deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-42923
Published: 2025-09-09
Description: Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended request to the web server. This has low impact on integrity and no impact on confidentiality and availability of the application.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://me.sap.com/notes/3450692; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42925
Published: 2025-09-09
Description: Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time, the attacker could determine a desired identifier which could enable them to access limited system information. This poses a low risk to confidentiality without impacting the integrity or availability of the service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-341
References: https://me.sap.com/notes/3640477; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42926
Published: 2025-09-09
Description: SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://me.sap.com/notes/3619465; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42927
Published: 2025-09-09
Description: SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.
CVSS Score: 3.4 (LOW)
References: https://me.sap.com/notes/3525295; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42929
Published: 2025-09-09
Description: Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1287
References: https://me.sap.com/notes/3633002; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42930
Published: 2025-09-09
Description: SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, consuming excessive resources and resulting in system unavailability. This leads to high impact on the availability of the application, there is no impact on confidentiality or integrity.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-606
References: https://me.sap.com/notes/3614067; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42933
Published: 2025-09-09
Description: When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidentiality, integrity, and availability of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://me.sap.com/notes/3642961; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42938
Published: 2025-09-09
Description: Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When executed, this content allows the attacker to access or modify information within the victim's browser scope, impacting the confidentiality and integrity�while availability remains unaffected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3629325; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-42944
Published: 2025-09-09
Description: Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://me.sap.com/notes/3634501; https://me.sap.com/notes/3660659; https://me.sap.com/notes/3670067
CVE: CVE-2025-42958
Published: 2025-09-09
Description: Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the confidentiality, integrity, and availability of the application.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-250
References: https://me.sap.com/notes/3627373; https://url.sap/sapsecuritypatchday
CVE: CVE-2025-43778
Published: 2025-09-09
Description: A Stored cross-site scripting vulnerability in the Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.11, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.20 allows an remote authenticated attacker to inject JavaScript through the name of a fieldset in Kaleo Forms Admin. The malicious payload is stored and executed without proper sanitization or escaping.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43778
CVE: CVE-2025-10122
Published: 2025-09-09
Description: A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/August829/Yu/blob/main/58ead8e7e08bfb016.md; https://vuldb.com/?ctiid.323092; https://vuldb.com/?id.323092
CVE: CVE-2025-10123
Published: 2025-09-09
Description: A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-77
References: https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md; https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md#poc; https://vuldb.com/?ctiid.323093
CVE: CVE-2025-43777
Published: 2025-09-09
Description: Liferay Portal  7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43777
CVE: CVE-2025-9489
Published: 2025-09-09
Description: The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.2/includes/class-wp-members-shortcodes.php#L69; https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.2/includes/class-wp-members-shortcodes.php#L983; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa2035ef-5251-49cc-a480-b6c167b5ef8c?source=cve
CVE: CVE-2025-8889
Published: 2025-09-09
Description: The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
CVSS Score: 3.8 (LOW)
CWE: CWE-434
References: https://wpscan.com/vulnerability/5d84a577-62aa-4aa2-ac39-b146eae65243/
CVE: CVE-2025-9058
Published: 2025-09-09
Description: The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/user/mikado-themes/portfolio; https://www.wordfence.com/threat-intel/vulnerabilities/id/cba546d8-df3e-4ada-9cf9-663baf175dd0?source=cve
CVE: CVE-2025-9061
Published: 2025-09-09
Description: The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/wilmr-construction-wordpress-theme/23695848; https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=cve
CVE: CVE-2025-9111
Published: 2025-09-09
Description: The AI ChatBot for WordPress  WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5845bcff-beb8-45c8-b182-3dc9e209008b/
CVE: CVE-2025-9539
Published: 2025-09-09
Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/automatorwp/tags/5.3.6/includes/admin/pages/import-automation.php#L386; https://www.wordfence.com/threat-intel/vulnerabilities/id/9efa04ca-68c8-4221-a3d9-cf75010d2266?source=cve
