Description: OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions 7.10.0 and below, oauth2-proxy deployments are vulnerable when using the skip_auth_routes configuration option with regex patterns. Attackers can bypass authentication by crafting URLs with query parameters that satisfy configured regex patterns, allowing unauthorized access to protected resources. The issue stems from skip_auth_routes matching against the full request URI. Deployments using skip_auth_routes with regex patterns containing wildcards or broad matching patterns are most at risk. This issue is fixed in version 7.11.0. Workarounds include: auditing all skip_auth_routes configurations for overly permissive patterns, replacing wildcard patterns with exact path matches where possible, ensuring regex patterns are properly anchored (starting with ^ and ending with $), or implementing custom validation that strips query parameters before regex matching.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-290
References: https://github.com/oauth2-proxy/oauth2-proxy/blob/f4b33b64bd66ad28e9b0d63bea51837b83c00ca1/oauthproxy.go#L582-L584; https://github.com/oauth2-proxy/oauth2-proxy/blob/f4b33b64bd66ad28e9b0d63bea51837b83c00ca1/pkg/requests/util/util.go#L37-L44; https://github.com/oauth2-proxy/oauth2-proxy/commit/9ffafad4b2d2f9f7668e5504565f356a7c047b77
CVE: CVE-2025-54581
Published: 2025-07-30
Description: vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service. This is fixed in version 2.4.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://github.com/0x676e67/vproxy/commit/aa1bf64c5e7f1c471395f9f29175ffc1b16a1079; https://github.com/0x676e67/vproxy/releases/tag/v2.4.0; https://github.com/0x676e67/vproxy/security/advisories/GHSA-7h24-c332-p48c
CVE: CVE-2025-54582
Published: 2025-07-30
Description: Rejected reason: Reason: This candidate was issued in error. Valid Netty requests are issued via https://github.com/netty/netty.
CVE: CVE-2025-54583
Published: 2025-07-30
Description: GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a; https://github.com/finos/git-proxy/commit/bd2ecb2099cba21bca3941ee4d655d2eb887b3a9; https://github.com/finos/git-proxy/releases/tag/v1.19.2
CVE: CVE-2025-54584
Published: 2025-07-30
Description: GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-115
References: https://github.com/finos/git-proxy/commit/333c98a165a5a1ec88414db3d4a2c6f81e083e0f; https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a; https://github.com/finos/git-proxy/releases/tag/v1.19.2
CVE: CVE-2025-8330
Published: 2025-07-30
Description: A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit1.php. The manipulation of the argument sno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zgqsdx/cve/issues/1; https://vuldb.com/?ctiid.318280
CVE: CVE-2025-8331
Published: 2025-07-30
Description: A vulnerability was found in code-projects Online Farm System 1.0 and classified as critical. This issue affects some unknown processing of the file /forgot_pass.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/10; https://vuldb.com/?ctiid.318281
CVE: CVE-2025-54585
Published: 2025-07-30
Description: GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations relying on GitProxy to enforce policy and prevent unapproved changes. It requires no elevated privileges beyond regular push access, and no extra user interaction. It does however, require a GitProxy administrator or designated user (canUserApproveRejectPush) to approve pushes to the child branch. This is fixed in version 1.19.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a; https://github.com/finos/git-proxy/commit/f99fe42082eab0970e4cd0acdc3421a527a7e531; https://github.com/finos/git-proxy/releases/tag/v1.19.2
CVE: CVE-2025-8332
Published: 2025-07-30
Description: A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /register.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/9; https://vuldb.com/?ctiid.318282
CVE: CVE-2025-8333
Published: 2025-07-30
Description: A vulnerability was found in code-projects Online Farm System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /categoryvalue.php. The manipulation of the argument Value leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/wllovemy/cve/issues/8; https://vuldb.com/?ctiid.318283
CVE: CVE-2025-54586
Published: 2025-07-30
Description: GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below,   attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate sensitive data without ever leaving a trace in the branch view. We rate this a High‑impact vulnerability because it completely compromises repository confidentiality. This is fixed in version 1.19.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: https://github.com/finos/git-proxy/commit/9c1449f4ec37d2d1f3edf4328bc3757e8dba2110; https://github.com/finos/git-proxy/commit/a620a2f33c39c78e01783a274580bf822af3cc3a; https://github.com/finos/git-proxy/releases/tag/v1.19.2
CVE: CVE-2025-8334
Published: 2025-07-30
