deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54955
Published: 2025-08-03
Description: OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account takeover. By exploiting this, an unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowledge of their credentials.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://docs.opennebula.io/6.10/intro_release_notes/release_notes_enterprise/resolved_issues_6103.html; https://github.com/OpenNebula/one; https://github.com/OpenNebula/one/commit/81058d9705e7ac619d294423de28b76d88f613b6
CVE: CVE-2025-8494
Published: 2025-08-03
Description: A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /admin/delete_student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.318593; https://vuldb.com/?id.318593
CVE: CVE-2025-54349
Published: 2025-08-03
Description: In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-193
References: https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf; https://github.com/esnet/iperf/releases/tag/3.19.1; https://lists.debian.org/debian-lts-announce/2025/08/msg00020.html
CVE: CVE-2025-54350
Published: 2025-08-03
Description: In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt.
CVSS Score: 3.7 (LOW)
CWE: CWE-617
References: https://github.com/esnet/iperf/commit/4eab661da0bbaac04493fa40164e928c6df7934a; https://github.com/esnet/iperf/releases/tag/3.19.1; https://lists.debian.org/debian-lts-announce/2025/08/msg00020.html
CVE: CVE-2025-54351
Published: 2025-08-03
Description: In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv).
CVSS Score: 8.9 (HIGH)
CWE: CWE-420
References: https://github.com/esnet/iperf/commit/969b7f70c447513e92c9798f22e82b40ebc53bf0; https://github.com/esnet/iperf/releases/tag/3.19.1
CVE: CVE-2025-8495
Published: 2025-08-03
Description: A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /admin/edit_admin_query.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://vuldb.com/?ctiid.318594; https://vuldb.com/?id.318594
CVE: CVE-2025-52131
Published: 2025-08-03
Description: The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar; https://github.com/xwiki-contrib/application-mocca-calendar; https://github.com/xwikisas/application-mocca-calendar
CVE: CVE-2025-52132
Published: 2025-08-03
Description: The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar; https://github.com/xwiki-contrib/application-mocca-calendar; https://github.com/xwikisas/application-mocca-calendar
CVE: CVE-2025-52133
Published: 2025-08-03
Description: The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://extensions.xwiki.org/xwiki/bin/view/Extension/MoccaCalendar; https://github.com/xwiki-contrib/application-mocca-calendar; https://github.com/xwikisas/application-mocca-calendar
CVE: CVE-2025-8496
Published: 2025-08-03
Description: A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /viewform.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/huangtinlin/CVE/issues/1; https://vuldb.com/?ctiid.318595; https://vuldb.com/?id.318595
CVE: CVE-2025-8497
Published: 2025-08-03
Description: A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/shokaku-cyb/cve/issues/2; https://vuldb.com/?ctiid.318596
CVE: CVE-2025-8498
Published: 2025-08-03
Description: A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /cart/index.php. Such manipulation of the argument uname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/shokaku-cyb/cve/issues/1; https://vuldb.com/?ctiid.318597
CVE: CVE-2025-8499
Published: 2025-08-03
Description: A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cusfindambulence2.php. The manipulation of the argument Search leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/joker-vip/cvesubmit/issues/1; https://vuldb.com/?ctiid.318598
CVE: CVE-2025-8500
Published: 2025-08-03
Description: A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insert-and-view/action.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/shenxianyuguitian/hris-vuln-sqli/blob/main/README.md; https://vuldb.com/?ctiid.318599
CVE: CVE-2025-8501
Published: 2025-08-03
Description: A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /insert-and-view/action.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/shenxianyuguitian/hris-vuln-XSS/blob/main/README.md; https://vuldb.com/?ctiid.318600
CVE: CVE-2025-8502
Published: 2025-08-03
Description: A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown functionality of the file /changepass.php. The manipulation of the argument ups leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/freshfish-hust/my-cves/issues/1; https://vuldb.com/?ctiid.318601
CVE: CVE-2025-8503
Published: 2025-08-03
Description: A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some unknown functionality of the file /adaddmed.php. The manipulation of the argument mname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/freshfish-hust/my-cves/issues/2; https://vuldb.com/?ctiid.318602
CVE: CVE-2025-8504
Published: 2025-08-03
Description: A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/freshfish-hust/my-cves/issues/4; https://vuldb.com/?ctiid.318603
CVE: CVE-2025-8505
Published: 2025-08-03
Description: A vulnerability has been found in 495300897 wx-shop up to de1b[PII_REDACTED]5779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862
References: https://github.com/Bemcliu/cve-reports/blob/main/cve-08-wx-shop-CSRF/readme.md; https://vuldb.com/?ctiid.318604; https://vuldb.com/?id.318604
CVE: CVE-2025-8506
Published: 2025-08-03
Description: A vulnerability was found in 495300897 wx-shop up to de1b[PII_REDACTED]5779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown processing of the file /user/editUI. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Bemcliu/cve-reports/blob/main/cve-07-wx-shop-Stored%20XSS/readme.md; https://vuldb.com/?ctiid.318605; https://vuldb.com/?id.318605
CVE: CVE-2024-41177
Published: 2025-08-03
Description: Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.

