deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7157
Published: 2025-07-08
Description: A vulnerability was found in code-projects Online Note Sharing 1.0. It has been classified as critical. Affected is an unknown function of the file /login.php. The manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/3; https://vuldb.com/?ctiid.315096
CVE: CVE-2025-7158
Published: 2025-07-08
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/manage-normal-ticket.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/101; https://phpgurukul.com/; https://vuldb.com/?ctiid.315097
CVE: CVE-2025-7159
Published: 2025-07-08
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/manage-animals.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/102; https://phpgurukul.com/; https://vuldb.com/?ctiid.315098
CVE: CVE-2025-7160
Published: 2025-07-08
Description: A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. This affects an unknown part of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/103; https://phpgurukul.com/; https://vuldb.com/?ctiid.315099
CVE: CVE-2025-7161
Published: 2025-07-08
Description: A vulnerability classified as critical was found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-normal-ticket.php. The manipulation of the argument cprice leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/104; https://phpgurukul.com/; https://vuldb.com/?ctiid.315100
CVE: CVE-2025-5537
Published: 2025-07-08
Description: The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3322273%40foobox-image-lightbox&new=3322273%40foobox-image-lightbox&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd2163-b8ef-4dd1-a12b-cd[PII_REDACTED]?source=cve
CVE: CVE-2025-5957
Published: 2025-07-08
Description: The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/ajax.php#L133; https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/class-dbquery.php#L736; https://plugins.trac.wordpress.org/changeset/3322664/
CVE: CVE-2025-7162
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown processing of the file /admin/add-foreigners-ticket.php. The manipulation of the argument cprice leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/105; https://phpgurukul.com/; https://vuldb.com/?ctiid.315101
CVE: CVE-2025-7163
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/add-animals.php. The manipulation of the argument cnum leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/106; https://phpgurukul.com/; https://vuldb.com/?ctiid.315102
CVE: CVE-2025-7164
Published: 2025-07-08
Description: A vulnerability has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/107; https://vuldb.com/?ctiid.315103; https://vuldb.com/?id.315103
CVE: CVE-2025-7165
Published: 2025-07-08
Description: A vulnerability was found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/108; https://vuldb.com/?ctiid.315104; https://vuldb.com/?id.315104
CVE: CVE-2025-7327
Published: 2025-07-08
Description: The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3316262%40business-reviews-wp%2Ftrunk&old=3201057%40business-reviews-wp%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4681e56f-1dad-46a7-8ac7-1f543a383433?source=cve
CVE: CVE-2025-24002
Published: 2025-07-08
Description: An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://certvde.com/en/advisories/VDE-2025-014
CVE: CVE-2025-24003
Published: 2025-07-08
Description: An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations.
CVSS Score: 8.2 (HIGH)
CWE: CWE-120
References: https://certvde.com/en/advisories/VDE-2025-014
CVE: CVE-2025-24004
Published: 2025-07-08
Description: A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-120
References: https://certvde.com/de/advisories/VDE-2025-014
CVE: CVE-2025-24005
Published: 2025-07-08
Description: A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://certvde.com/de/advisories/VDE-2025-014
CVE: CVE-2025-24006
Published: 2025-07-08
Description: A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://certvde.com/de/advisories/VDE-2025-014
CVE: CVE-2025-25268
Published: 2025-07-08
Description: An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://certvde.com/de/advisories/VDE-2025-019
CVE: CVE-2025-25269
Published: 2025-07-08
Description: An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://certvde.com/de/advisories/VDE-2025-019
CVE: CVE-2025-25270
Published: 2025-07-08
Description: An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-913
References: https://certvde.com/de/advisories/VDE-2025-019
CVE: CVE-2025-25271
Published: 2025-07-08
Description: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1188
References: https://certvde.com/de/advisories/VDE-2025-019
CVE: CVE-2025-41665
Published: 2025-07-08
Description: An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://certvde.com/en/advisories/VDE-2025-054
CVE: CVE-2025-41666
Published: 2025-07-08
Description: A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://certvde.com/en/advisories/VDE-2025-054
CVE: CVE-2025-41667
Published: 2025-07-08
Description: A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://certvde.com/en/advisories/VDE-2025-054
CVE: CVE-2025-41668
Published: 2025-07-08
Description: A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://certvde.com/en/advisories/VDE-2025-054
CVE: CVE-2025-42956
Published: 2025-07-08
Description: SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, injected input data will be used by the web site page generation to create content which when executed in the victim's browser leading to low impact on Confidentiality and Integrity with no effect on Availability of the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3617131; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-6743
Published: 2025-07-08
Description: The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492; https://www.wordfence.com/threat-intel/vulnerabilities/id/4b881509-572b-4e2d-9e75-defaa2cc32dc?source=cve
CVE: CVE-2025-6746
Published: 2025-07-08
Description: The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492; https://www.wordfence.com/threat-intel/vulnerabilities/id/98c1363e-b25d-46fc-b6bf-0285a37f748c?source=cve
CVE: CVE-2025-7166
Published: 2025-07-08
Description: A vulnerability was found in code-projects Responsive Blog Site 1.0. It has been classified as critical. This affects an unknown part of the file /single.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/7; https://vuldb.com/?ctiid.315105
CVE: CVE-2025-7167
Published: 2025-07-08
Description: A vulnerability was found in code-projects Responsive Blog Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /category.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/8; https://vuldb.com/?ctiid.315106
CVE: CVE-2025-7346
Published: 2025-07-08
Description: Any unauthenticated attacker can bypass the localhost 
restrictions posed by the application and utilize this to create 
arbitrary packages
CWE: CWE-281
References: https://github.com/pyload/pyload/security/advisories/GHSA-x698-5hjm-w2m5
CVE: CVE-2025-38237
Published: 2025-07-08
Description: In the Linux kernel, the following vulnerability has been resolved:

media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()

