deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-22483
Published: 2025-08-29
Description: A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:
License Center 1.8.51 and later
License Center 1.9.51 and later
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-25-27
CVE: CVE-2025-29874
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29875
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29878
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29879
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-55579
Published: 2025-08-29
Description: SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ddobrev25/CVE-2025-55579; https://solidinvoice.co/
CVE: CVE-2025-55580
Published: 2025-08-29
Description: SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/ddobrev25/CVE-2025-55580; https://solidinvoice.co/
CVE: CVE-2025-55763
Published: 2025-08-29
Description: Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a crafted HTTP request. This vulnerability is triggered during request processing and may allow an attacker to corrupt heap memory, potentially leading to denial of service or arbitrary code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/civetweb/civetweb; https://github.com/krispybyte/CVE-2025-55763
CVE: CVE-2025-9660
Published: 2025-08-29
Description: A vulnerability was found in SourceCodester Bakeshop Online Ordering System 1.0. The impacted element is an unknown function of the file /passwordrecover.php. Performing manipulation of the argument phonenumber results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/daimabiabia/cve/issues/1; https://vuldb.com/?ctiid.321868; https://vuldb.com/?id.321868
CVE: CVE-2025-9662
Published: 2025-08-29
Description: A vulnerability was determined in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel. Executing manipulation can lead to sql injection. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.321869; https://vuldb.com/?id.321869
CVE: CVE-2025-9663
Published: 2025-08-29
Description: A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /edit_account.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.321870; https://vuldb.com/?id.321870
CVE: CVE-2025-9664
Published: 2025-08-29
Description: A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.321871; https://vuldb.com/?id.321871
CVE: CVE-2025-29882
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-29886
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29887
Published: 2025-08-29
Description: A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
QuRouter 2.5.1.060 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-25-25
CVE: CVE-2025-29888
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29889
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29890
Published: 2025-08-29
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29893
Published: 2025-08-29
Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-29894
Published: 2025-08-29
Description: An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-29898
Published: 2025-08-29
Description: An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-29899
Published: 2025-08-29
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-29900
Published: 2025-08-29
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4907 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-19
CVE: CVE-2025-30260
Published: 2025-08-29
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-30261
Published: 2025-08-29
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-28
CVE: CVE-2025-30262
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-28
CVE: CVE-2025-30263
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.0 ( 2025/06/13 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-28
CVE: CVE-2025-30264
Published: 2025-08-29
Description: A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30265
Published: 2025-08-29
Description: A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-121
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30267
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30268
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30270
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30271
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30272
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If  can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30273
Published: 2025-08-29
Description: An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30274
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If  can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following versions:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-30275
Published: 2025-08-29
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-30277
Published: 2025-08-29
Description: An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-30278
Published: 2025-08-29
Description: An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-295
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-33032
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
QTS 5.2.5.3145 build 20250526 and later
QuTS hero h5.2.5.3138 build 20250519 and later
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-21
CVE: CVE-2025-33033
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-33036
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-33037
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-33038
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 4.5.0.7 ( 2025/04/23 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-22
CVE: CVE-2025-44015
Published: 2025-08-29
Description: A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.18 and later
CVSS Score: 8.4 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.qnap.com/en/security-advisory/qsa-25-20
CVE: CVE-2025-44033
Published: 2025-08-29
Description: SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declaration in src/main/java/cn/gson/oasys/mappers/AddressMapper.java
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/qkdjksfkeg/Security-Collections/blob/main/sqlinjection.md
CVE: CVE-2025-52856
Published: 2025-08-29
Description: An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version:
VioStor 5.1.6 build 20250621 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.qnap.com/en/security-advisory/qsa-25-29
CVE: CVE-2025-52861
Published: 2025-08-29
Description: A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
VioStor 5.1.6 build 20250621 and later
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-28