deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5749
Published: 2025-06-06
Description: WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of cryptographic keys used in vendor-specific encrypted communications. The issue results from the lack of proper initialization of a variable prior to accessing it. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26295.
CVSS Score: 8.8 (HIGH)
CWE: CWE-457
References: https://www.zerodayinitiative.com/advisories/ZDI-25-328/
CVE: CVE-2025-5750
Published: 2025-06-06
Description: WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of WOLFBOX Level 2 EV Charger. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the secKey, localKey, stdTimeZone and devId parameters. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26294.
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-25-329/
CVE: CVE-2025-5751
Published: 2025-06-06
Description: WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of WOLFBOX Level 2 EV Charger. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of management cards. The issue results from the lack of personalization of management cards. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26292.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-798
References: https://www.zerodayinitiative.com/advisories/ZDI-25-330/
CVE: CVE-2025-5783
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. This affects an unknown part of the file /editmyexp.php. The manipulation of the argument emp3workduration leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/58; https://phpgurukul.com/; https://vuldb.com/?ctiid.311331
CVE: CVE-2025-5784
Published: 2025-06-06
Description: A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects unknown code of the file /myexp.php. The manipulation of the argument emp3ctc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/60; https://phpgurukul.com/; https://vuldb.com/?ctiid.311332
CVE: CVE-2025-5785
Published: 2025-06-06
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED] and classified as critical. This issue affects some unknown processing of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/7.md; https://vuldb.com/?ctiid.311333; https://vuldb.com/?id.311333
CVE: CVE-2025-49599
Published: 2025-06-06
Description: Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account to disable ONT firewall functionality, e.g., to remove the default blocking of the SSH and TELNET TCP ports, aka HWNO-56Q3.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-863
References: https://www.youtube.com/watch?v=l1eYpcNvZdQ; https://www.youtube.com/watch?v=l1eYpcNvZdQ
CVE: CVE-2025-5786
Published: 2025-06-06
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been classified as critical. Affected is an unknown function of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/8.md; https://vuldb.com/?ctiid.311334; https://vuldb.com/?id.311334
CVE: CVE-2025-5787
Published: 2025-06-06
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/Lena-lyy/cve/blob/main/9.md; https://vuldb.com/?ctiid.311335; https://vuldb.com/?id.311335
CVE: CVE-2025-5788
Published: 2025-06-06
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/10.md; https://vuldb.com/?ctiid.311336; https://vuldb.com/?id.311336
CVE: CVE-2025-47950
Published: 2025-06-06
Description: CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash — especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency.  Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://datatracker.ietf.org/doc/html/rfc9250; https://github.com/coredns/coredns/commit/efaed02c6a480ec147b1f799aab7cf815b17dfe1; https://github.com/coredns/coredns/security/advisories/GHSA-cvx7-x8pj-x2gw
CVE: CVE-2025-49011
Published: 2025-06-06
Description: SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow’ed relation.
CVSS Score: 3.7 (LOW)
CWE: CWE-358
References: https://github.com/authzed/spicedb/commit/fe8dd9f491f6975b3408c401e413a530eb181a67; https://github.com/authzed/spicedb/releases/tag/v1.44.2; https://github.com/authzed/spicedb/security/advisories/GHSA-cwwm-hr97-qfxm
CVE: CVE-2025-5789
Published: 2025-06-06
Description: A vulnerability classified as critical has been found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/11.md; https://vuldb.com/?ctiid.311337; https://vuldb.com/?id.311337
CVE: CVE-2025-5790
Published: 2025-06-06
Description: A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. This vulnerability affects unknown code of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/12.md; https://vuldb.com/?ctiid.311338; https://vuldb.com/?id.311338
CVE: CVE-2025-5792
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formWlanRedirect of the component HTTP POST Request Handler. The manipulation of the argument redirect-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/byxs0x0/cve2/blob/main/1.md; https://vuldb.com/?ctiid.311339; https://vuldb.com/?id.311339
CVE: CVE-2025-5793
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/byxs0x0/cve2/blob/main/2.md; https://vuldb.com/?ctiid.311340; https://vuldb.com/?id.311340
CVE: CVE-2025-2766
Published: 2025-06-06
Description: 70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the default configuration of user accounts. The configuration contains default password. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the root. Was ZDI-CAN-24996.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1393
References: https://www.zerodayinitiative.com/advisories/ZDI-25-180/
CVE: CVE-2025-3485
Published: 2025-06-06
Description: Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the extractFileFromZip method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26524.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-2; https://www.zerodayinitiative.com/advisories/ZDI-25-254/
CVE: CVE-2025-5473
Published: 2025-06-06
Description: GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26752.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://www.gimp.org/news/2025/05/18/gimp-3-0-4-released/#general-bugfixes; https://www.zerodayinitiative.com/advisories/ZDI-25-321/; https://lists.debian.org/debian-lts-announce/2025/10/msg00022.html
CVE: CVE-2025-5474
Published: 2025-06-06
Description: 2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 2BrightSparks SyncBackFree. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is also required.

