deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7460
Published: 2025-07-11
Description: A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/ElvisBlue/Public/blob/main/Vuln/1.md; https://github.com/ElvisBlue/Public/blob/main/Vuln/1.md#poc; https://vuldb.com/?ctiid.316111
CVE: CVE-2025-5199
Published: 2025-07-12
Description: In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276, CWE-863
References: https://github.com/canonical/multipass/pull/4115; https://github.com/canonical/multipass/security/advisories/GHSA-2j82-p5cq-62p3; https://github.com/canonical/multipass/security/advisories/GHSA-2j82-p5cq-62p3
CVE: CVE-2023-38036
Published: 2025-07-12
Description: A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://forums.ivanti.com/s/article/Security-Advisory-Avalanche-CVE-2023-38036
CVE: CVE-2023-39338
Published: 2025-07-12
Description: Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: https://forums.ivanti.com/s/article/CVE-2023-39338
CVE: CVE-2023-39339
Published: 2025-07-12
Description: A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://forums.ivanti.com/s/article/Security-patch-release-Ivanti-Policy-Secure-22-6R1
CVE: CVE-2024-38648
Published: 2025-07-12
Description: A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-798
References: https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-38648
CVE: CVE-2025-24294
Published: 2025-07-12
Description: The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/; https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/
CVE: CVE-2025-6057
Published: 2025-07-12
Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php#L85; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3326098%40wpbookit&new=3326098%40wpbookit&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wpbookit/
CVE: CVE-2025-6058
Published: 2025-07-12
Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-booking-type-controller.php#L455; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3314288%40wpbookit&new=3314288%40wpbookit&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d779ad1-fdbe-444c-85c5-99146a1a03d8?source=cve
CVE: CVE-2025-7461
Published: 2025-07-12
Description: A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument proId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/bx33661/newvul/issues/1; https://vuldb.com/?ctiid.316112
CVE: CVE-2025-1313
Published: 2025-07-12
Description: The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241; https://www.wordfence.com/threat-intel/vulnerabilities/id/507c2abd-47d3-4a28-a9b7-a1ad9b026e7d?source=cve
CVE: CVE-2025-7462
Published: 2025-07-12
Description: A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404, CWE-476
References: https://artifex.com/; https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=619a106ba4c4; https://vuldb.com/?ctiid.316113
CVE: CVE-2025-7463
Published: 2025-07-12
Description: A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP POST Request Handler. The manipulation of the argument mit_ssid leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://candle-throne-f75.notion.site/Tenda-FH1201-formWrlsafeset-228df0aa118580a3b0dcd29972efbf0e; https://vuldb.com/?ctiid.316114; https://vuldb.com/?id.316114
CVE: CVE-2025-7464
Published: 2025-07-12
Description: A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-119, CWE-125
References: https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64; https://vuldb.com/?ctiid.316116; https://vuldb.com/?id.316116
CVE: CVE-2025-7465
Published: 2025-07-12
Description: A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://candle-throne-f75.notion.site/Tenda-FH1201-fromRouteStatic-229df0aa118580ba952bd3f16857b176; https://vuldb.com/?ctiid.316117; https://vuldb.com/?id.316117
CVE: CVE-2025-6423
Published: 2025-07-12
Description: The BeeTeam368 Extensions plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_submit_upload_file() function in all versions up to, and including, 2.3.5. This makes it possible for authenticated attackers with Subscriber-level access or higher to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://themeforest.net/item/vidmov-video-wordpress-theme/35542187#item-description__change-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/96170b82-6ed9-4a52-8592-944163cdd3cf?source=cve
CVE: CVE-2025-7466
Published: 2025-07-12
Description: A vulnerability, which was classified as critical, has been found in 1000projects ABC Courier Management 1.0. Affected by this issue is some unknown functionality of the file /add_dealerrequest.php. The manipulation of the argument Name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/kensei0x/cve/issues/2; https://vuldb.com/?ctiid.316118; https://vuldb.com/?id.316118
CVE: CVE-2025-7467
Published: 2025-07-12
Description: A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This affects an unknown part of the file /product-detail.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/XiaoZhengRS/OpenCVE202507/issues/1; https://vuldb.com/?ctiid.316119
CVE: CVE-2025-7468
Published: 2025-07-12
Description: A vulnerability has been found in Tenda FH1201 1.2.0.14 and classified as critical. This vulnerability affects the function fromSafeUrlFilter of the file /goform/fromSafeUrlFilter of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://candle-throne-f75.notion.site/Tenda-FH1201-fromSafeUrlFilter-229df0aa118580ceb3e4f54d22814c40; https://vuldb.com/?ctiid.316120; https://vuldb.com/?id.316120
CVE: CVE-2025-7504
Published: 2025-07-12
