deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7132
Published: 2025-07-07
Description: A vulnerability was found in Campcodes Payroll Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_payroll. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/20; https://vuldb.com/?ctiid.315044; https://vuldb.com/?id.315044
CVE: CVE-2025-7133
Published: 2025-07-07
Description: A vulnerability classified as problematic has been found in CodeAstro Online Movie Ticket Booking System 1.0. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://codeastro.com/; https://github.com/Vanshdhawan188/Online-Movie-Ticket-Booking-System-in-Python-/blob/main/Online%20Movie%20Ticket%20Booking%20System%20in%20Python.md; https://vuldb.com/?ctiid.315045
CVE: CVE-2025-26780
Published: 2025-07-07
Description: An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a malformed PDCP packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-26780/
CVE: CVE-2025-32023
Published: 2025-07-07
Description: Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
CVSS Score: 7.0 (HIGH)
CWE: CWE-680
References: https://github.com/redis/redis/commit/50188747cbfe43528d2719399a2a3c[PII_REDACTED]; https://github.com/redis/redis/releases/tag/6.2.19; https://github.com/redis/redis/releases/tag/7.2.10
CVE: CVE-2025-43931
Published: 2025-07-07
Description: flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://gist.github.com/BrookeYangRui/19fcc6c19df7bb4d8437476c609a6129; https://github.com/MaxHalford/flask-boilerplate/blob/a170e7cec[PII_REDACTED]80567c4279b30ccd9630b/app/views/user.py#L103-L126
CVE: CVE-2025-43932
Published: 2025-07-07
Description: JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640
References: https://github.com/guomaoqiu/JobCenter/blob/7e7b0b2f756d66bba7e592a6c8952c78a3573d9c/app/templates/auth/email/reset_password.txt; https://github.com/guomaoqiu/JobCenter/issues/18
CVE: CVE-2025-43933
Published: 2025-07-07
Description: fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-472
References: https://github.com/ghost123gg/fblog/blob/983bedec9f837a54ab2dfd358a9cb45504a2e709/app/templates/auth/email/resetPassword.html#L1-L8; https://github.com/ghost123gg/fblog/issues/5
CVE: CVE-2025-45065
Published: 2025-07-07
Description: employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.google.com/document/d/1Sq08I_eKCY-YOmVOQPIEj4Ui2pW0gIgXHcqD9fcvR7M/edit?usp=sharing; https://medium.com/@shrutukapoor25/cve-2025-45065-b58a33e65860; https://docs.google.com/document/d/1Sq08I_eKCY-YOmVOQPIEj4Ui2pW0gIgXHcqD9fcvR7M/edit?tab=t.0#heading=h.vb8p0lepu9vn
CVE: CVE-2025-45479
Published: 2025-07-07
Description: Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting crafted content into a container.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/YX-hueimie/CVE-Issues/blob/main/CVE-2025-45479.md; https://www.educoder.net/; https://www.educoder.net/shixuns/fb7qhjgz/challenges
CVE: CVE-2025-47202
Published: 2025-07-07
Description: In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400, the lack of a length check leads to out-of-bounds writes.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-47202/
CVE: CVE-2025-48367
Published: 2025-07-07
Description: Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/redis/redis/commit/bde62951accfc4bb0a516276fd0b4b307e140ce2; https://github.com/redis/redis/releases/tag/6.2.19; https://github.com/redis/redis/releases/tag/7.2.10
CVE: CVE-2025-52492
Published: 2025-07-07
Description: A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain unauthorized access to the associated Twilio account, leading to information disclosure, potential service disruption, and unauthorized use of the Twilio services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://gist.github.com/jackcaplin/0dfb7ef428b8ade5de4396dd753cd894; https://paxton-access.co.uk
CVE: CVE-2025-53373
Published: 2025-07-07
Description: Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b.
