deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12250
Published: 2025-10-27
Description: A flaw has been found in OpenWGA 7.11.12 Build 737. This affects an unknown function of the file WGA.File of the component TMLScript API. Executing manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://github.com/mikecole-mg/security_findings/blob/main/openwga/openwga-rce.md; https://vuldb.com/?ctiid.329921; https://vuldb.com/?id.329921
CVE: CVE-2025-12251
Published: 2025-10-27
Description: A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/mikecole-mg/security_findings/blob/main/openwga/openwga-xss.md; https://vuldb.com/?ctiid.329922; https://vuldb.com/?id.329922
CVE: CVE-2025-12252
Published: 2025-10-27
Description: A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of the argument content results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xmqaq/cve/issues/10; https://vuldb.com/?ctiid.329923
CVE: CVE-2025-12253
Published: 2025-10-27
Description: A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/guapiqing/cve/issues/3; https://vuldb.com/?ctiid.329924; https://vuldb.com/?id.329924
CVE: CVE-2025-12254
Published: 2025-10-27
Description: A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.php. Such manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/daminqaq/damin-CVE/issues/2; https://vuldb.com/?ctiid.329925
CVE: CVE-2025-12255
Published: 2025-10-27
Description: A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing manipulation of the argument fullname results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zzonce/cve/issues/3; https://vuldb.com/?ctiid.329926
CVE: CVE-2025-46582
Published: 2025-10-27
Description: A private key disclosure vulnerability exists in ZTE's ZXMP M721 product. A low-privileged user can bypass authorization checks to view the device's communication private key, resulting in key exposure and impacting communication security.
CVSS Score: 7.7 (HIGH)
CWE: CWE-321
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]512220847
CVE: CVE-2025-10561
Published: 2025-10-27
Description: Rejected reason: This CVE ID was assigned in error.

The End-of-Life status of a component, by itself, does not constitute a vulnerability under the CVE Program’s rules.

This condition represents a security weakness (CWE-1104: Use of Unmaintained Third-Party Components) rather than a specific vulnerability instance.
CVE: CVE-2025-12256
Published: 2025-10-27
Description: A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Executing manipulation of the argument contestant_id can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/zzonce/cve/issues/2; https://vuldb.com/?ctiid.329927
CVE: CVE-2025-12257
Published: 2025-10-27
Description: A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Cloverhyl/CVE/issues/2; https://vuldb.com/?ctiid.329928; https://vuldb.com/?id.329928
CVE: CVE-2025-12258
Published: 2025-10-27
Description: A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component POST Parameter Handler. The manipulation of the argument opmode results in stack-based buffer overflow. The attack may be performed from remote.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setOpModeCfg.md; https://vuldb.com/?ctiid.329929; https://vuldb.com/?id.329929
CVE: CVE-2025-12259
Published: 2025-10-27
Description: A flaw has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. This manipulation of the argument recHour causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setScheduleCfg.md; https://vuldb.com/?ctiid.329930; https://vuldb.com/?id.329930
CVE: CVE-2025-12260
Published: 2025-10-27
Description: A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. Such manipulation of the argument enable leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setSyslogCfg.md; https://vuldb.com/?ctiid.329931; https://vuldb.com/?id.329931
CVE: CVE-2025-12261
Published: 2025-10-27
Description: A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://codeastro.com/; https://github.com/JeromClown/cve/issues/1; https://vuldb.com/?ctiid.329932
CVE: CVE-2025-46583
Published: 2025-10-27
Description: There is a Denial of Service（DoS）vulnerability in the ZTE MC889A Pro product. Due to insufficient validation of the input parameters of the Short Message Service interface, allowing an attacker to exploit it to carry out a DoS attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/[PII_REDACTED]512220894
CVE: CVE-2025-8432
Published: 2025-10-27
Description: Incorrect Default Permissions vulnerability in Centreon Infra Monitoring (MBI modules) allows Embedding Scripts within Scripts by CentreonBI user account on the MBI server This issue affects Infra Monitoring: from 24.10.0 before 24.10.6, from 24.04.0 before 24.04.9, from 23.10.0 before 23.10.15.
