deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2158
Published: 2025-05-10
Description: The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5 via the Post custom fields. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register_argc_argv also enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/wp-review/tags/5.3.5/includes/functions.php; https://plugins.trac.wordpress.org/browser/wp-review/tags/5.3.5/includes/shortcodes.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a058e6bf-109f-4985-8aad-08858553c4c3?source=cve
CVE: CVE-2025-4498
Published: 2025-05-10
Description: A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Affected is the function a::install of the component Install Bus. The manipulation of the argument bus leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Bus%20Management%20System.md; https://vuldb.com/?ctiid.308214
CVE: CVE-2025-3876
Published: 2025-05-10
Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L145; https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/handler/forms/class-wplogin.php#L447; https://plugins.trac.wordpress.org/changeset/3290478/
CVE: CVE-2025-3878
Published: 2025-05-10
Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sms-alert/tags/3.8.0/helper/shortcode.php#L103; https://plugins.trac.wordpress.org/changeset/3290478/; https://wordpress.org/plugins/sms-alert/#developers
CVE: CVE-2025-4499
Published: 2025-05-10
Description: A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Affected by this vulnerability is the function Add of the component Add Information. The manipulation of the argument x[i].name/x[i].disease leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/Hospital%20Management%20System.md; https://vuldb.com/?ctiid.308215
CVE: CVE-2025-4500
Published: 2025-05-10
Description: A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0. Affected by this issue is the function Edit of the component Edit Room. The manipulation of the argument roomnumber leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/HOTEL_MANAGEMENT_SYSTEM.md; https://vuldb.com/?ctiid.308216
CVE: CVE-2025-4501
Published: 2025-05-10
Description: A vulnerability, which was classified as critical, was found in code-projects Album Management System 1.0. This affects the function searchalbum of the component Search Albums. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/zzzxc643/cve/blob/main/ALBUM_MANAGEMENT_SYSTEM.md; https://vuldb.com/?ctiid.308217
CVE: CVE-2025-1752
Published: 2025-05-10
Description: A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_depth parameter in the get_article_urls function. This allows an attacker to exhaust Python's recursion limit through repeated function calls, leading to resource consumption and ultimately crashing the Python process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/run-llama/llama_index/commit/3c65db2947271de3bd1927dc66a044da385de4da; https://huntr.com/bounties/cd7b9082-7d75-42e4-84f5-dbee23cbc467; https://huntr.com/bounties/cd7b9082-7d75-42e4-84f5-dbee23cbc467
CVE: CVE-2025-4502
Published: 2025-05-10
Description: A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pages/creditor_add.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/0x0a1lphg/CVE/issues/1; https://vuldb.com/?ctiid.308218; https://vuldb.com/?id.308218
CVE: CVE-2025-4503
Published: 2025-05-10
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/customer_update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/0x0a1lphg/CVE/issues/2; https://vuldb.com/?ctiid.308219; https://vuldb.com/?id.308219
CVE: CVE-2023-53145
Published: 2025-05-10
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

In btsdio_probe, the data->work is bound with btsdio_work. It will be
started in btsdio_send_frame.

