deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4869
Published: 2025-05-18
Description: A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. This affects an unknown part of the file /admin/member_update.php. The manipulation of the argument menu leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wuquwuquwuqu/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.309411
CVE: CVE-2025-4870
Published: 2025-05-18
Description: A vulnerability classified as critical was found in itsourcecode Restaurant Management System 1.0. This vulnerability affects unknown code of the file /admin/menu_save.php. The manipulation of the argument menu leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wuquwuquwuqu/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.309412
CVE: CVE-2025-4871
Published: 2025-05-18
Description: A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component REST Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Blu3B3ard/PoC-Pacman-FTP-Server-2.0.7/blob/main/exploit.txt; https://vuldb.com/?ctiid.309413; https://vuldb.com/?id.309413
CVE: CVE-2025-4872
Published: 2025-05-18
Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component CCC Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/Blu3B3ard/PoC-FreeFloat-FTP-Server-1.0/blob/main/exploit.txt; https://vuldb.com/?ctiid.309414; https://vuldb.com/?id.309414
CVE: CVE-2025-4873
Published: 2025-05-18
Description: A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Schatten-42/MyCVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.309415
CVE: CVE-2025-4874
Published: 2025-05-18
Description: A vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/contactus.php. The manipulation of the argument pagetitle leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Schatten-42/MyCVE/issues/7; https://phpgurukul.com/; https://vuldb.com/?ctiid.309416
CVE: CVE-2025-4875
Published: 2025-05-18
Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/arpcyber040/CVE/issues/2; https://vuldb.com/?ctiid.309418; https://vuldb.com/?id.309418
CVE: CVE-2025-4880
Published: 2025-05-18
Description: A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Schatten-42/MyCVE/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.309433
CVE: CVE-2025-4881
Published: 2025-05-18
Description: A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/user_save.php. The manipulation of the argument username/name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Cherish-Ink/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.309434
CVE: CVE-2025-4882
Published: 2025-05-18
Description: A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team_update.php. The manipulation of the argument team leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Cherish-Ink/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.309435
CVE: CVE-2025-48219
Published: 2025-05-18
Description: O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call and then reading the utran-cell-id-3gpp field of a Cellular-Network-Info SIP header, aka an ECI (E-UTRAN Cell Identity) leak. The Cell ID might be usable to identify a cell location via crowdsourced data, and might correspond to a small physical area (e.g., if the called party is in a city centre). Removal of the Cellular-Network-Info header is mentioned in section 4.4.19 of ETSI TS 124 229.
CVSS Score: 3.5 (LOW)
CWE: CWE-201
References: https://mastdatabase.co.uk/blog/2025/05/o2-expose-customer-location-call-4g/; https://news.ycombinator.com/item?id=44014046; https://www.etsi.org/deliver/etsi_ts/124200_124299/124229/15.10.00_60/ts_124229v151000p.pdf
CVE: CVE-2025-4883
Published: 2025-05-18
Description: A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been declared as critical. This vulnerability affects the function ctxz_asp of the file /ctxz.asp of the component Connection Limit Page. The manipulation of the argument def/defTcp/defUdp/defIcmp/defOther leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/Yhuanhuan01/DI-8100_Vulnerability_Report/blob/main/DI-8100-Vulnerability_Report_ctxz.md; https://vuldb.com/?ctiid.309436; https://vuldb.com/?id.309436
CVE: CVE-2025-4884
Published: 2025-05-18
Description: A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/assign_save.php. The manipulation of the argument team leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/arpcyber555/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.309437
CVE: CVE-2025-4885
Published: 2025-05-18
Description: A vulnerability classified as critical has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument serial leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/arpcyber555/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.309438
CVE: CVE-2025-4886
Published: 2025-05-18