CVSS Score: 8.4 (HIGH)
CWE: CWE-276
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-8432-centreon-mbi-high-severity-5180
CVE: CVE-2025-12262
Published: 2025-10-27
Description: A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/anyizilegong/cve/issues/1; https://vuldb.com/?ctiid.329933
CVE: CVE-2025-12263
Published: 2025-10-27
Description: A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/anyizilegong/cve/issues/2; https://vuldb.com/?ctiid.329934
CVE: CVE-2025-12264
Published: 2025-10-27
Description: A security flaw has been discovered in Wisencode up to 20251012. Affected by this vulnerability is an unknown functionality of the file /support-ticket/create of the component Create Support Ticket Handler. The manipulation of the argument Message results in cross site scripting. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.329935; https://vuldb.com/?id.329935; https://vuldb.com/?submit.673806
CVE: CVE-2025-12265
Published: 2025-10-27
Description: A weakness has been identified in Tenda CH22 1.0.0.1. Affected by this issue is the function fromVirtualSer of the file /goform/VirtualSer. This manipulation of the argument page causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/18; https://vuldb.com/?ctiid.329936; https://vuldb.com/?id.329936
CVE: CVE-2025-12266
Published: 2025-10-27
Description: A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty of the file /index.php/auth/widget. Performing manipulation of the argument get.layer/get.widget/get.action results in code injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-94
References: http://101.200.76.102:38765/qwertyuiop/Vuldb/Zytec.html; https://vuldb.com/?ctiid.329938; https://vuldb.com/?id.329938
CVE: CVE-2025-12267
Published: 2025-10-27
Description: A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.329939; https://vuldb.com/?id.329939; https://vuldb.com/?submit.673717
CVE: CVE-2025-59459
Published: 2025-10-27
Description: An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-59460
Published: 2025-10-27
Description: The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1391
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-59461
Published: 2025-10-27
Description: A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-59462
Published: 2025-10-27
Description: An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-59463
Published: 2025-10-27
Description: An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-833
References: https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices; https://www.first.org/cvss/calculator/3.1
CVE: CVE-2025-11955
Published: 2025-10-27
Description: Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.
CWE: CWE-299
References: https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-validation-ocsp-certificates-thegreenbow-vpn-client-windows; https://www.thegreenbow.com/en/support/security-alerts/
CVE: CVE-2025-12268
Published: 2025-10-27
Description: A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Impacted is an unknown function of the file /api/v1/courses/ of the component Course Thumbnail Handler. The manipulation of the argument thumbnail leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://gist.github.com/KhanMarshaI/ef07d20eb1cbe30c71722fbded7cc056; https://vuldb.com/?ctiid.329940; https://vuldb.com/?id.329940
CVE: CVE-2025-12269
Published: 2025-10-27
Description: A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/settings/previews of the component Account Setting Page. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/KhanMarshaI/c06263648d8a807108801e1a4daf0ab9; https://vuldb.com/?ctiid.329941; https://vuldb.com/?id.329941
CVE: CVE-2025-12270
Published: 2025-10-27
Description: A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/assignments/{assignment_id}/tasks/{task_id}/sub_file of the component Student Assignment Submission Handler. This manipulation causes improper control of resource identifiers. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-99, CWE-639
References: https://gist.github.com/KhanMarshaI/f71f86fbd5d8e8363f9113a8c054c28b; https://vuldb.com/?ctiid.329942; https://vuldb.com/?id.329942
CVE: CVE-2025-12271
Published: 2025-10-27
Description: A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/20; https://vuldb.com/?ctiid.329943; https://vuldb.com/?id.329943
CVE: CVE-2025-12272
Published: 2025-10-27
Description: A security flaw has been discovered in Tenda CH22 1.0.0.1. This impacts the function fromAddressNat of the file /goform/addressNat. Performing a manipulation of the argument page results in buffer overflow. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/21; https://vuldb.com/?ctiid.329944; https://vuldb.com/?id.329944
CVE: CVE-2025-41009
Published: 2025-10-27
Description: SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-virtual-campus-platform-diseno-de-recursos-educativos
CVE: CVE-2025-11248
Published: 2025-10-27
Description: ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.
CVSS Score: 3.2 (LOW)
CWE: CWE-532
References: https://www.manageengine.com/products/desktop-central/CVE-2025-11248.html
CVE: CVE-2025-12273
Published: 2025-10-27
Description: A weakness has been identified in Tenda CH22 1.0.0.1. Affected is the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter. Executing a manipulation of the argument page can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/22; https://vuldb.com/?ctiid.329945; https://vuldb.com/?id.329945
CVE: CVE-2025-12274
Published: 2025-10-27
Description: A security vulnerability has been detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/QIU-DIE/CVE/issues/23; https://vuldb.com/?ctiid.329946; https://vuldb.com/?id.329946
CVE: CVE-2025-12276
Published: 2025-10-27
Description: A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://gist.github.com/KhanMarshaI/4a89e9d807094b6dd4a138bc5664e748; https://vuldb.com/?ctiid.329947; https://vuldb.com/?id.329947
CVE: CVE-2025-12277
Published: 2025-10-27
Description: A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/DaoYunXinShang/Reports/blob/main/sql%20injection.doc; https://vuldb.com/?ctiid.329948; https://vuldb.com/?id.329948
CVE: CVE-2025-12279
Published: 2025-10-27
Description: A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/hellonewbie/tutorial/issues/7; https://vuldb.com/?ctiid.329949
CVE: CVE-2025-41067
Published: 2025-10-27
Description: Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that ends up crashing the NRF process and renders the discovery service unavailable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs
CVE: CVE-2025-41068
Published: 2025-10-27
Description: Reachable Assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. This is achieved by sending the creation of an NF with an invalid type via SBI and then requesting its data. The NRF executes a check that crashes the process, leaving the discovery service unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://open5gs.org/open5gs/release/2025/07/19/release-v2.7.6.html; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-newplanes-open5gs
CVE: CVE-2025-41384
Published: 2025-10-27
Description: Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-suitecrm