Description: The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This requires access to the sites SALT_NONCE and and SALT_KEY to exploit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://drive.google.com/file/d/1K-_AcDk9BhUa0kSQ_M-UUnLgmnYJTA0l/view; https://github.com/akirk/friends/pull/537; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306684%40friends&new=3306684%40friends&sfp_email=&sfph_mail=
CVE: CVE-2020-36847
Published: 2025-07-12
Description: The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. This allows unauthenticated attackers to execute code on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/160221/; https://plugins.trac.wordpress.org/changeset/2286920/simple-file-list; https://wpscan.com/vulnerability/365da9c5-a8d0-45f6-863c-1b1926ffd574/
CVE: CVE-2025-7518
Published: 2025-07-12
Description: The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306173%40rsfirewall&new=3306173%40rsfirewall&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fd7b0eef-3b8e-4272-bbd7-ad52088d0835?source=cve
CVE: CVE-2025-7469
Published: 2025-07-12
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/product_add.php. The manipulation of the argument prod_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/angel9sec/cve/issues/1; https://vuldb.com/?ctiid.316121; https://vuldb.com/?id.316121
CVE: CVE-2025-7470
Published: 2025-07-12
Description: A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/angel9sec/cve/issues/2; https://vuldb.com/?ctiid.316122; https://vuldb.com/?id.316122
CVE: CVE-2020-36848
Published: 2025-07-12
Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/2439376/boldgrid-backup; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/wp_total_upkeep_downloader.rb; https://wpscan.com/vulnerability/d35c19d9-8586-4c5b-9a01-44739cbeee19/
CVE: CVE-2020-36849
Published: 2025-07-12
Description: The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/wp_ait_csv_rce.rb; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_ait_csv_rce.rb; https://wpscan.com/vulnerability/36e699a4-91f2-426d-ba14-26036fbfeaea
CVE: CVE-2021-4458
Published: 2025-07-12
Description: The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2683727/modern-events-calendar-lite/trunk/app/libraries/render.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/703ba736-5834-40f2-9cf6-a6a70a73e4d6?source=cve
CVE: CVE-2025-36104
Published: 2025-07-12
Description: IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-277, CWE-732
References: https://www.ibm.com/support/pages/node/7239562
CVE: CVE-2025-7471
Published: 2025-07-12
Description: A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/login-back.php. The manipulation of the argument user-name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/HeDunSec/cve/issues/4; https://vuldb.com/?ctiid.316123
CVE: CVE-2025-7474
Published: 2025-07-12
Description: A vulnerability was found in code-projects Job Diary 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /search.php. The manipulation of the argument Search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/18; https://vuldb.com/?ctiid.316124
CVE: CVE-2025-7475
Published: 2025-07-12
Description: A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part of the file /pay.php. The manipulation of the argument mpesa leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/y2xsec324/cve/issues/12; https://vuldb.com/?ctiid.316125
CVE: CVE-2025-7476
Published: 2025-07-12
Description: A vulnerability classified as critical was found in code-projects Simple Car Rental System 1.0. This vulnerability affects unknown code of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/y2xsec324/cve/issues/13; https://vuldb.com/?ctiid.316126
CVE: CVE-2025-7477
Published: 2025-07-12
Description: A vulnerability, which was classified as critical, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/add_cars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/y2xsec324/cve/issues/14; https://vuldb.com/?ctiid.316127
CVE: CVE-2025-7478
Published: 2025-07-12
Description: A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. Affected is an unknown function of the file /admin/category-list.php. The manipulation of the argument idCate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Gemileo/CVE/issues/4; https://vuldb.com/?ctiid.316128
CVE: CVE-2025-7479
Published: 2025-07-12
Description: A vulnerability has been found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /users/view--detail.php. The manipulation of the argument viewid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/109; https://phpgurukul.com/; https://vuldb.com/?ctiid.316129
CVE: CVE-2025-7480
Published: 2025-07-12
Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. Affected by this issue is some unknown functionality of the file /users/signup.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/110; https://phpgurukul.com/; https://vuldb.com/?ctiid.316130
CVE: CVE-2024-41169
Published: 2025-07-12
Description: The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories and files.

This issue affects Apache Zeppelin: from 0.10.1 up to 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue by removing the Cluster Interpreter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-664
References: https://github.com/apache/zeppelin/pull/4841; https://issues.apache.org/jira/browse/ZEPPELIN-6101; https://lists.apache.org/thread/moyym04993c8owh4h0qj98r43tbo8qdd
CVE: CVE-2025-7481
Published: 2025-07-12
Description: A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /users/profile.php. The manipulation of the argument firstname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/111; https://phpgurukul.com/; https://vuldb.com/?ctiid.316131