Description: A vulnerability classified as critical was found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/product_update.php. The manipulation of the argument serial leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/arpcyber555/CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.309439
CVE: CVE-2025-4887
Published: 2025-05-18
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Online Student Clearance System 1.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/ClausiusFan/CVE/blob/main/CVE_2.md; https://vuldb.com/?ctiid.309440; https://vuldb.com/?id.309440
CVE: CVE-2025-4888
Published: 2025-05-18
Description: A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. This affects the function medicineType::take_order of the component Add Order Details. The manipulation leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Pharmacy_Management_System.md; https://vuldb.com/?ctiid.309441
CVE: CVE-2025-4889
Published: 2025-05-18
Description: A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. This vulnerability affects the function AddUser of the component User Registration. The manipulation of the argument username/password leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Tourism-Management-System.md; https://vuldb.com/?ctiid.309442
CVE: CVE-2025-4890
Published: 2025-05-18
Description: A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. This issue affects the function LoginUser of the component Login User. The manipulation of the argument username/password leads to stack-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Tourism-Management-System2.md; https://vuldb.com/?ctiid.309443
CVE: CVE-2025-4891
Published: 2025-05-18
Description: A vulnerability was found in code-projects Police Station Management System 1.0. It has been classified as critical. Affected is the function criminal::display of the file source.cpp of the component Display Record. The manipulation of the argument N leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-120, CWE-120
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Police-StationManagementSystem.md; https://vuldb.com/?ctiid.309444
CVE: CVE-2025-4892
Published: 2025-05-18
Description: A vulnerability was found in code-projects Police Station Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function criminal::remove of the file source.cpp of the component Delete Record. The manipulation of the argument No leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-121
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Police-StationManagementSystem2.md; https://vuldb.com/?ctiid.309445
CVE: CVE-2025-4893
Published: 2025-05-18
Description: A vulnerability classified as critical has been found in jammy928 CoinExchange_CryptoExchange_Java up to 8adf508b996020d3efbeeb2473d7235bd01436fa. This affects the function uploadLocalImage of the file /CoinExchange_CryptoExchange_Java-master/00_framework/core/src/main/java/com/bizzan/bitrade/util/UploadFileUtil.java of the component File Upload Endpoint. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250515-01.md; https://vuldb.com/?ctiid.309447; https://vuldb.com/?id.309447
CVE: CVE-2025-4894
Published: 2025-05-18
Description: A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulnerability affects the function gen_rsa_keys of the file common/crypto.py. The manipulation leads to inadequate encryption strength. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-326, CWE-326
References: https://vuldb.com/?ctiid.309448; https://vuldb.com/?id.309448; https://vuldb.com/?submit.578019
CVE: CVE-2025-4895
Published: 2025-05-18
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Doctors Appointment System 1.0. This issue affects some unknown processing of the file /admin/delete-session.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Xiaoyi-ing/CVE/issues/11; https://vuldb.com/?ctiid.309449; https://vuldb.com/?id.309449
CVE: CVE-2025-4896
Published: 2025-05-18
Description: A vulnerability was found in Tenda AC10 16.03.10.13 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/UserCongratulationsExec. The manipulation of the argument getuid leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/byxs0x0/cve2/blob/main/Tenda%20AC10.md; https://vuldb.com/?ctiid.309452; https://vuldb.com/?id.309452
CVE: CVE-2025-4897
Published: 2025-05-18
Description: A vulnerability was found in Tenda A15 15.13.07.09/15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/multimodalAdd of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/byxs0x0/cve2/blob/main/tenda%20AC15.md; https://vuldb.com/?ctiid.309453; https://vuldb.com/?id.309453
CVE: CVE-2025-4898
Published: 2025-05-18
Description: A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects the function unlink of the file update_system.php of the component Logo File Handler. The manipulation of the argument old_logo leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://magnificent-dill-351.notion.site/Arbitrary-File-Delete-in-SRMS-1-0-1f4c693918ed80de80b0e7925ddbdadc; https://vuldb.com/?ctiid.309454; https://vuldb.com/?id.309454
