deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-61788
Published: 2025-10-08
Description: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified. The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers of users watching the prepared media. This can then be used to modify the site or to execute actions in the name of logged-in users. To inject malicious metadata, an attacker needs write access to the system. For example, the ability to upload media and modify metadata. This cannot be exploited by unauthenticated users. This issue is fixed in Opencast 17.8 and 18.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/opencast/opencast/commit/2809520fa88d108d8104c760f00c10bad42c14f9; https://github.com/opencast/opencast/security/advisories/GHSA-m2vg-rmq6-p62r
CVE: CVE-2025-61906
Published: 2025-10-08
Description: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on "Save & Publish" before then selecting the "Save" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91; https://github.com/opencast/opencast-editor/issues/1626; https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv
CVE: CVE-2025-9868
Published: 2025-10-08
Description: Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate proxy repository credentials via crafted HTTP requests.
CWE: CWE-918
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]3635
CVE: CVE-2025-11490
Published: 2025-10-08
Description: A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term."
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218; https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218#issue[PII_REDACTED]; https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218#issuecomment[PII_REDACTED]
CVE: CVE-2025-11491
Published: 2025-10-08
Description: A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217; https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217#issue[PII_REDACTED]; https://vuldb.com/?ctiid.327610
CVE: CVE-2025-57457
Published: 2025-10-08
Description: An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://curo.com; https://github.com/restdone/CVE-2025-57457/tree/main
CVE: CVE-2025-61524
Published: 2025-10-08
Description: An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login
CVSS Score: 7.2 (HIGH)
CWE: CWE-285
References: http://casdoor.com; https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a; https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd
CVE: CVE-2025-11494
Published: 2025-10-08
Description: A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-125, CWE-125
References: https://sourceware.org/bugzilla/attachment.cgi?id=16389; https://sourceware.org/bugzilla/show_bug.cgi?id=33499; https://sourceware.org/bugzilla/show_bug.cgi?id=33499#c2
CVE: CVE-2025-11495
Published: 2025-10-08
Description: A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-122
References: https://sourceware.org/bugzilla/attachment.cgi?id=16393; https://sourceware.org/bugzilla/show_bug.cgi?id=33502; https://sourceware.org/bugzilla/show_bug.cgi?id=33502#c3
CVE: CVE-2025-11503
Published: 2025-10-08
Description: A vulnerability was determined in PHPGurukul Beauty Parlour Management System 1.1. This issue affects some unknown processing of the file /admin/manage-services.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f000x0/cve/issues/9; https://phpgurukul.com/; https://vuldb.com/?ctiid.327629
CVE: CVE-2025-60311
Published: 2025-10-08
Description: ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60311/README.md; https://github.com/projectworldsofficial/Gym-Management-System-Project-in-PHP; https://youtu.be/J_7G_AahgSw
CVE: CVE-2017-20201
Published: 2025-10-08
Description: CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 (32-bit builds) contained a malicious pre-entry-point loader that diverts execution from __scrt_common_main_seh into a custom loader. That loader decodes an embedded blob into shellcode, allocates executable heap memory, resolves Windows API functions at runtime, and transfers execution to an in-memory payload. The payload performs anti-analysis checks, gathers host telemetry, encodes the data with a two-stage obfuscation, and attempts HTTPS exfiltration to hard-coded C2 servers or month-based DGA domains. Potential impacts include remote data collection and exfiltration, stealthy in-memory execution and persistence, and potential lateral movement. CCleaner was developed by Piriform, which was acquired by Avast in July 2017; Avast later merged with NortonLifeLock to form the parent company now known as Gen Digital. According to vendor advisories, the compromised CCleaner build was released on August 15, 2017 and remediated on September 12, 2017 with v5.34; the compromised CCleaner Cloud build was released on August 24, 2017 and remediated on September 15, 2017 with v1.07.3214.
CWE: CWE-506
References: https://blog.avast.com/progress-on-ccleaner-investigation; https://blog.avast.com/update-to-the-ccleaner-5.33.6162-security-incident; https://blog.talosintelligence.com/avast-distributes-malware/
CVE: CVE-2017-20202
Published: 2025-10-08
Description: Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to affiliate programs, and attempted to harvest credentials when users logged in. Injected components enumerate common banner sizes for substitution, replace third-party ad calls, and redirect victim traffic to affiliate landing pages. Potential impacts include user-level code execution in the browser context, large-scale ad fraud and traffic hijacking, credential theft, and exposure to additional payloads delivered by the actor. The compromise was reported on by the maintainer of Web Developer for Chrome on August 2, 2017 and remediated in v0.5.0.
CWE: CWE-506
References: https://chromewebstore.google.com/detail/web-developer/bfbameneiokkgbdmiekhjnmfkcnldhhm?pli=1; https://gist.github.com/piedpiperRichard/076516da60f45842f1a6e6ae35a9a240/; https://ui.vision/blog/chrome-extension-adware/
CVE: CVE-2025-11505
Published: 2025-10-08
Description: A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Impacted is an unknown function of the file /admin/new-appointment.php. The manipulation of the argument delid leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f000x0/cve/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.327630
CVE: CVE-2025-11506
Published: 2025-10-08
Description: A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/search-appointment.php. The manipulation of the argument searchdata results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f000x0/cve/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.327631
CVE: CVE-2025-11507
Published: 2025-10-08
Description: A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/search-invoices.php. This manipulation of the argument searchdata causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f000x0/cve/issues/13; https://phpgurukul.com/; https://vuldb.com/?ctiid.327632
CVE: CVE-2025-11535
Published: 2025-10-08
Description: MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24.
