deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6470
Published: 2025-06-22
Description: A vulnerability classified as critical has been found in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /bidlog.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/W2-l0mechan1c/cve/issues/1; https://vuldb.com/?ctiid.313578
CVE: CVE-2025-6471
Published: 2025-06-22
Description: A vulnerability classified as critical was found in code-projects Online Bidding System 1.0. Affected by this vulnerability is an unknown functionality of the file /administrator. The manipulation of the argument aduser leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ganzhi-qcy/cve/issues/11; https://vuldb.com/?ctiid.313579
CVE: CVE-2025-6472
Published: 2025-06-22
Description: A vulnerability, which was classified as critical, has been found in code-projects Online Bidding System 1.0. Affected by this issue is some unknown functionality of the file /showprod.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/ganzhi-qcy/cve/issues/10; https://vuldb.com/?ctiid.313580
CVE: CVE-2025-6473
Published: 2025-06-22
Description: A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /fees.php. The manipulation of the argument transcation_remark leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/17; https://vuldb.com/?ctiid.313581
CVE: CVE-2025-6474
Published: 2025-06-22
Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /changeUsername.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/[PII_REDACTED]/cve/issues/1; https://vuldb.com/?ctiid.313582
CVE: CVE-2025-6475
Published: 2025-06-22
Description: A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /script/admin/manage_students of the component Manage Students Module. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README8.md; https://vuldb.com/?ctiid.313583; https://vuldb.com/?id.313583
CVE: CVE-2025-6476
Published: 2025-06-22
Description: A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/alc9700jmo/CVE/issues/15; https://vuldb.com/?ctiid.313584; https://vuldb.com/?id.313584
CVE: CVE-2025-6477
Published: 2025-06-22
Description: A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /script/admin/system of the component System Settings Page. The manipulation of the argument School Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README9.md; https://vuldb.com/?ctiid.313585; https://vuldb.com/?id.313585
CVE: CVE-2025-6478
Published: 2025-06-22
Description: A vulnerability was found in CodeAstro Expense Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://codeastro.com/; https://vuldb.com/?ctiid.313586; https://vuldb.com/?id.313586
CVE: CVE-2025-6479
Published: 2025-06-22
Description: A vulnerability classified as critical has been found in code-projects Simple Pizza Ordering System 1.0. This affects an unknown part of the file /salesreport.php. The manipulation of the argument dayfrom leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/rom4j/cve/issues/1; https://vuldb.com/?ctiid.313587
CVE: CVE-2025-6480
Published: 2025-06-22
Description: A vulnerability classified as critical was found in code-projects Simple Pizza Ordering System 1.0. This vulnerability affects unknown code of the file /addcatexec.php. The manipulation of the argument textfield leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/rom4j/cve/issues/2; https://vuldb.com/?ctiid.313588
CVE: CVE-2025-6481
Published: 2025-06-22
Description: A vulnerability, which was classified as critical, has been found in code-projects Simple Pizza Ordering System 1.0. This issue affects some unknown processing of the file /update.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/rom4j/cve/issues/3; https://vuldb.com/?ctiid.313589
CVE: CVE-2025-6482
Published: 2025-06-22
Description: A vulnerability, which was classified as critical, was found in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /edituser-exec.php. The manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/rom4j/cve/issues/4; https://vuldb.com/?ctiid.313590
CVE: CVE-2025-6483
Published: 2025-06-22
Description: A vulnerability has been found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edituser.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/rom4j/cve/issues/5; https://vuldb.com/?ctiid.313591
CVE: CVE-2025-6484
Published: 2025-06-22
Description: A vulnerability was found in code-projects Online Shopping Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument cat_id/brand_id/keyword/proId/pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/ez-lbz/poc/issues/5; https://github.com/ez-lbz/poc/issues/6
CVE: CVE-2025-6485
Published: 2025-06-22
Description: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20[PII_REDACTED]. It has been classified as critical. This affects the function formWlSiteSurvey of the file /boafrm/formWlSiteSurvey. The manipulation of the argument wlanif leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_34/34.md; https://vuldb.com/?ctiid.313593; https://vuldb.com/?id.313593
CVE: CVE-2025-6486
Published: 2025-06-22
Description: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20[PII_REDACTED]. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_35/35.md; https://vuldb.com/?ctiid.313594; https://vuldb.com/?id.313594
CVE: CVE-2025-6487
Published: 2025-06-22