CWE: CWE-640
References: https://github.com/ahmed-elgaml11/Natours/commit/7401793a8d9ed0f0c250c4e0ee2815d685d7a70b; https://github.com/ahmed-elgaml11/Natours/security/advisories/GHSA-8gmw-7p75-58qv
CVE: CVE-2025-53374
Published: 2025-07-07
Description: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privileged account can retrieve detailed profile information about another users in the same organization by directly invoking user.one. The response discloses personally-identifiable information (PII) such as e-mail address, role, two-factor status, organization ID, and various account flags. The fix will be available in the v0.23.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-359, CWE-862
References: https://github.com/Dokploy/dokploy/commit/61cf426615a4aa095b150362526aa52f2d1ea115; https://github.com/Dokploy/dokploy/security/advisories/GHSA-fcq8-wv2q-f758
CVE: CVE-2025-53375
Published: 2025-07-07
Description: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access (e.g., /etc/passwd, application source, environment variable files containing credentials and secrets). This may lead to full compromise of other services or lateral movement. This vulnerability is fixed in 0.23.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/Dokploy/dokploy/commit/e42f6bc61050cd438726921fced64477cbf8f8e6; https://github.com/Dokploy/dokploy/security/advisories/GHSA-vq94-qm94-mxp6
CVE: CVE-2025-53376
Published: 2025-07-07
Description: Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure
docker.getContainersByAppNameMatch interpolates the attacker-supplied appName value into a Docker CLI call without sanitisation, enabling command injection under the Dokploy service account. This vulnerability is fixed in 0.23.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/Dokploy/dokploy/commit/fb5d2bd5b67322f1468e5e4d0d5abcf97517761c; https://github.com/Dokploy/dokploy/security/advisories/GHSA-m486-7pmj-8cmv
CVE: CVE-2025-53487
Published: 2025-07-07
Description: The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped.




This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Ifcab085111e7898da485a5e2ae287fee4e6d167b; https://phabricator.wikimedia.org/T394383
CVE: CVE-2025-7057
Published: 2025-07-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension allows Stored XSS.This issue affects Mediawiki - Quiz Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Quiz/+/1166274; https://phabricator.wikimedia.org/T394612
CVE: CVE-2025-7134
Published: 2025-07-07
Description: A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_application. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/21; https://vuldb.com/?ctiid.315046; https://vuldb.com/?id.315046
CVE: CVE-2025-7135
Published: 2025-07-07
Description: A vulnerability, which was classified as critical, has been found in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_vacancy. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/22; https://vuldb.com/?ctiid.315047; https://vuldb.com/?id.315047
CVE: CVE-2025-7259
Published: 2025-07-07
Description: An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can only be triggered by authorized users and cause Denial of Service. This issue affects MongoDB Server v8.1 version 8.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843
References: https://jira.mongodb.org/browse/SERVER-102693
CVE: CVE-2024-25176
Published: 2025-07-07
Description: LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://gist.github.com/pwnhacker0x18/cd75d01fc7c9b6c85c183fbe5353d276; https://github.com/LuaJIT/LuaJIT/commit/343ce0edaf3906a[PII_REDACTED]5b2f5410024cbfc; https://github.com/LuaJIT/LuaJIT/issues/1149
CVE: CVE-2024-25177
Published: 2025-07-07
Description: LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://gist.github.com/pwnhacker0x18/a73f560d79f2c3d4011d6c5a2676f04a; https://github.com/LuaJIT/LuaJIT/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f; https://github.com/LuaJIT/LuaJIT/issues/1147
CVE: CVE-2024-25178
Published: 2025-07-07
Description: LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://gist.github.com/pwnhacker0x18/423b4292f301ab274b42d5ed6e0b87d8; https://github.com/LuaJIT/LuaJIT/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8; https://github.com/LuaJIT/LuaJIT/issues/1152
CVE: CVE-2025-1351
Published: 2025-07-07
Description: IBM Storage Virtualize 8.5, 8.6, and 8.7 products could allow a user to escalate their privileges to that of another user logging in at the same time due to a race condition in the login function.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-362
References: https://www.ibm.com/support/pages/node/7237157
CVE: CVE-2025-36014
Published: 2025-07-07
Description: IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory.