CWE: CWE-276
References: https://www.mongodb.com/docs/bi-connector/current/release-notes/#bi-2.14.25
CVE: CVE-2025-11508
Published: 2025-10-08
Description: A security vulnerability has been detected in code-projects Voting System 1.0. This affects an unknown function of the file /admin/voters_add.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/13; https://vuldb.com/?ctiid.327633
CVE: CVE-2025-11509
Published: 2025-10-08
Description: A vulnerability was detected in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/product_add.php. Performing manipulation of the argument prod_name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Blowingwinds/cve-report/blob/main/cve1/report.md; https://vuldb.com/?ctiid.327634
CVE: CVE-2025-11511
Published: 2025-10-08
Description: A flaw has been found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/supplier_add.php. Executing manipulation of the argument supp_email can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Blowingwinds/cve-report/blob/main/cve4/report.md; https://vuldb.com/?ctiid.327635
CVE: CVE-2025-61913
Published: 2025-10-08
Description: Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22
References: https://github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3; https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8; https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c
CVE: CVE-2025-11512
Published: 2025-10-09
Description: A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manipulation of the argument Firstname/Lastname/Platform results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/underatted/CVE/issues/14; https://vuldb.com/?ctiid.327637
CVE: CVE-2025-11513
Published: 2025-10-09
Description: A vulnerability was determined in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/supplier_update.php. This manipulation of the argument supp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/cxm947/CVE-report-251006; https://vuldb.com/?ctiid.327638
CVE: CVE-2025-11514
Published: 2025-10-09
Description: A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Aurion365/cve/issues/1; https://vuldb.com/?ctiid.327639
CVE: CVE-2025-11515
Published: 2025-10-09
Description: A security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/register-complaint.php. Performing manipulation of the argument cid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Aurion365/cve/issues/2; https://vuldb.com/?ctiid.327640
CVE: CVE-2025-11516
Published: 2025-10-09
Description: A weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.php. Executing manipulation of the argument cid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Aurion365/cve/issues/3; https://vuldb.com/?ctiid.327641
CVE: CVE-2025-10496
Published: 2025-10-09
Description: The Cookie Notice & Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uuid parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/cookie-notice-consent/tags/1.6.5/includes/class-cnc-admin.php#L33; https://plugins.trac.wordpress.org/browser/cookie-notice-consent/tags/1.6.5/includes/class-cnc-logger.php#L141; https://plugins.trac.wordpress.org/browser/cookie-notice-consent/tags/1.6.5/includes/class-cnc-logger.php#L259
CVE: CVE-2025-10586
Published: 2025-10-09
Description: The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/community-events/trunk/community-events.php?rev=3115223; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3369351%40community-events%2Ftrunk&old=3115222%40community-events%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/community-events/
CVE: CVE-2025-11166
Published: 2025-10-09
Description: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46. This is due to the plugin exposing state-changing REST actions through an AJAX bridge without proper CSRF token validation, and having destructive logic reachable via GET requests with no permission_callback. This makes it possible for unauthenticated attackers to force logged-in administrators to create, update, or delete markers and geometry features via CSRF attacks, and allows anonymous users to trigger mass deletion of markers via unsafe GET requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L287; https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L45; https://plugins.trac.wordpress.org/browser/wp-google-maps/trunk/includes/class.rest-api.php#L850
CVE: CVE-2025-11523
Published: 2025-10-09
Description: A vulnerability was detected in Tenda AC7 15.03.06.44. This vulnerability affects unknown code of the file /goform/AdvSetLanip. The manipulation of the argument lanIp results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/AdvSetLanip.md; https://vuldb.com/?ctiid.327661; https://vuldb.com/?id.327661
CVE: CVE-2025-11524
Published: 2025-10-09
Description: A flaw has been found in Tenda AC7 15.03.06.44. This issue affects some unknown processing of the file /goform/SetDDNSCfg. This manipulation of the argument ddnsEn causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/SetDDNSCfg.md; https://vuldb.com/?ctiid.327662; https://vuldb.com/?id.327662
CVE: CVE-2025-11525
Published: 2025-10-09
Description: A vulnerability has been found in Tenda AC7 15.03.06.44. Impacted is an unknown function of the file /goform/SetUpnpCfg. Such manipulation of the argument upnpEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/SetUpnpCfg.md; https://vuldb.com/?ctiid.327663; https://vuldb.com/?id.327663
CVE: CVE-2025-11526
Published: 2025-10-09
Description: A vulnerability was found in Tenda AC7 15.03.06.44. The affected element is an unknown function of the file /goform/WifiMacFilterSet. Performing a manipulation of the argument wifi_chkHz results in stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/WifiMacFilterSet.md; https://vuldb.com/?ctiid.327664; https://vuldb.com/?id.327664
CVE: CVE-2025-11527
Published: 2025-10-09
Description: A vulnerability was determined in Tenda AC7 15.03.06.44. The impacted element is an unknown function of the file /goform/fast_setting_pppoe_set. Executing a manipulation of the argument Password can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/fast_setting_pppoe_set.md; https://vuldb.com/?ctiid.327665; https://vuldb.com/?id.327665
CVE: CVE-2025-11528
Published: 2025-10-09
Description: A vulnerability was identified in Tenda AC7 15.03.06.44. This affects an unknown function of the file /goform/saveAutoQos. The manipulation of the argument enable leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/AC7/saveAutoQos.md; https://vuldb.com/?ctiid.327666; https://vuldb.com/?id.327666
CVE: CVE-2025-11529
Published: 2025-10-09
Description: A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 3a1cffd2aea63d884025949cfbcfd274d06216a4. A patch should be applied to remediate this issue.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-306
References: https://github.com/ChurchCRM/CRM/commit/3a1cffd2aea63d884025949cfbcfd274d06216a4; https://github.com/ChurchCRM/CRM/pull/7376; https://github.com/uartu0/advisories/blob/main/churchcrm-api-auth-bypass-2025.md