This issue affects Apache Zeppelin: before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/apache/zeppelin/pull/4755; https://github.com/apache/zeppelin/pull/4795; https://lists.apache.org/thread/nwh8vh9f3pnvt04n8z4g2kbddh62blr6
CVE: CVE-2024-52279
Published: 2025-08-03
Description: Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.

This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/apache/zeppelin/pull/4838; https://issues.apache.org/jira/browse/ZEPPELIN-6095; https://lists.apache.org/thread/dxb98vgrb21rrl3k0fzonpk66onr6o4q
CVE: CVE-2025-8507
Published: 2025-08-03
Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8507.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_funcao_lst.md; https://vuldb.com/?ctiid.318606
CVE: CVE-2024-51775
Published: 2025-08-03
Description: Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. 
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1385
References: https://github.com/apache/zeppelin/pull/4823; http://www.openwall.com/lists/oss-security/2025/08/03/5
CVE: CVE-2025-8508
Published: 2025-08-03
Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8508.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20educar_avaliacao_desempenho_cad.php%20parameters%20titulo_avaliacao%20and%20descricao.md; https://vuldb.com/?ctiid.318607
CVE: CVE-2025-8509
Published: 2025-08-03
Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8509.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20educar_servidor_cad.php%20parameter%20matricula.md; https://vuldb.com/?ctiid.318608
CVE: CVE-2025-8510
Published: 2025-08-03
Description: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.md; https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46; https://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xg
CVE: CVE-2025-8511
Published: 2025-08-03
Description: A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ of the component Observações. The manipulation of the argument Descrição leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-8511.md; https://github.com/marcelomulder/CVE/blob/main/i-diario/Stored%20XSS%20endpoint%20diario-de-observacoes.(ID)%20in%20'Observa%C3%A7%C3%B5es-Descri%C3%A7%C3%A3o'%20parameter.md; https://vuldb.com/?ctiid.318610
CVE: CVE-2025-8512
Published: 2025-08-03
Description: A vulnerability, which was classified as problematic, has been found in TVB Big Big Shop App 2.9.0 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component hk.com.tvb.bigbigshop. The manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/hk.com.tvb.bigbigshop.md; https://vuldb.com/?ctiid.318611; https://vuldb.com/?id.318611
CVE: CVE-2025-8513
Published: 2025-08-03
Description: A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.caixin.news. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.caixin.news.md; https://vuldb.com/?ctiid.318612; https://vuldb.com/?id.318612
CVE: CVE-2025-54956
Published: 2025-08-03
Description: The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request.
CVSS Score: 3.2 (LOW)
CWE: CWE-669
References: https://github.com/r-lib/gh/commit/b575d488c71318449cc6c8c989c617db29275848; https://github.com/r-lib/gh/compare/v1.4.1...v1.5.0; https://github.com/r-lib/gh/issues/222
CVE: CVE-2025-20696
Published: 2025-08-04
Description: In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2025
CVE: CVE-2025-20697
Published: 2025-08-04
Description: In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2025
CVE: CVE-2025-20698
Published: 2025-08-04
Description: In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915400; Issue ID: MSV-3793.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-bulletin/August-2025
CVE: CVE-2025-54962
Published: 2025-08-04
Description: /edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/Eyodav/OpenPLC-Insecure-File-Upload; https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992
CVE: CVE-2025-48499
Published: 2025-08-04
Description: Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU93897456/; https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0804_announce.html
CVE: CVE-2025-20700
Published: 2025-08-04
Description: In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://www.airoha.com/product-security-bulletin/2025
CVE: CVE-2025-20701
Published: 2025-08-04
Description: In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.airoha.com/product-security-bulletin/2025
CVE: CVE-2025-20702
Published: 2025-08-04
Description: In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://www.airoha.com/product-security-bulletin/2025
CVE: CVE-2025-41658
Published: 2025-08-04
Description: CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://certvde.com/de/advisories/VDE-2025-049
CVE: CVE-2025-41659
Published: 2025-08-04
Description: A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted.
CVSS Score: 8.3 (HIGH)
CWE: CWE-732
References: https://certvde.com/de/advisories/VDE-2025-051
CVE: CVE-2025-41691
Published: 2025-08-04
Description: An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://certvde.com/de/advisories/VDE-2025-070
CVE: CVE-2025-8341
Published: 2025-08-04
Description: Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints.


If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-918
References: https://github.com/grafana/grafana-infinity-datasource/releases/tag/v3.4.1; https://grafana.com/security/security-advisories/cve-2025-8341/