deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54135
Published: 2025-08-05
Description: Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in the workspace, an attacker can chain a indirect prompt injection vulnerability to hijack the context to write to the settings file and trigger RCE on the victim without user approval. This is fixed in version 1.3.9.
CVSS Score: 8.5 (HIGH)
CWE: CWE-78, CWE-829
References: https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm
CVE: CVE-2025-54387
Published: 2025-08-05
Description: IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because the check relies on a raw string prefix comparison. This is fixed in versions 1.3.2, 2.1.1 and 3.1.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214; https://github.com/unjs/ipx/releases/tag/v1.3.2; https://github.com/unjs/ipx/releases/tag/v2.1.1
CVE: CVE-2025-54780
Published: 2025-08-05
Description: The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2.
CVSS Score: 7.7 (HIGH)
CWE: CWE-73
References: https://github.com/cconard96/glpi-screenshot-plugin/commit/49215b53a05dc792719b69c098df80100208c2c8; https://github.com/cconard96/glpi-screenshot-plugin/security/advisories/GHSA-x6mp-jhxw-9xrp
CVE: CVE-2025-54794
Published: 2025-08-05
Description: Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory with the same prefix as the CWD and the ability to add untrusted content into a Claude Code context window. This is fixed in version 0.2.111.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-pmw4-pwvc-3hx2
CVE: CVE-2025-54795
Published: 2025-08-05
Description: Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This is fixed in version 1.0.20.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/anthropics/claude-code/security/advisories/GHSA-x56v-x2h6-7j34
CVE: CVE-2025-54802
Published: 2025-08-05
Description: pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suffers from an unsafe path construction vulnerability, allowing unauthenticated attackers to write arbitrary files outside the designated storage directory. This can be abused to overwrite critical system files, including cron jobs and systemd services, leading to privilege escalation and remote code execution as root. This issue is fixed in version 0.5.0b3.dev90.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/pyload/pyload/commit/70a44fe02c03bce92337b5d370d2a45caa4de3d4; https://github.com/pyload/pyload/pull/4596; https://github.com/pyload/pyload/security/advisories/GHSA-48rp-jc79-2264
CVE: CVE-2025-54803
Published: 2025-08-05
Description: js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed in version 1.0.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/siunam321/f3dc4d21a5a932c67b6c11d0026f5afc; https://github.com/sunnyadn/js-toml/commit/b125910a3f094b744c9c3571360d4b9e3a472f66; https://github.com/sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2
CVE: CVE-2025-54804
Published: 2025-08-05
Description: Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server. This is fixed in version 0.54.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/Eugeny/russh/commit/0eb5e406780890e21ff71dd25d731b30676478e5; https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm; https://github.com/Eugeny/russh/security/advisories/GHSA-h5rc-j5f5-3gcm
CVE: CVE-2025-54865
Published: 2025-08-05
Description: Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the Tilesheets extension allows users to insert and potentially execute malicious SQL code. This issue has not been fixed.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/FTB-Gamepedia/Tilesheets/blob/8debbf8ee6ddb02bf9c756bab5c085b007d72c50/special/SheetManager.php#L255; https://github.com/FTB-Gamepedia/Tilesheets/security/advisories/GHSA-hqfr-7cm9-4h87; https://github.com/FTB-Gamepedia/Tilesheets/security/advisories/GHSA-hqfr-7cm9-4h87
CVE: CVE-2025-54870
Published: 2025-08-05
Description: VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed in version 3.0.18. To workaround this issue, avoid blowfish-256.
CWE: CWE-636
References: https://github.com/leakingmemory/vtun-ng/commit/8c63982b6c487c52db1d56ab94c266f0bc857140; https://github.com/leakingmemory/vtun-ng/security/advisories/GHSA-m3jc-27c6-2wrf
CVE: CVE-2025-54871
Published: 2025-08-05
Description: Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRON_RUN_AS_NODE. This environment variable allows arbitrary Node.js code to be executed via the -e flag, which runs inside the main Electron context, inheriting any previously granted TCC entitlements (such as access to Documents, Downloads, etc.). This issue is fixed in version 2.20.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://github.com/steveseguin/electroncapture/commit/3837f54e75911bb99fa45cfa138a5e401d16f531; https://github.com/steveseguin/electroncapture/releases/tag/2.20.0; https://github.com/steveseguin/electroncapture/security/advisories/GHSA-8849-p3j4-jq4h
CVE: CVE-2025-8535
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the file /main.js of the component xrb URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://drive.google.com/file/d/1Hil-UQiLweGe9q1aCiiyQoiW9wOJsY7-/view?usp=drive_link; https://gist.github.com/jackfromeast/1e2e206813887a470e00b8474c616567; https://vuldb.com/?ctiid.318665
CVE: CVE-2025-8537
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-400, CWE-770, CWE-617
References: https://drive.google.com/file/d/1AkRpx3wcMy3Ic9tQeQyRJybBipK72aQO/view?usp=drive_link; https://github.com/axiomatic-systems/Bento4/issues/1037; https://vuldb.com/?ctiid.318666
CVE: CVE-2025-8538
Published: 2025-08-05
Description: A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /usuarios/tipos/novo. The manipulation of the argument name/description leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8538/; https://vuldb.com/?ctiid.318667; https://vuldb.com/?id.318667
CVE: CVE-2025-8539
Published: 2025-08-05
Description: A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet/public_distrito_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8539/; https://vuldb.com/?ctiid.318668; https://vuldb.com/?id.318668
CVE: CVE-2025-53417
Published: 2025-08-05
Description: DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability
CWE: CWE-35
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00010_DIAView%20Directory%20Traversal%20Information%20Disclosure.pdf
