deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49674
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49674
CVE: CVE-2025-49675
Published: 2025-07-08
Description: Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49675
CVE: CVE-2025-49676
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49676
CVE: CVE-2025-49677
Published: 2025-07-08
Description: Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49677
CVE: CVE-2025-49678
Published: 2025-07-08
Description: Null pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49678
CVE: CVE-2025-49679
Published: 2025-07-08
Description: Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-197
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49679
CVE: CVE-2025-49680
Published: 2025-07-08
Description: Improper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49680
CVE: CVE-2025-49681
Published: 2025-07-08
Description: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49681
CVE: CVE-2025-49682
Published: 2025-07-08
Description: Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49682
CVE: CVE-2025-49683
Published: 2025-07-08
Description: Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49683
CVE: CVE-2025-49684
Published: 2025-07-08
Description: Buffer over-read in Storage Port Driver allows an authorized attacker to disclose information locally.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-126
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49684
CVE: CVE-2025-49685
Published: 2025-07-08
Description: Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49685
CVE: CVE-2025-49686
Published: 2025-07-08
Description: Null pointer dereference in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49686
CVE: CVE-2025-49687
Published: 2025-07-08
Description: Out-of-bounds read in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49687
CVE: CVE-2025-49688
Published: 2025-07-08
Description: Double free in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49688
CVE: CVE-2025-49689
Published: 2025-07-08
Description: Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-190, CWE-822
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49689
CVE: CVE-2025-49690
Published: 2025-07-08
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.4 (HIGH)
CWE: CWE-362, CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49690
CVE: CVE-2025-49691
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over an adjacent network.
CVSS Score: 8.0 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49691
CVE: CVE-2025-49693
Published: 2025-07-08
Description: Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49693
CVE: CVE-2025-49694
Published: 2025-07-08
Description: Null pointer dereference in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49694
CVE: CVE-2025-49695
Published: 2025-07-08
Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49695
CVE: CVE-2025-49696
Published: 2025-07-08
Description: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122, CWE-125, CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49696
CVE: CVE-2025-49697
Published: 2025-07-08
Description: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49697
CVE: CVE-2025-49698
Published: 2025-07-08
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49698
CVE: CVE-2025-49699
Published: 2025-07-08
Description: Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49699
CVE: CVE-2025-49700
Published: 2025-07-08
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49700
CVE: CVE-2025-49701
Published: 2025-07-08
Description: Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49701
CVE: CVE-2025-49702
Published: 2025-07-08
Description: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49702
CVE: CVE-2025-49703
Published: 2025-07-08
Description: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49703
CVE: CVE-2025-49704
Published: 2025-07-08
Description: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49704; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
CVE: CVE-2025-49705
Published: 2025-07-08
Description: Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49705
CVE: CVE-2025-49706
Published: 2025-07-08
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49706; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
CVE: CVE-2025-49711
Published: 2025-07-08
Description: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49711
CVE: CVE-2025-49714
Published: 2025-07-08
Description: Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-501
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49714
CVE: CVE-2025-49716
Published: 2025-07-08
Description: Uncontrolled resource consumption in Windows Netlogon allows an unauthorized attacker to deny service over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49716
CVE: CVE-2025-49717
Published: 2025-07-08
Description: Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
CVSS Score: 8.5 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49717
CVE: CVE-2025-49718
Published: 2025-07-08
Description: Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49718
CVE: CVE-2025-49719
Published: 2025-07-08
Description: Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49719
CVE: CVE-2025-49721
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49721
CVE: CVE-2025-49722
Published: 2025-07-08
Description: Uncontrolled resource consumption in Windows Print Spooler Components allows an authorized attacker to deny service over an adjacent network.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-400
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49722
CVE: CVE-2025-49723
Published: 2025-07-08
Description: Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49723
CVE: CVE-2025-49724
Published: 2025-07-08
Description: Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49724
CVE: CVE-2025-49725
Published: 2025-07-08
Description: Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49725
CVE: CVE-2025-49726
Published: 2025-07-08
Description: Use after free in Windows Notification allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49726
CVE: CVE-2025-49727
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49727
CVE: CVE-2025-49729
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49729
CVE: CVE-2025-49730
Published: 2025-07-08
Description: Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-367
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49730
CVE: CVE-2025-49731
Published: 2025-07-08
Description: Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
CVSS Score: 3.1 (LOW)
CWE: CWE-280
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49731
CVE: CVE-2025-49732
Published: 2025-07-08
Description: Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49732
CVE: CVE-2025-49733
Published: 2025-07-08
Description: Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49733
CVE: CVE-2025-49735
Published: 2025-07-08
Description: Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49735
CVE: CVE-2025-49737
Published: 2025-07-08
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49737
CVE: CVE-2025-49738
Published: 2025-07-08
Description: Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49738
CVE: CVE-2025-49739
Published: 2025-07-08
Description: Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49739
CVE: CVE-2025-49740
Published: 2025-07-08
Description: Protection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-693
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49740
CVE: CVE-2025-49742
Published: 2025-07-08
Description: Integer overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49742
CVE: CVE-2025-49744
Published: 2025-07-08
Description: Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-122, CWE-191, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49744
CVE: CVE-2025-49753
Published: 2025-07-08
Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49753
CVE: CVE-2025-49756
Published: 2025-07-08
Description: Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally.