Description: A vulnerability was found in TOTOLINK A3002R 1.1.1-B20[PII_REDACTED]. It has been rated as critical. This issue affects the function formRoute of the file /boafrm/formRoute. The manipulation of the argument subnet leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/wudipjq/my_vuln/blob/main/totolink3/vuln_36/36.md; https://vuldb.com/?ctiid.313595; https://vuldb.com/?id.313595
CVE: CVE-2025-6489
Published: 2025-06-22
Description: A vulnerability has been found in itsourcecode Agri-Trading Online Shopping System 1.0 and classified as critical. This vulnerability affects unknown code of the file /transactionsave.php. The manipulation of the argument del leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ltranquility/CVE/issues/13; https://itsourcecode.com/; https://vuldb.com/?ctiid.313600
CVE: CVE-2025-6490
Published: 2025-06-22
Description: A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-122
References: https://github.com/sparklemotion/nokogiri/commit/ada4708e5a67114402cd3feb70a4e1d1d7cf773a; https://github.com/sparklemotion/nokogiri/issues/3500; https://github.com/sparklemotion/nokogiri/pull/3524
CVE: CVE-2025-6492
Published: 2025-06-22
Description: A vulnerability has been found in MarkText up to 0.17.1 and classified as problematic. Affected by this vulnerability is the function getRecommendTitleFromMarkdownString of the file marktext/src/main/utils/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/marktext/marktext/pull/3952; https://github.com/mmmsssttt404/marktext/blob/c59b3ad423dfa082869933baf9f5d5c69bdcc560/test/unit/specs/match-electron-accelerator.spec.js#L155-L164; https://vuldb.com/?ctiid.313609
CVE: CVE-2025-6493
Published: 2025-06-22
Description: A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400, CWE-1333
References: https://github.com/codemirror/codemirror5/issues/7128; https://vuldb.com/?ctiid.313610; https://vuldb.com/?id.313610
CVE: CVE-2025-6494
Published: 2025-06-22
Description: A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-122
References: https://github.com/sparklemotion/nokogiri/commit/ada4708e5a67114402cd3feb70a4e1d1d7cf773a; https://github.com/sparklemotion/nokogiri/issues/3508; https://github.com/sparklemotion/nokogiri/pull/3524
CVE: CVE-2025-6496
Published: 2025-06-23
Description: A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://github.com/htacg/tidy-html5/issues/1141; https://github.com/user-attachments/files/19652942/tidy-html5_crash.txt; https://vuldb.com/?ctiid.313612
CVE: CVE-2025-52926
Published: 2025-06-23
Description: In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.
CVSS Score: 2.7 (LOW)
CWE: CWE-223
References: https://github.com/spytrap-org/spytrap-adb/commit/277cec542466b75cf5a8c532581243fd4b7b9713; https://github.com/spytrap-org/spytrap-adb/pull/65; https://github.com/spytrap-org/spytrap-adb/releases/tag/v0.3.5
CVE: CVE-2025-6497
Published: 2025-06-23
Description: A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-617
References: https://github.com/htacg/tidy-html5/issues/1142; https://github.com/user-attachments/files/19825297/tidy-html5_crash_2.txt; https://vuldb.com/?ctiid.313613
CVE: CVE-2025-6498
Published: 2025-06-23
Description: A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-401, CWE-404, CWE-401
References: https://github.com/htacg/tidy-html5/issues/1152; https://github.com/user-attachments/files/20438303/tidy-html5_crash_3.txt; https://vuldb.com/?ctiid.313614
CVE: CVE-2025-6499
Published: 2025-06-23
Description: A vulnerability classified as problematic was found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function ucl_parse_multiline_string of the file src/ucl_parser.c. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/user-attachments/files/19825399/libucl_crash.txt; https://github.com/vstakhov/libucl/issues/319; https://vuldb.com/?ctiid.313615
CVE: CVE-2025-6500
Published: 2025-06-23
Description: A vulnerability, which was classified as critical, has been found in code-projects Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /php_action/editCategories.php. The manipulation of the argument editCategoriesName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/mex135605/cve/issues/3; https://vuldb.com/?ctiid.313616
CVE: CVE-2025-6501
Published: 2025-06-23
Description: A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/mex135605/cve/issues/2; https://vuldb.com/?ctiid.313617
CVE: CVE-2025-6502
Published: 2025-06-23
Description: A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/mex135605/cve/issues/1; https://vuldb.com/?ctiid.313618
CVE: CVE-2025-6503
Published: 2025-06-23
Description: A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/fetchSelectedCategories.php. The manipulation of the argument categoriesId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/YunQipao/cve/issues/1; https://vuldb.com/?ctiid.313619
CVE: CVE-2024-3511
Published: 2025-06-23
Description: An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/
CVE: CVE-2024-45347
Published: 2025-06-23
Description: An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=548
CVE: CVE-2025-27387
Published: 2025-06-23
Description: OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]974403072https://
CVE: CVE-2025-52935
Published: 2025-06-23
Description: Integer Overflow or Wraparound vulnerability in dragonflydb dragonfly (src/redis/lua/struct modules). This vulnerability is associated with program files lua_struct.C.