CVE: CVE-2025-8540
Published: 2025-08-05
Description: A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8540/; https://vuldb.com/?ctiid.318669; https://vuldb.com/?id.318669
CVE: CVE-2025-8541
Published: 2025-08-05
Description: A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8541/; https://vuldb.com/?ctiid.318670; https://vuldb.com/?id.318670
CVE: CVE-2025-8542
Published: 2025-08-05
Description: A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8542/; https://vuldb.com/?ctiid.318671; https://vuldb.com/?id.318671
CVE: CVE-2025-8543
Published: 2025-08-05
Description: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8543/; https://vuldb.com/?ctiid.318672; https://vuldb.com/?id.318672
CVE: CVE-2025-54868
Published: 2025-08-05
Description: LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without proper access control. This results in the ability to read chats from arbitrary users. This issue is fixed in version 0.7.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://github.com/danny-avila/LibreChat/commit/0e8041bcac616949c42a68dfb8f108ccc4db5151; https://github.com/danny-avila/LibreChat/security/advisories/GHSA-p5j8-m4wh-ffmw
CVE: CVE-2025-8544
Published: 2025-08-05
Description: A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module/RegraAvaliacao/edit. The manipulation of the argument nome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8544/; https://vuldb.com/?ctiid.318673; https://vuldb.com/?id.318673
CVE: CVE-2025-8545
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /intranet/educar_motivo_afastamento_cad.php. The manipulation of the argument nm_motivo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-8545/; https://vuldb.com/?ctiid.318674; https://vuldb.com/?id.318674
CVE: CVE-2025-8546
Published: 2025-08-05
Description: A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287, CWE-804
References: https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf; https://github.com/atjiu/pybbs/issues/199; https://github.com/atjiu/pybbs/issues/199#issue[PII_REDACTED]
CVE: CVE-2025-54982
Published: 2025-08-05
Description: An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-347
References: https://help.zscaler.com/zia/about-identity-providers
CVE: CVE-2025-8547
Published: 2025-08-05
Description: A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as critical. This vulnerability affects unknown code of the component Email Verification Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 044f22893bee254dc2bb0d30f614913fab3c22c2. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/atjiu/pybbs/commit/044f22893bee254dc2bb0d30f614913fab3c22c2; https://github.com/atjiu/pybbs/issues/200; https://github.com/atjiu/pybbs/issues/200#issue[PII_REDACTED]
CVE: CVE-2025-7050
Published: 2025-08-05
Description: The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can be exploited by the lowest authentication level permitted to upload files, including unauthenticated users, once a file upload shortcode is published on a publicly accessible post.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://wpcloudplugins.gitbook.io/docs/other/changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/de0c8922-b290-4582-9079-e79da684bcff?source=cve
CVE: CVE-2025-8313
Published: 2025-08-05
Description: The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/campus-directory/tags/1.9.1/includes/emd-form-builder-lite/emd-form-frontend.php; https://plugins.trac.wordpress.org/changeset/3337642; https://wordpress.org/plugins/campus-directory/#developers
CVE: CVE-2025-8315
Published: 2025-08-05
Description: The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/wp-easy-contact/tags/4.0.1/includes/emd-form-builder-lite/emd-form-frontend.php; https://plugins.trac.wordpress.org/changeset/3337661; https://wordpress.org/plugins/wp-easy-contact/#developers
CVE: CVE-2025-8548
Published: 2025-08-05
Description: A vulnerability was found in atjiu pybbs up to 6.0.0 and classified as problematic. This issue affects the function sendEmailCode of the file src/main/java/co/yiiu/pybbs/controller/api/SettingsApiController.java of the component Registered Email Handler. The manipulation of the argument email leads to information exposure through error message. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 234197c4f8fc7ce24bdcff5430cd42492f28936a. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-209
References: https://github.com/atjiu/pybbs/commit/234197c4f8fc7ce24bdcff5430cd42492f28936a; https://github.com/atjiu/pybbs/issues/202; https://github.com/atjiu/pybbs/issues/202#issue[PII_REDACTED]
CVE: CVE-2025-8549
Published: 2025-08-05
Description: A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as d09cb19a8e7d7e[PII_REDACTED]ada54080244d499f. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-521
References: https://github.com/atjiu/pybbs/commit/d09cb19a8e7d7e[PII_REDACTED]ada54080244d499f; https://github.com/atjiu/pybbs/issues/201; https://github.com/atjiu/pybbs/issues/201#issue[PII_REDACTED]
CVE: CVE-2025-8550
Published: 2025-08-05
Description: A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/topic/list. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 2fe4a51afbce0068c291bc1818bbc8f7f3b01a22. It is recommended to apply a patch to fix this issue.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/atjiu/pybbs/commit/2fe4a51afbce0068c291bc1818bbc8f7f3b01a22; https://github.com/atjiu/pybbs/issues/203; https://github.com/atjiu/pybbs/issues/203#issue[PII_REDACTED]
CVE: CVE-2025-2810
Published: 2025-08-05
Description: A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-321
References: https://certvde.com/en/advisories/VDE-2025-028
CVE: CVE-2025-41698
Published: 2025-08-05
Description: A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://certvde.com/en/advisories/VDE-2025-028
CVE: CVE-2025-5061
Published: 2025-08-05
Description: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpie_parse_upload_data' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 3.9.29.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/includes/classes/import/class-wpie-upload-validate.php#L24; https://plugins.trac.wordpress.org/browser/wp-import-export-lite/trunk/includes/classes/import/class-wpie-upload-validate.php#L89; https://plugins.trac.wordpress.org/changeset/3323402/