deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8323
Published: 2025-07-30
Description: The e-School from Ventem has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-10307-25cdf-2.html; https://www.twcert.org.tw/tw/cp-132-10306-ccea7-1.html
CVE: CVE-2025-38498
Published: 2025-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

do_change_type(): refuse to operate on unmounted/not ours mounts

Ensure that propagation settings can only be changed for mounts located
in the caller's mount namespace. This change aligns permission checking
with the rest of mount(2).
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/064014f[PII_REDACTED]d5d0592f3d2bcd727f2ee93; https://git.kernel.org/stable/c/12f147ddd6de7382dad54812e65f3f08d05809fc; https://git.kernel.org/stable/c/19554c79a2095ddde850906a067915c1ef3a4114
CVE: CVE-2025-1221
Published: 2025-07-30
Description: A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system (CPCd) due to heavy Zigbee traffic, resulting in a Denial of Service (DoS) attack, Only hard reset will bring the device to normal operation
CWE: CWE-667
References: https://community.silabs.com/068Vm00000Sadyn; https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-7.4.4.0.pdf; https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-8.0.2.0.pdf
CVE: CVE-2025-1394
Published: 2025-07-30
Description: The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial of Service (DoS).
CWE: CWE-252
References: https://community.silabs.com/068Vm00000SkHNX; https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-7.5.0.0.pdf; https://www.silabs.com/documents/public/release-notes/emberznet-release-notes-8.0.3.0.pdf
CVE: CVE-2025-6348
Published: 2025-07-30
Description: The Smart Slider 3 plugin for WordPress is vulnerable to time-based SQL Injection via the ‘sliderid’ parameter in all versions up to, and including, 3.5.1.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3332052/; https://www.wordfence.com/threat-intel/vulnerabilities/id/188baddc-134c-4a82-898b-9b038e795893?source=cve
CVE: CVE-2025-47001
Published: 2025-07-30
Description: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
CVE: CVE-2025-8326
Published: 2025-07-30
Description: A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/delete_s7.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/vullis0/cve/issues/1; https://vuldb.com/?ctiid.318276
CVE: CVE-2025-52567
Published: 2025-07-30
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were not robust enough for certain specific cases. This is fixed in version 10.0.19.
CVSS Score: 3.5 (LOW)
CWE: CWE-918
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-5mp6-mgmh-vrq7
CVE: CVE-2025-52897
Published: 2025-07-30
Description: GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80, CWE-601
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-6whm-q2rp-prqm
CVE: CVE-2025-53008
Published: 2025-07-30
Description: GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed in version 10.0.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-52h8-76ph-4j9q
CVE: CVE-2025-54388
Published: 2025-07-30
Description: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-909
References: https://github.com/moby/moby/commit/bea959c7b793b32a893820b97c4eadc7c87fabb0; https://github.com/moby/moby/pull/50506; https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4
CVE: CVE-2025-54410
Published: 2025-07-30
Description: Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected.
Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.
CVSS Score: 3.3 (LOW)
CWE: CWE-909
References: https://firewalld.org/documentation/howto/reload-firewalld.html; https://github.com/moby/moby/security/advisories/GHSA-4vq8-7jfc-9cvp
CVE: CVE-2025-54425
Published: 2025-07-30
Description: Umbraco is an ASP.NET CMS. In versions 13.0.0 through 13.9.2, 15.0.0 through 15.4.1 and 16.0.0 through 16.1.0, the content delivery API can be restricted from public access where an API key must be provided in a header to authorize the request. It's also possible to configure output caching, such that the delivery API outputs will be cached for a period of time, improving performance. There's an issue when these two things are used together, where caching doesn't vary by the header that contains the API key. As such, it's possible for a user without a valid API key to retrieve a response for a given path and query if it has recently been requested and cached by request with a valid key. This is fixed in versions 13.9.3, 15.4.4 and 16.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api; https://github.com/umbraco/Umbraco-CMS/commit/7e82c258eebaa595eadc9b000461e27d02bc030e; https://github.com/umbraco/Umbraco-CMS/commit/9f37db18d11c8ba4e3ecdeb35291af30ebee7cd0
CVE: CVE-2025-54430
Published: 2025-07-30
Description: dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issue_comment can be triggered using the @benchmark body. This workflow is susceptible to exploitation as it checkout the ${{ github.event.issue.number }}, which correspond to the branch of the PR manipulated by potentially malicious actors, and where untrusted code may be executed. Running untrusted code may lead to the exfiltration of GITHUB_TOKEN, which in this workflow has write permissions on most of the scopes - in particular the contents one - and could lead to potential repository takeover. This is fixed by commit 3f61e79.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://github.com/dedupeio/dedupe/commit/3f61e79102910bd355e920a2df7e44c14c9cb247; https://github.com/dedupeio/dedupe/security/advisories/GHSA-wrg3-xqw8-m85p
CVE: CVE-2025-54572
Published: 2025-07-30
Description: The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
CWE: CWE-400, CWE-770
References: https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709; https://github.com/SAML-Toolkits/ruby-saml/pull/770; https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1
CVE: CVE-2024-45515
Published: 2025-07-30
Description: An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient validation of the content type metadata when importing files into the briefcase. Attackers can exploit this issue by crafting a file with manipulated metadata, allowing them to bypass content type checks and execute arbitrary JavaScript within the victim's session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE: CVE-2025-43018
Published: 2025-07-30
Description: Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.hp.com/us-en/document/ish_12[PII_REDACTED]7034-16/hpsbpi04040
CVE: CVE-2025-46811
Published: 2025-07-30
Description: A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46811
CVE: CVE-2025-53111
Published: 2025-07-30
Description: GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-p665-mqcr-j96j
CVE: CVE-2025-53112
Published: 2025-07-30
Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-rp7w-6343-3m2r
CVE: CVE-2025-53113
Published: 2025-07-30
Description: GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do not have the right to see. This is fixed in version 10.0.19.
CVSS Score: 2.7 (LOW)
CWE: CWE-284, CWE-862
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-r2mm-6499-4m8j
CVE: CVE-2025-53357
Published: 2025-07-30
Description: GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. This is fixed in version 10.0.19.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-x9mj-822q-6cf8
CVE: CVE-2025-53944
Published: 2025-07-30
Description: AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_graph_execution_results endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graph_id, it fails to verify ownership of the graph_exec_id parameter, allowing authenticated users to access any execution results by providing arbitrary execution IDs. The internal API implements proper validation for both parameters. This is fixed in v0.6.16.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-639
References: https://github.com/Significant-Gravitas/AutoGPT/commit/309114a727baa[PII_REDACTED]d444e9a119f8dd7f6; https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.16; https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-x77j-qg2x-fgg6
CVE: CVE-2025-54433
Published: 2025-07-30
Description: Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3,  ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.
CWE: CWE-22
References: https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33; https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21; https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f
CVE: CVE-2025-54573
Published: 2025-07-30
Description: CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified users. Additionally, the missing email verification check leaves the system open to bot signups and further usage. CVAT 2.42.0 and later versions contain a fix for the issue. CVAT Enterprise customers have a workaround available; those customers may disable registration to prevent this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/cvat-ai/cvat/commit/bc20eff16b8406fbb755f6540e6f269da0c9c5b2; https://github.com/cvat-ai/cvat/security/advisories/GHSA-fxgh-m76j-242q
CVE: CVE-2023-2593
Published: 2025-07-30
Description: A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This vulnerability allows an unauthenticated attacker to create a denial of service condition on the system.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/security/cve/CVE-2023-2593; https://bugzilla.redhat.com/show_bug.cgi?id=2384787; https://lore.kernel.org/lkml/CAH2r5msyEy20e=FBx6wPWWc3kXzNR4b+zHshSqidRdFKVf_7Jg@mail.gmail.com/
CVE: CVE-2025-50578
Published: 2025-07-30
Description: LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-74, CWE-601
References: https://github.com/linuxserver/Heimdall; https://github.com/linuxserver/Heimdall/issues/1451; https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea
CVE: CVE-2025-54656
Published: 2025-07-30
Description: ** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.