CVSS Score: 8.2 (HIGH)
CWE: CWE-94
References: https://www.ibm.com/support/pages/node/7239003
CVE: CVE-2025-53377
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_funcionario parameter. This vulnerability is fixed in 3.4.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/8ab726c9f4d0fce7ad6c66640c3126f95f73ddd7; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qgrq-qjq6-h6gj; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qgrq-qjq6-h6gj
CVE: CVE-2025-53491
Published: 2025-07-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - FlaggedRevs Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - FlaggedRevs Extension: from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1165929; https://phabricator.wikimedia.org/T394397
CVE: CVE-2025-53497
Published: 2025-07-07
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles Extension allows Stored XSS.This issue affects Mediawiki - RelatedArticles Extension: from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/RelatedArticles/+/1166024; https://phabricator.wikimedia.org/T396413
CVE: CVE-2025-53525
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/45695edc5ff7689f14efcfddb37e0323df34e184; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-982x-v58q-6qpj
CVE: CVE-2025-53526
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php.
After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/f8cf5d0473334e6c28ea7f604da11ee2a7b419df; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-46fm-hx2r-69fg
CVE: CVE-2025-53527
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/9de9a741d1d26ae76b2215a32660817d9bd452aa; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-43xw-c4g6-jgff; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-43xw-c4g6-jgff
CVE: CVE-2025-53529
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/0a061bcc5024937edd18ab3e65ccc8f38deb6957; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rrj6-pj6w-8j2r
CVE: CVE-2025-53530
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks.  This vulnerability is fixed in 3.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-562r-xgj9-2r7p
CVE: CVE-2025-53531
Published: 2025-07-07
Description: WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks. This vulnerability is fixed in 3.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-4ffc-f23j-54m3
CVE: CVE-2025-53532
Published: 2025-07-07
Description: giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service. This vulnerability is fixed by the c43af7806e65adfcf4d0feeebef76dc36c95cb9a and 4b9745fe1a326ce08d69f8a388331bc993d19389 commits.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/giscus/giscus/commit/4b9745fe1a326ce08d69f8a388331bc993d19389; https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a; https://github.com/giscus/giscus/security/advisories/GHSA-w6vg-v24f-4vm3
CVE: CVE-2025-7136
Published: 2025-07-07
Description: A vulnerability, which was classified as critical, was found in Campcodes Online Recruitment Management System 1.0. Affected is an unknown function of the file /admin/view_vacancy.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/wyl091256/CVE/issues/23; https://vuldb.com/?ctiid.315048; https://vuldb.com/?id.315048
CVE: CVE-2025-7137
Published: 2025-07-07
Description: A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /panel/schedule-staff.php. The manipulation of the argument staff_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-22.md; https://vuldb.com/?ctiid.315051; https://vuldb.com/?id.315051
CVE: CVE-2024-37656
Published: 2025-07-07
Description: An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/gnuboard/gnuboard5/issues/318; https://github.com/gnuboard/gnuboard5/issues/318
CVE: CVE-2024-37657
Published: 2025-07-07
Description: An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/gnuboard/gnuboard5/issues/320; https://sir.kr/g5_pds/7205; https://github.com/gnuboard/gnuboard5/issues/320
CVE: CVE-2024-37658
Published: 2025-07-07
Description: An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/gnuboard/gnuboard5/issues/319; https://sir.kr/g5_pds/7205; https://github.com/gnuboard/gnuboard5/issues/319
CVE: CVE-2024-43190
Published: 2025-07-07
Description: IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a legitimate user using man in the middle techniques.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-640
References: https://www.ibm.com/support/pages/node/7238992
CVE: CVE-2025-20300
Published: 2025-07-07
Description: In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to a specific alert, could suppress that alert when it triggers. See [Define alert suppression groups to throttle sets of similar alerts](https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/manage-alert-trigger-conditions-and-throttling/define-alert-suppression-groups-to-throttle-sets-of-similar-alerts).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://advisory.splunk.com/advisories/SVD-2025-0708