In fimc_is_hw_change_mode(), the function changes camera modes without
waiting for hardware completion, risking corrupted data or system hangs
if subsequent operations proceed before the hardware is ready.

Add fimc_is_hw_wait_intmsr0_intmsd0() after mode configuration, ensuring
hardware state synchronization and stable interrupt handling.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/14acbb5af101b7bb58c0952949bba4c5fdf0ee7e; https://git.kernel.org/stable/c/b0d92b94278561f43057003a73a17ce13b7c1a1a; https://git.kernel.org/stable/c/bb97dfab7615fea97322b8a6131546e80f878a69
CVE: CVE-2025-7168
Published: 2025-07-08
Description: A vulnerability was found in code-projects Crime Reporting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /userlogin.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/9; https://vuldb.com/?ctiid.315107
CVE: CVE-2025-7169
Published: 2025-07-08
Description: A vulnerability classified as critical has been found in code-projects Crime Reporting System 1.0. Affected is an unknown function of the file /complainer_page.php. The manipulation of the argument location leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/fpclose/cve/issues/4; https://vuldb.com/?ctiid.315108
CVE: CVE-2025-7170
Published: 2025-07-08
Description: A vulnerability classified as critical was found in code-projects Crime Reporting System 1.0. Affected by this vulnerability is an unknown functionality of the file /registration.php. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/fpclose/cve/issues/3; https://vuldb.com/?ctiid.315109
CVE: CVE-2025-7171
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, has been found in code-projects Crime Reporting System 1.0. Affected by this issue is some unknown functionality of the file /policelogin.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/tangjihong1974/cve/issues/4; https://vuldb.com/?ctiid.315110
CVE: CVE-2025-6744
Published: 2025-07-08
Description: The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_get_products_shortcode() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://themeforest.net/item/woodmart-woocommerce-wordpress-theme/20264492; https://www.wordfence.com/threat-intel/vulnerabilities/id/dd056d29-3bd9-49e4-bcc4-fa487de8a27e?source=cve
CVE: CVE-2025-7172
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, was found in code-projects Crime Reporting System 1.0. This affects an unknown part of the file /headlogin.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/A1b2rt/CVE/issues/5; https://vuldb.com/?ctiid.315111
CVE: CVE-2025-7173
Published: 2025-07-08
Description: A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-student.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Qq2240151/CVE/issues/2; https://vuldb.com/?ctiid.315112
CVE: CVE-2024-31853
Published: 2025-07-08
Description: A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed device, the affected application doesn't check the extended key usage attribute of that device's certificate.
This could allow an attacker to execute an on-path network (MitM) attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://cert-portal.siemens.com/productcert/html/ssa-183963.html
CVE: CVE-2024-31854
Published: 2025-07-08
Description: A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed device, the affected application doesn't check device's certificate common name against an expected value.
This could allow an attacker to execute an on-path network (MitM) attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295
References: https://cert-portal.siemens.com/productcert/html/ssa-183963.html
CVE: CVE-2025-20982
Published: 2025-07-08
Description: Out-of-bounds write in setting auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-20983
Published: 2025-07-08
Description: Out-of-bounds write in checking auth secret in KnoxVault trustlet prior to SMR Jul-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-20997
Published: 2025-07-08
Description: Incorrect default permission in Framework for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to reset some configuration of Galaxy Watch.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-20998
Published: 2025-07-08
Description: Improper access control in SamsungAccount for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to access phone number.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-20999
Published: 2025-07-08
Description: Improper authorization in accessing saved Wi-Fi password for Galaxy Tablet prior to SMR Jul-2025 Release 1 allows secondary users to access owner's saved Wi-Fi password.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-863
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-21000
Published: 2025-07-08
Description: Improper privilege management in Bluetooth prior to SMR Jul-2025 Release 1 allows local attackers to enable Bluetooth.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-21001
Published: 2025-07-08
Description: Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to stop broadcasting Auracast.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-21002
Published: 2025-07-08
Description: Improper access control in LeAudioService prior to SMR Jul-2025 Release 1 allows local attackers to manipulate broadcasting Auracast.
CVSS Score: 6.2 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-21003
Published: 2025-07-08
Description: Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-922
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07
CVE: CVE-2025-21004
Published: 2025-07-08
Description: Improper verification of intent by broadcast receiver in System UI for Galaxy Watch prior to SMR Jul-2025 Release 1 allows local attackers to power off the device.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-347
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=07