The specific flaw exists within the Mirror functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26962.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://www.zerodayinitiative.com/advisories/ZDI-25-322/
CVE: CVE-2025-5480
Published: 2025-06-06
Description: Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1.  An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26767.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.action1.com/blog/acknowledging-zdi-can-26767-high-severity-vulnerability-in-action1-agent/; https://www.zerodayinitiative.com/advisories/ZDI-25-323/
CVE: CVE-2025-5481
Published: 2025-06-06
Description: Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26168.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-25-324/
CVE: CVE-2025-5794
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, has been found in Tenda AC5 15.03.06.47. Affected by this issue is the function formSetPPTPUserList of the file /goform/setPptpUserList. The manipulation of the argument list leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC5-formSetPPTPUserList-20a53a41781f806faf61cef61ed929c0?source=copy_link; https://vuldb.com/?ctiid.311348; https://vuldb.com/?id.311348
CVE: CVE-2025-5795
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, was found in Tenda AC5 1.0/15.03.06.47. This affects the function fromadvsetlanip of the file /goform/AdvSetLanip. The manipulation of the argument lanMask leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC5-fromadvsetlanip-20a53a41781f805389dcd51fa04bc530?source=copy_link; https://vuldb.com/?ctiid.311349; https://vuldb.com/?id.311349
CVE: CVE-2025-5796
Published: 2025-06-06
Description: A vulnerability has been found in code-projects Laundry System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /data/edit_type.php. The manipulation of the argument Type leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/8; https://vuldb.com/?ctiid.311350
CVE: CVE-2025-5797
Published: 2025-06-06
Description: A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. This issue affects some unknown processing of the file /data/insert_type.php. The manipulation of the argument Type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/tuooo/CVE/issues/9; https://vuldb.com/?ctiid.311351
CVE: CVE-2025-5798
Published: 2025-06-06
Description: A vulnerability was found in Tenda AC8 16.03.34.09. It has been classified as critical. Affected is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument timeType leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC8-fromSetSysTime-20a53a41781f807b9489fff42f262e11?source=copy_link; https://vuldb.com/?ctiid.311352; https://vuldb.com/?id.311352
CVE: CVE-2025-5799
Published: 2025-06-06
Description: A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://lavender-bicycle-a5a.notion.site/Tenda-AC8-fromSetWirelessRepeat-20a53a41781f803d9156f0babaf94fca?source=copy_link; https://vuldb.com/?ctiid.311353; https://vuldb.com/?id.311353
CVE: CVE-2025-49127
Published: 2025-06-06
Description: Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user to execute arbitrary code on the server. Version 1.1.0 fixes the issue.
CWE: CWE-502
References: https://github.com/kafbat/kafka-ui/releases/tag/v1.1.0; https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2; https://github.com/kafbat/kafka-ui/security/advisories/GHSA-g3mf-c374-fgh2
CVE: CVE-2025-49128
Published: 2025-06-06
Description: Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and prior to version 2.13.0, a flaw in jackson-core's `JsonLocation._appendSourceDesc` method allows up to 500 bytes of unintended memory content to be included in exception messages. When parsing JSON from a byte array with an offset and length, the exception message incorrectly reads from the beginning of the array instead of the logical payload start. This results in possible information disclosure in systems using pooled or reused buffers, like Netty or Vert.x. This issue was silently fixed in jackson-core version 2.13.0, released on September 30, 2021, via PR #652. All users should upgrade to version 2.13.0 or later. If upgrading is not immediately possible, applications can mitigate the issue by disabling exception message exposure to clients to avoid returning parsing exception messages in HTTP responses and/or disabling source inclusion in exceptions to prevent Jackson from embedding any source content in exception messages, avoiding leakage.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-209
References: https://github.com/FasterXML/jackson-core/commit/a6c297682737dde13337cb7c3020f299518609a8; https://github.com/FasterXML/jackson-core/pull/652; https://github.com/FasterXML/jackson-core/security/advisories/GHSA-wf8f-6423-gfxg
CVE: CVE-2025-47601
Published: 2025-06-07
Description: Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Privilege Escalation.This issue affects MaxiBlocks: from n/a through <= 2.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/maxi-blocks/vulnerability/wordpress-maxiblocks-plugin-2-1-0-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-5814
Published: 2025-06-07
Description: The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_plugin_control() function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate previously deactivated plugins after accessing the "Profiler" page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/profiler-what-slowing-down/trunk/actions.php#L31; https://www.wordfence.com/threat-intel/vulnerabilities/id/9213db60-c0c1-44a9-9b8c-621029c3a08f?source=cve
CVE: CVE-2025-5399
Published: 2025-06-07
Description: Due to a mistake in libcurl's WebSocket code, a malicious server can send a
particularly crafted packet which makes libcurl get trapped in an endless
busy-loop.

There is no other way for the application to escape or exit this loop other
than killing the thread/process.

This might be used to DoS libcurl-using application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://curl.se/docs/CVE-2025-5399.html; https://curl.se/docs/CVE-2025-5399.json; https://hackerone.com/reports/3168039