If the btsdio_remove runs with a unfinished work, there may be a race
condition that hdev is freed but used in btsdio_work. Fix it by
canceling the work before do cleanup in btsdio_remove.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/179c65828593aff1f444e15debd40a477cb23cf4; https://git.kernel.org/stable/c/3efcbf25e5ab4d4ad1b7e6ba0869ff85540e3f6e; https://git.kernel.org/stable/c/6c[PII_REDACTED]a0d6eab19b20a59423e118985a6b
CVE: CVE-2025-4504
Published: 2025-05-10
Description: A vulnerability was found in SourceCodester Online College Library System 1.0. It has been classified as critical. Affected is an unknown function of the file /index.php. The manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/krookies/cve/issues/1; https://vuldb.com/?ctiid.308220; https://vuldb.com/?id.308220
CVE: CVE-2025-4505
Published: 2025-05-10
Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /category.php. The manipulation of the argument categoryname leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/y77-88/myCVE/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.308221
CVE: CVE-2025-4506
Published: 2025-05-10
Description: A vulnerability was found in Campcodes Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /routers/menu-router.php. The manipulation of the argument 1_price leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/TEhS411/cve/issues/5; https://vuldb.com/?ctiid.308222; https://vuldb.com/?id.308222
CVE: CVE-2025-4507
Published: 2025-05-10
Description: A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /routers/add-item.php. The manipulation of the argument price leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/TEhS411/cve/issues/6; https://vuldb.com/?ctiid.308223; https://vuldb.com/?id.308223
CVE: CVE-2025-4508
Published: 2025-05-10
Description: A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. This vulnerability affects unknown code of the file /my-profile.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/y77-88/myCVE/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.308224
CVE: CVE-2025-4509
Published: 2025-05-10
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul e-Diary Management System 1.0. This issue affects some unknown processing of the file /manage-notes.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/y77-88/myCVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.308225
CVE: CVE-2025-4510
Published: 2025-05-10
Description: A vulnerability was found in Changjietong UFIDA CRM 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /optnty/optntyday.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Michael19820315/CVE/issues/1; https://vuldb.com/?ctiid.308230; https://vuldb.com/?id.308230
CVE: CVE-2025-4511
Published: 2025-05-10
Description: A vulnerability was found in vector4wang spring-boot-quick up to 20250422. It has been rated as critical. This issue affects the function ResponseEntity of the file /spring-boot-quick-master/quick-img2txt/src/main/java/com/quick/controller/Img2TxtController.java of the component quick-img2txt. The manipulation leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250422-01.md; https://vuldb.com/?ctiid.308231; https://vuldb.com/?id.308231
CVE: CVE-2025-4512
Published: 2025-05-10
Description: A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/iodasweb/app.jsp. The manipulation of the argument action leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/lam-sec/iodasweb-poc; https://vuldb.com/?ctiid.308232; https://vuldb.com/?id.308232
CVE: CVE-2025-4513
Published: 2025-05-10
Description: A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown functionality of the file /auth/userkey/logout.php of the component Logout. The manipulation of the argument return leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/Cyber-Wo0dy/report/blob/main/moodle/key_user_authentication/v[PII_REDACTED]/key_user_authentication_open_redirection; https://vuldb.com/?ctiid.308233; https://vuldb.com/?id.308233
CVE: CVE-2025-4514
Published: 2025-05-10
Description: A vulnerability, which was classified as critical, has been found in Zhengzhou Jiuhua Electronic Technology mayicms up to 5.8E. Affected by this issue is some unknown functionality of the file /javascript.php. The manipulation of the argument Value leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Axianke/cve/issues/1; https://vuldb.com/?ctiid.308234; https://vuldb.com/?id.308234
CVE: CVE-2025-4515
Published: 2025-05-10
Description: A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2. This affects an unknown part of the file settings.yaml. The manipulation of the argument allow_origins leads to permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346, CWE-942, CWE-346, CWE-697
References: https://gist.github.com/superboy-zjc/2a727cb0c1d468f21a91e0416d006ffe; https://vuldb.com/?ctiid.308235; https://vuldb.com/?id.308235
CVE: CVE-2025-47814
Published: 2025-05-10
Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in zip-reader.c.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://savannah.gnu.org/bugs/?67074; https://savannah.gnu.org/bugs/?67074
CVE: CVE-2025-47815
Published: 2025-05-10
Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in zip-reader.c.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://savannah.gnu.org/bugs/?67075; https://savannah.gnu.org/bugs/?67075
CVE: CVE-2025-47816
Published: 2025-05-10
Description: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at the end of a document.