CVE: CVE-2025-4899
Published: 2025-05-18
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /pages/transaction_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/RoyalZJT/CVE/issues/1; https://vuldb.com/?ctiid.309455; https://vuldb.com/?id.309455
CVE: CVE-2025-4900
Published: 2025-05-18
Description: A vulnerability classified as critical has been found in Campcodes Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/payment.php. The manipulation of the argument cid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/RoyalZJT/CVE/issues/2; https://vuldb.com/?ctiid.309456; https://vuldb.com/?id.309456
CVE: CVE-2025-4901
Published: 2025-05-19
Description: A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this vulnerability is the function sub_41E304 of the file /H5/state_view.data of the component HTTP Endpoint. The manipulation leads to information disclosure. The attack can only be done within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/state_view.md; https://vuldb.com/?ctiid.309457; https://vuldb.com/?id.309457
CVE: CVE-2025-4902
Published: 2025-05-19
Description: A vulnerability, which was classified as problematic, has been found in D-Link DI-7003GV2 24.04.18D1 R(68125). Affected by this issue is the function sub_48F4F0 of the file /H5/versionupdate.data. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/versionupdate.md; https://vuldb.com/?ctiid.309458; https://vuldb.com/?id.309458
CVE: CVE-2025-4903
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, was found in D-Link DI-7003GV2 24.04.18D1 R(68125). This affects the function sub_41F4F0 of the file /H5/webgl.asp?tggl_port=0&remote_management=0&http_[CREDENTIAL_REDACTED]_service=admin-restart. The manipulation leads to unverified password change. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-620, CWE-640, CWE-620
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/webgl_asp.md; https://vuldb.com/?ctiid.309459; https://vuldb.com/?id.309459
CVE: CVE-2025-4904
Published: 2025-05-19
Description: A vulnerability has been found in D-Link DI-7003GV2 24.04.18D1 R(68125) and classified as problematic. This vulnerability affects the function sub_41F0FC of the file /H5/webgl.data. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/at0de/my_vulns/blob/main/Dlink/Di-7003GV2/webgl_data.md; https://vuldb.com/?ctiid.309460; https://vuldb.com/?id.309460
CVE: CVE-2025-23122
Published: 2025-05-19
Description: Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
CVE: CVE-2025-23123
Published: 2025-05-19
Description: A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a heap buffer overflow vulnerability in the UniFi Protect Cameras (Version 4.75.43 and earlier) firmware.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-122
References: https://community.ui.com/releases/Security-Advisory-Bulletin-047-047/cef86c37-7421-44fd-b251-84e76475a5bc
CVE: CVE-2025-23164
Published: 2025-05-19
Description: A misconfigured access token mechanism in the Unifi Protect Application (Version 5.3.41 and earlier) could permit the recipient of a "Share Livestream" link to maintain access to the corresponding livestream subsequent to such link becoming disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://community.ui.com/releases/Security-Advisory-Bulletin-047-047/cef86c37-7421-44fd-b251-84e76475a5bc
CVE: CVE-2025-23165
Published: 2025-05-19
Description: In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:
* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.
CVSS Score: 3.7 (LOW)
CWE: CWE-401
References: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases
CVE: CVE-2025-23166
Published: 2025-05-19
Description: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248
References: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases
CVE: CVE-2025-23167
Published: 2025-05-19
Description: A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.
This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.

Impact:
* This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases
CVE: CVE-2025-4905
Published: 2025-05-19
Description: A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function load_qc_pickl of the file basestation3/QC.py. The manipulation of the argument qc_file leads to deserialization. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The code maintainer tagged the issue as closed. But there is no new commit nor release in the GitHub repository available so far.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/iop-apl-uw/basestation3/issues/6; https://github.com/iop-apl-uw/basestation3/issues/6#event[PII_REDACTED]7; https://github.com/iop-apl-uw/basestation3/issues/6#issue[PII_REDACTED]