deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10750
Published: 2025-10-18
Description: The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the mo_epbr_admin_observer() function hooked on 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including personal identifiable information (PII) such as displayName, mail, phones, department, or detailed OAuth error data including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observer/adminObserver.php#L265; https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/Observer/adminObserver.php#L54; https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.2.0/embed-microsoft-power-bi-reports.php#L75
CVE: CVE-2025-11256
Published: 2025-10-18
Description: The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3380313%40chatbot-chatgpt&new=3380313%40chatbot-chatgpt&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3380317%40chatbot-chatgpt&new=3380317%40chatbot-chatgpt&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8fe389-ff44-4be3-889b-0006977f4f3c?source=cve
CVE: CVE-2025-40001
Published: 2025-10-18
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

During the detaching of Marvell's SAS/SATA controller, the original code
calls cancel_delayed_work() in mvs_free() to cancel the delayed work
item mwq->work_q. However, if mwq->work_q is already running, the
cancel_delayed_work() may fail to cancel it. This can lead to
use-after-free scenarios where mvs_free() frees the mvs_info while
mvs_work_queue() is still executing and attempts to access the
already-freed mvs_info.

A typical race condition is illustrated below:

CPU 0 (remove)            | CPU 1 (delayed work callback)
mvs_pci_remove()          |
  mvs_free()              | mvs_work_queue()
    cancel_delayed_work() |
      kfree(mvi)          |
                          |   mvi-> // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the delayed work item is properly canceled and any executing
delayed work item completes before the mvs_info is deallocated.

This bug was found by static analysis.
References: https://git.kernel.org/stable/c/00d3af40b158ebf7c7db2b3bbb1598a54bf28127; https://git.kernel.org/stable/c/3c90f583d679c81a5a607a6ae0051251b6dee35b; https://git.kernel.org/stable/c/60cd16a3b7439ccb699d0bf533799eeb894fd217
CVE: CVE-2025-40002
Published: 2025-10-18
Description: In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix use-after-free in tb_dp_dprx_work

The original code relies on cancel_delayed_work() in tb_dp_dprx_stop(),
which does not ensure that the delayed work item tunnel->dprx_work has
fully completed if it was already running. This leads to use-after-free
scenarios where tb_tunnel is deallocated by tb_tunnel_put(), while
tunnel->dprx_work remains active and attempts to dereference tb_tunnel
in tb_dp_dprx_work().

A typical race condition is illustrated below:

CPU 0                            | CPU 1
tb_dp_tunnel_active()            |
  tb_deactivate_and_free_tunnel()| tb_dp_dprx_start()
    tb_tunnel_deactivate()       |   queue_delayed_work()
      tb_dp_activate()           |
        tb_dp_dprx_stop()        | tb_dp_dprx_work() //delayed worker
          cancel_delayed_work()  |
    tb_tunnel_put(tunnel);       |
                                 |   tunnel = container_of(...); //UAF
                                 |   tunnel-> //UAF

Replacing cancel_delayed_work() with cancel_delayed_work_sync() is
not feasible as it would introduce a deadlock: both tb_dp_dprx_work()
and the cleanup path acquire tb->lock, and cancel_delayed_work_sync()
would wait indefinitely for the work item that cannot proceed.

Instead, implement proper reference counting:
- If cancel_delayed_work() returns true (work is pending), we release
  the reference in the stop function.
- If it returns false (work is executing or already completed), the
  reference is released in delayed work function itself.

This ensures the tb_tunnel remains valid during work item execution
while preventing memory leaks.

This bug was found by static analysis.
References: https://git.kernel.org/stable/c/67600ccfc4f38ebd331b9332ac94717bfbc87ea7; https://git.kernel.org/stable/c/c07923f6a8729fc27ee652221a51702ff6654097
CVE: CVE-2025-5555
Published: 2025-10-18
Description: A vulnerability has been found in Nixdorf Wincor PORT IO Driver up to 1.0.0.1. This affects the function sub_11100 in the library wnport.sys of the component IOCTL Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0.1 is able to mitigate this issue. Upgrading the affected component is recommended. The vendor was contacted beforehand and was able to provide a patch very early.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://b.iakb.org/2025/06/26/Wincor-Nixdorf-PORT-IO-Driver-Buffer-Overflow/; https://download.dieboldnixdorf.com/; https://vuldb.com/?ctiid.329013
CVE: CVE-2025-9890
Published: 2025-10-18
Description: The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/theme-editor/trunk/app/controller/theme_controller.php#L87; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379404%40theme-editor&new=3379404%40theme-editor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/77189684-b794-41a0-8fc0-3320032c2f69?source=cve
CVE: CVE-2025-11926
Published: 2025-10-18
Description: The Related Posts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/prabhatverma47/Wordpress-Related-Posts-Lite-plugin-XSS-PoC?utm_source=chatgpt.com; https://plugins.trac.wordpress.org/browser/related-posts-lite/tags/1.12/; https://wordpress.org/plugins/related-posts-lite/?utm_source=chatgpt.com
CVE: CVE-2025-47410
Published: 2025-10-18
Description: Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could allow an attacker who has tricked a user into giving up their Geode session credentials to submit malicious commands on the target system on behalf of the authenticated user.