This issue affects Apache Struts Extras: before 2.

When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). 

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-117
References: https://lists.apache.org/thread/so5cn07j2zn9vlf1xnfqp630wts719rr; http://www.openwall.com/lists/oss-security/2025/07/30/1
CVE: CVE-2025-8312
Published: 2025-07-30
Description: Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) :

  *  
Devolutions Server 2025.2.2.0 through 2025.2.5.0
  *  Devolutions Server 2025.1.12.0 and earlier
CVSS Score: 7.1 (HIGH)
CWE: CWE-833
References: https://devolutions.net/security/advisories/DEVO-2025-0013/
CVE: CVE-2025-8353
Published: 2025-07-30
Description: UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-446
References: https://devolutions.net/security/advisories/DEVO-2025-0013/
CVE: CVE-2024-45955
Published: 2025-07-30
Description: Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: http://rocket.com; https://notes.netbytesec.com/2025/07/cve-2024-45955-sql-injection.html
CVE: CVE-2025-25691
Published: 2025-07-30
Description: A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77, CWE-502
References: http://dem0.com; http://dem0.com/admin/index.php/improve/design/themes/import?_token=btRUtV2Om2noliZZjeFQZhlMY3gYivjABbPOjP91L6U; http://prestashop.com
CVE: CVE-2025-25692
Published: 2025-07-30
Description: A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77, CWE-502
References: http://prestashop.com; https://github.com/3em0/cve_repo/blob/main/preshop/CVE-2025-25692.md; https://github.com/PrestaShop/PrestaShop
CVE: CVE-2025-36611
Published: 2025-07-30
Description: Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Following') Vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000347824/dsa-2025-292
CVE: CVE-2025-45619
Published: 2025-07-30
Description: An issue in Aver PTC310UV2 firmware v.0.1.0000.59 allows a remote attacker to execute arbitrary code via the SendAction function
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: http://aver.com; http://ptc310uv2.com; https://github.com/weedl/CVE-2025-45619
CVE: CVE-2025-45620
Published: 2025-07-30
Description: An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted request
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: http://aver.com; http://ptc310uv2.com; https://github.com/weedl/CVE-2025-45620
CVE: CVE-2025-26332
Published: 2025-07-30
Description: TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000337241/dsa-2025-108-security-update-for-dell-emc-xtremio-x2
CVE: CVE-2025-30105
Published: 2025-07-30
Description: Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532
References: https://www.dell.com/support/kbdoc/en-us/000337241/dsa-2025-108-security-update-for-dell-emc-xtremio-x2