CVSS Score: 2.9 (LOW)
CWE: CWE-125
References: https://savannah.gnu.org/bugs/?67073; https://savannah.gnu.org/bugs/?67073
CVE: CVE-2025-47817
Published: 2025-05-10
Description: In BlueWave Checkmate through 2.0.2 before b387eba, a profile edit request can include a role parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-472
References: https://github.com/bluewave-labs/Checkmate/commit/b387ebaae96fc3a23b090a8baea7a9ebaa70f052; https://github.com/bluewave-labs/Checkmate/pull/2161; https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-rq7r-p9cq-5q4f
CVE: CVE-2025-4525
Published: 2025-05-10
Description: A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427
References: https://gist.github.com/shellkraft/ac4be6a3953e2889a7bf54aea2db88c2; https://vuldb.com/?ctiid.308270; https://vuldb.com/?id.308270
CVE: CVE-2025-4526
Published: 2025-05-11
Description: A vulnerability, which was classified as problematic, was found in Dígitro NGC Explorer 3.44.15. This affects an unknown part of the component Configuration Page. The manipulation leads to missing password field masking. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-549
References: https://vuldb.com/?ctiid.308271; https://vuldb.com/?id.308271; https://vuldb.com/?submit.565307
CVE: CVE-2025-47828
Published: 2025-05-11
Description: Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3; https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894
CVE: CVE-2025-4527
Published: 2025-05-11
Description: A vulnerability has been found in Dígitro NGC Explorer 3.44.15 and classified as problematic. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to client-side enforcement of server-side security. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-602
References: https://vuldb.com/?ctiid.308272; https://vuldb.com/?id.308272; https://vuldb.com/?submit.565308
CVE: CVE-2025-4528
Published: 2025-05-11
Description: A vulnerability was found in Dígitro NGC Explorer up to 3.44.15 and classified as problematic. This issue affects some unknown processing. The manipulation leads to session expiration. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-613
References: https://vuldb.com/?ctiid.308273; https://vuldb.com/?id.308273; https://vuldb.com/?submit.565309
CVE: CVE-2025-4529
Published: 2025-05-11
Description: A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the file seeyon\opt\Seeyon\A8\ApacheJetspeed\webapps\seeyon\WEB-INF\lib\seeyon-apps-m3.jar!\com\seeyon\apps\m3\core\controller\M3CoreController.class of the component ZIP File Handler. The manipulation of the argument Name leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.308274; https://vuldb.com/?id.308274; https://vuldb.com/?submit.565379
CVE: CVE-2025-4530
Published: 2025-05-11
Description: A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm 1.0. It has been declared as problematic. Affected by this vulnerability is the function handleFileDownload of the file FileController.java of the component File Handler. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Hao-Ni/CVE/issues/2; https://vuldb.com/?ctiid.308275; https://vuldb.com/?id.308275
CVE: CVE-2025-4531
Published: 2025-05-11
Description: A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData of the file ROOT\WEB-INF\classes\com\ours\www\ehr\salary\service\data\EhrSalaryPayrollServiceImpl.class of the component Beetl Template Handler. The manipulation of the argument payrollId leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-94, CWE-94
References: https://vuldb.com/?ctiid.308276; https://vuldb.com/?id.308276; https://vuldb.com/?submit.566097
CVE: CVE-2025-4532
Published: 2025-05-11
Description: A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427
References: https://vuldb.com/?ctiid.308277; https://vuldb.com/?id.308277; https://vuldb.com/?submit.566141
CVE: CVE-2025-4533
Published: 2025-05-11
Description: A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/knowledge/doc/import/zip of the component Document Library Upload. The manipulation of the argument File leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.7 (LOW)
CWE: CWE-400, CWE-404
References: https://github.com/jeecgboot/JeecgBoot/issues/8199; https://github.com/jeecgboot/JeecgBoot/issues/8199#issue[PII_REDACTED]; https://github.com/jeecgboot/JeecgBoot/issues/8199#issuecomment[PII_REDACTED]
CVE: CVE-2025-4534
Published: 2025-05-11
Description: A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-521
References: https://vuldb.com/?ctiid.308279; https://vuldb.com/?id.308279; https://vuldb.com/?submit.566423