This issue affects Apache Geode: versions 1.10 through 1.15.1

Users are recommended to upgrade to version 1.15.2, which fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://lists.apache.org/thread/k88tv3rhl4ymsvt4h6qsv7sq10q5prrt; http://www.openwall.com/lists/oss-security/2025/10/17/2
CVE: CVE-2025-62672
Published: 2025-10-19
Description: rplay through 3.3.2 allows attackers to cause a denial of service (SIGSEGV and daemon crash) or possibly have unspecified other impact. This occurs in memcpy in the RPLAY_DATA case in rplay_unpack in librplay/rplay.c, potentially reachable via packet data with no authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://salsa.debian.org/alteholz/rplay; https://web.archive.org/web/[PII_REDACTED]0411/http://rplay.doit.org; https://www.openwall.com/lists/oss-security/2025/10/18/4
CVE: CVE-2025-11938
Published: 2025-10-19
Description: A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/uartu0/advisories/blob/main/churchcrm-setup-rce-2025.md; https://vuldb.com/?ctiid.329014; https://vuldb.com/?id.329014
CVE: CVE-2025-11939
Published: 2025-10-19
Description: A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://github.com/uartu0/advisories/blob/main/churchcrm-path-traversal-rce-2025.md; https://vuldb.com/?ctiid.329015; https://vuldb.com/?id.329015
CVE: CVE-2025-11940
Published: 2025-10-19
Description: A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component.
CVSS Score: 7.0 (HIGH)
CWE: CWE-426, CWE-427
References: https://codeberg.org/librewolf/bsys6/commit/dd10e31dd873e9cb309fad8aed921d45bf905a55; https://codeberg.org/librewolf/bsys6/releases/tag/144.0-1; https://github.com/Cyber-Wo0dy/report/blob/main/librewolf/143.0.4-1/librewolf_installer_exe_hijacking.md
CVE: CVE-2025-11941
Published: 2025-10-19
Description: A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://note-hxlab.wetolink.com/share/igdVbDCk2IkD; https://note-hxlab.wetolink.com/share/igdVbDCk2IkD#proof-of-concept-; https://vuldb.com/?ctiid.329020
CVE: CVE-2025-11942
Published: 2025-10-19
Description: A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-306
References: https://github.com/geo-chen/70mai/blob/main/README.md#finding-9-bypass-device-pairing-of-70mai-dashcam-omni-x200; https://vuldb.com/?ctiid.329021; https://vuldb.com/?id.329021
CVE: CVE-2025-11943
Published: 2025-10-19
Description: A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1392
References: https://github.com/geo-chen/70mai/blob/main/README.md#finding-10-exposed-root-password-via-unauthenticated-http-server; https://vuldb.com/?ctiid.329022; https://vuldb.com/?id.329022
CVE: CVE-2025-11944
Published: 2025-10-19
Description: A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/givanz/Vvveb/; https://github.com/givanz/Vvveb/commit/52204b4a106b2fb02d16eee06a88a1f2697f9b35; https://github.com/givanz/Vvveb/issues/332
CVE: CVE-2025-11945
Published: 2025-10-19
Description: A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://drive.google.com/file/d/1L6gX0GY8cE9rS6o50oJzuMRPVMerFQNS; https://vuldb.com/?ctiid.329025; https://vuldb.com/?id.329025
CVE: CVE-2025-11946
Published: 2025-10-19
Description: A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/thezeekhan/231d87163fbb84f94c9c94f13b88db90; https://gist.github.com/thezeekhan/231d87163fbb84f94c9c94f13b88db90#steps-to-reproduce; https://vuldb.com/?ctiid.329026
CVE: CVE-2025-11947
Published: 2025-10-19
Description: A weakness has been identified in bftpd up to 6.2. Impacted is the function expand_groups of the file options.c of the component Configuration File Handler. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack on the local host. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://shimo.im/docs/rp3OMVMZZXc9lvkm/; https://vuldb.com/?ctiid.329027; https://vuldb.com/?id.329027
CVE: CVE-2025-11948
Published: 2025-10-20
Description: Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-10453-43e63-2.html; https://www.twcert.org.tw/tw/cp-132-10452-72cb6-1.html; https://www.chtsecurity.com/news/3575ad9c-31f4-49de-8bc4-de85bb2eed39
CVE: CVE-2025-40004
Published: 2025-10-20
Description: In the Linux kernel, the following vulnerability has been resolved:

net/9p: Fix buffer overflow in USB transport layer

A buffer overflow vulnerability exists in the USB 9pfs transport layer
where inconsistent size validation between packet header parsing and
actual data copying allows a malicious USB host to overflow heap buffers.

The issue occurs because:
- usb9pfs_rx_header() validates only the declared size in packet header
- usb9pfs_rx_complete() uses req->actual (actual received bytes) for
memcpy

This allows an attacker to craft packets with small declared size
(bypassing validation) but large actual payload (triggering overflow
in memcpy).

Add validation in usb9pfs_rx_complete() to ensure req->actual does not
exceed the buffer capacity before copying data.
References: https://git.kernel.org/stable/c/0da18d49f874d444ad83c8a546fa33bfcf2f582c; https://git.kernel.org/stable/c/c04db81cd0288dfc68b7a0f7d09bd49b40bba451; https://git.kernel.org/stable/c/df8462f0fc045b4475dc494a5787a03c972ba2a2
CVE: CVE-2025-62577
Published: 2025-10-20
Description: ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to the management server may obtain database credentials, potentially allowing execution of OS commands with administrator privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: https://jvn.jp/en/jp/JVN44266462/; https://www.fsastech.com/ja-jp/resources/security/2025/1020.html; https://www.fujitsu.com/global/support/products/computing/storage/20251020/index.html
CVE: CVE-2025-31342
Published: 2025-10-20
Description: An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals ESP Forum Module through 1.3 version allows remote authenticated users to execute arbitrary system commands via a malicious file.
CWE: CWE-434
References: https://zuso.ai/advisory/za-2025-15
CVE: CVE-2025-57838
Published: 2025-10-20
Description: Some Honor products are affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://www.honor.com/global/security/cve-2025-57838/
CVE: CVE-2025-57839
Published: 2025-10-20
Description: Photo module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://www.honor.com/global/security/cve-2025-57839/
CVE: CVE-2025-61932
Published: 2025-10-20
Description: Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-940
References: https://jvn.jp/en/jp/JVN86318557/; https://www.motex.co.jp/news/notice/2025/release251020/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61932
CVE: CVE-2025-41028
Published: 2025-10-20
Description: A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete database via sending a POST request using the parameter ‘sEstadoUsr’ in ‘/epsilonnetws/WSAvisos.asmx’.
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-epsilon-rh
CVE: CVE-2025-57837
Published: 2025-10-20
Description: Tileservice module is affected by information leak vulnerability, successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 2.9 (LOW)
CWE: CWE-200
References: https://www.honor.com/global/security/cve-2025-57837/
CVE: CVE-2025-8349
Published: 2025-10-20
Description: Cross-site Scripting (XSS) stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed without proper sanitisation when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-tawk-live-chat
CVE: CVE-2025-56219
Published: 2025-10-20
Description: Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limiting. This can lead to a resource exhaustion and a Denial of Service (DoS) when an excessively large number of user accounts are created.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://ascertia.com; http://signinghub.com; https://github.com/saykino/CVE-2025-56219
CVE: CVE-2025-56223
Published: 2025-10-20
Description: A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Denial of Service (DoS) via uploading an excessive number of files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://ascertia.com; http://signinghub.com; https://github.com/saykino/CVE-2025-56223
CVE: CVE-2025-56224
Published: 2025-10-20
Description: A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-307
References: http://ascertia.com; http://signinghub.com; https://github.com/saykino/CVE-2025-56224
CVE: CVE-2025-61454
Published: 2025-10-20
Description: A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who visits a malicious link or submits a crafted request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tansique-17/CVE-2025-61454
CVE: CVE-2025-11677
Published: 2025-10-20
Description: Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
CWE: CWE-416
References: https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f[PII_REDACTED]43ba94875d783971a; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677
CVE: CVE-2025-11678
Published: 2025-10-20
Description: Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.
CWE: CWE-121
References: https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a; https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11678