CVSS Score: 3.3 (LOW)
CWE: CWE-327
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49756
CVE: CVE-2025-49760
Published: 2025-07-08
Description: External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.
CVSS Score: 3.5 (LOW)
CWE: CWE-73
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49760
CVE: CVE-2025-53512
Published: 2025-07-08
Description: The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-285
References: https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63
CVE: CVE-2025-53513
Published: 2025-07-08
Description: The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.
CVSS Score: 8.8 (HIGH)
CWE: CWE-24, CWE-22
References: https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8; https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8
CVE: CVE-2025-7186
Published: 2025-07-08
Description: A vulnerability was found in code-projects Chat System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/fetch_chat.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/LamentXU123/cve/blob/main/sql_fetch_chat.md; https://vuldb.com/?ctiid.315125
CVE: CVE-2025-7187
Published: 2025-07-08
Description: A vulnerability classified as critical has been found in code-projects Chat System 1.0. Affected is an unknown function of the file /user/fetch_member.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/LamentXU123/cve/blob/main/sql_fetch_member.md; https://vuldb.com/?ctiid.315126
CVE: CVE-2025-0928
Published: 2025-07-08
Description: In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285, CWE-434
References: https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv
CVE: CVE-2025-30312
Published: 2025-07-08
Description: Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/dimension/apsb25-63.html
CVE: CVE-2025-47135
Published: 2025-07-08
Description: Dimension versions 4.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/dimension/apsb25-63.html
CVE: CVE-2025-4663
Published: 2025-07-08
Description: An Improper Check for Unusual or 
Exceptional Conditions vulnerability in Brocade Fabric OS before 9.2.2.a
 could allow an authenticated, network-based attacker to cause a 
Denial-of-Service (DoS).
The
 vulnerability is encountered when supportsave is invoked remotely, 
using ssh command or SANnav inline ssh, and the corresponding ssh 
session is terminated with Control C (^c ) before supportsave 
completion.
This issue affects Brocade Fabric OS 9.0.0 through 9.2.2
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-754
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35815
CVE: CVE-2025-53479
Published: 2025-07-08
Description: The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper escaping, making it possible to inject JavaScript through the uselang=x-xss language override mechanism.




This issue affects Mediawiki - CheckUser extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I159e14543912cb3bc7f4a00c3090c0285b154786; https://phabricator.wikimedia.org/T394693; https://phabricator.wikimedia.org/T394693
CVE: CVE-2025-7188
Published: 2025-07-08
Description: A vulnerability classified as critical was found in code-projects Chat System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/addmember.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/LamentXU123/cve/blob/main/sql_addmember.md; https://vuldb.com/?ctiid.315127
CVE: CVE-2025-7189
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, has been found in code-projects Chat System 1.0. Affected by this issue is some unknown functionality of the file /user/send_message.php. The manipulation of the argument msg leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/LamentXU123/cve/blob/main/sql_send_message.md; https://vuldb.com/?ctiid.315128