Description: A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_recruitment_status. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/CVE-Hunter-Leo/CVE/issues/1; https://vuldb.com/?ctiid.318284; https://vuldb.com/?id.318284
CVE: CVE-2025-8335
Published: 2025-07-30
Description: A vulnerability classified as problematic has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/12; https://vuldb.com/?ctiid.318285
CVE: CVE-2024-11478
Published: 2025-07-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-7356
Published: 2025-07-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-8336
Published: 2025-07-30
Description: A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_user. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/CVE-Hunter-Leo/CVE/issues/2; https://vuldb.com/?ctiid.318286; https://vuldb.com/?id.318286
CVE: CVE-2025-8337
Published: 2025-07-30
Description: A vulnerability, which was classified as problematic, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/add_vehicles.php. The manipulation of the argument car_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/i-Corner/cve/issues/13; https://vuldb.com/?ctiid.318287
CVE: CVE-2025-36039
Published: 2025-07-31
Description: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms,
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7241007
CVE: CVE-2025-36040
Published: 2025-07-31
Description: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://www.ibm.com/support/pages/node/7241007
CVE: CVE-2025-49082
Published: 2025-07-31
Description: CVE-2025-49082 is a vulnerability in the management console
of Absolute Secure Access prior to version 13.56. Attackers with administrative
access to the console and who have been assigned a certain set of permissions
can bypass those permissions to improperly read other settings. The attack
complexity is low, there are no preexisting attack requirements; the privileges
required are high, and there is no user interaction required. The impact to
system confidentiality is low, there is no impact to system availability or
integrity.
CVSS Score: 2.7 (LOW)
CWE: CWE-276
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-49082
CVE: CVE-2025-49083
Published: 2025-07-31
Description: CVE-2025-49083 is a vulnerability in the management console
of Absolute Secure Access after version 12.00 and prior to version 13.56.
Attackers with administrative access to the console can cause unsafe content to
be deserialized and executed in the security context of the console. The attack
complexity is low and there are no attack requirements. Privileges required are
high and there is no user interaction required. The impact to confidentiality
is low, impact to integrity is high and there is no impact to availability. The
impact to the confidentiality and integrity of subsequent systems is low and
there is no subsequent system impact to availability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-49083
CVE: CVE-2025-49084
Published: 2025-07-31
Description: CVE-2025-49084 is a vulnerability in the management console
of Absolute Secure Access prior to version 13.56. Attackers with administrative
access can overwrite policy rules without the requisite permissions. The attack
complexity is low, attack requirements are present, privileges required are
high and no user interaction is required. There is no impact to
confidentiality, the impact to integrity is low, and there is no impact to
availability. The impact to confidentiality and availability of subsequent systems
is high and the impact to the integrity of subsequent systems is low.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-49084
CVE: CVE-2025-54085
Published: 2025-07-31
Description: CVE-2025-54085 is a vulnerability in the management console
of Absolute Secure Access prior to version 13.56. Attackers with administrative
access to the console and who have been assigned a certain set of permissions
can bypass those permissions to improperly read or change other settings. The
attack complexity is low, there are no preexisting attack requirements; the
privileges required are high, and there is no user interaction required. The
impact to system confidentiality and integrity is low, there is no impact to
system availability.
CVSS Score: 3.8 (LOW)
CWE: CWE-276
References: https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54085
CVE: CVE-2025-8338
Published: 2025-07-31
Description: A vulnerability was found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adminac.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Sunhaobin318/CVE/issues/1; https://vuldb.com/?ctiid.318290; https://vuldb.com/?id.318290
CVE: CVE-2025-8339
Published: 2025-07-31
Description: A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been classified as critical. This affects an unknown part of the file /student_login.php. The manipulation of the argument user_name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/shenxianyuguitian/intern-mms-vuln/blob/main/README.md; https://vuldb.com/?ctiid.318291