This issue affects dragonfly: 1.30.1, 1.30.0, 1.28.18.
CWE: CWE-190
References: https://github.com/dragonflydb/dragonfly/commit/473e002c848eb312f23d84114eb4951a7c4af5a1; https://github.com/dragonflydb/dragonfly/pull/4996
CVE: CVE-2025-52936
Published: 2025-06-23
Description: Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2.
CWE: CWE-59
References: https://github.com/yrutschle/sslh/pull/494; https://lists.debian.org/debian-lts-announce/2025/07/msg00001.html
CVE: CVE-2025-52937
Published: 2025-06-23
Description: Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C.

This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specifically requests to not use the system zlib (WITH_SYSTEM_ZLIB=FALSE).
CWE: CWE-494
References: https://github.com/PointCloudLibrary/pcl/commit/2f9dc390c6769fbd821fafa0e16f4707ed7c5d79; https://github.com/PointCloudLibrary/pcl/pull/6275
CVE: CVE-2025-52938
Published: 2025-06-23
Description: Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C.


This issue affects NotepadNext: through v0.11.

The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
CWE: CWE-125
References: https://github.com/dail8859/NotepadNext/commit/66b8a97d9fdfd[PII_REDACTED]716f39c18d84e004f; https://github.com/dail8859/NotepadNext/pull/756
CVE: CVE-2025-52939
Published: 2025-06-23
Description: Out-of-bounds Write vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files ldebug.C, lvm.C.

This issue affects NotepadNext: through v0.11.
CWE: CWE-787
References: https://github.com/dail8859/NotepadNext/commit/3e928d91b8fc8bb5c77801ee8652f41e98d12571; https://github.com/dail8859/NotepadNext/pull/757/files
CVE: CVE-2025-23049
Published: 2025-06-23
Description: Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.
CWE: CWE-78
References: https://outurnate.com/remote-code-execution-and-authentication-bypass-in-materialise-orthoview-cve-2025-23049; https://www.materialise.com/en/healthcare/orthoview; https://www.materialise.com/en/healthcare/orthoview/security-vulnerability