CVE: CVE-2025-9542
Published: 2025-09-09
Description: The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3355175/; https://www.wordfence.com/threat-intel/vulnerabilities/id/62ed278c-f914-4edd-aba1-4aaa099a869f?source=cve
CVE: CVE-2025-10134
Published: 2025-09-09
Description: The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-73
References: https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575; https://www.wordfence.com/threat-intel/vulnerabilities/id/73efd9ad-9515-4ca8-bfb3-1d478f39c2b9?source=cve
CVE: CVE-2025-40594
Published: 2025-09-09
Description: A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: https://cert-portal.siemens.com/productcert/html/ssa-027652.html
CVE: CVE-2025-40757
Published: 2025-09-09
Description: A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All versions). Affected devices connected to the network allow unrestricted access to sensitive files, such as databases. This could allow an attacker to download encrypted .db file containing passwords.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/html/ssa-916339.html
CVE: CVE-2025-40795
Published: 2025-09-09
Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a stack-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial of service condition.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/html/ssa-722410.html
CVE: CVE-2025-40796
Published: 2025-09-09
Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-722410.html
CVE: CVE-2025-40797
Published: 2025-09-09
Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-722410.html
CVE: CVE-2025-40798
Published: 2025-09-09
Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-722410.html
CVE: CVE-2025-40802
Published: 2025-09-09
Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resource exhaustion when subjected to high volumes of query requests.
This could allow an attacker to cause a temporary denial of service, with the system recovering once the activity stops.
CVSS Score: 3.1 (LOW)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/html/ssa-494539.html
CVE: CVE-2025-40803
Published: 2025-09-09
Description: A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the device. This could allow an unauthenticated attacker to access sensitive data, potentially leading to a breach of confidentiality.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/html/ssa-494539.html
CVE: CVE-2025-40804
Published: 2025-09-09
Description: A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/html/ssa-534283.html
CVE: CVE-2025-41701
Published: 2025-09-09
Description: An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://certvde.com/en/advisories/VDE-2025-075
CVE: CVE-2025-59013
Published: 2025-09-09
Description: An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://typo3.org/security/advisory/typo3-core-sa-2025-017
CVE: CVE-2025-59014
Published: 2025-09-09
Description: An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.
CVSS Score: 2.7 (LOW)
CWE: CWE-248
References: https://typo3.org/security/advisory/typo3-core-sa-2025-018
CVE: CVE-2025-59015
Published: 2025-09-09
Description: A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-331
References: https://typo3.org/security/advisory/typo3-core-sa-2025-019
CVE: CVE-2025-59016
Published: 2025-09-09
Description: Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://typo3.org/security/advisory/typo3-core-sa-2025-020
CVE: CVE-2025-59017
Published: 2025-09-09
Description: Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://typo3.org/security/advisory/typo3-core-sa-2025-021
CVE: CVE-2025-59018
Published: 2025-09-09
Description: Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://typo3.org/security/advisory/typo3-core-sa-2025-022
CVE: CVE-2025-59019
Published: 2025-09-09
Description: Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://typo3.org/security/advisory/typo3-core-sa-2025-023
CVE: CVE-2025-10095
Published: 2025-09-09
Description: A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically affecting the handling of certain parameters within the server's database interactions. The vulnerability is isolated to the SMPP server, which operates with its own dedicated database, separate from the main software's database. This isolation limits the scope of the vulnerability to the SMPP server's operations. The vulnerability arises from improper sanitization of user input in the SMPP server's scripts.

This issue has been fixed in version 6.11.
CWE: CWE-89
References: https://cert.pl/en/posts/2025/09/CVE-2025-10095; https://www.smseagle.eu/security-advisory/resolved-sql-injection-in-smpp-component-of-smseagle-software-6-11/
CVE: CVE-2025-24404
Published: 2025-09-09
Description: XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.












The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability.

This issue affects Apache HertzBeat (incubating): before 1.7.0.

Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-91
References: https://lists.apache.org/thread/4ydy3tqbpwmhl79mcj3pxwqz62nggrfd; http://www.openwall.com/lists/oss-security/2025/09/06/4
CVE: CVE-2025-48208
Published: 2025-09-09
Description: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat .












The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution.

This issue affects Apache HertzBeat: through 1.7.2.

Users are recommended to upgrade to version [1.7.3], which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-90
References: https://lists.apache.org/thread/3zrr3oo67pxxx7wgzj80kglltfshngn2; http://www.openwall.com/lists/oss-security/2025/09/06/5