deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10548
Published: 2025-09-23
Description: The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are executed with SYSTEM privileges. This can lead to full remote code execution with administrative rights. No patch is available as the vendor has been unresponsive. It is assumed that previous versions are also affected, but this is not confirmed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://r.sec-consult.com/clevercontrol; http://seclists.org/fulldisclosure/2025/Sep/71
CVE: CVE-2025-10844
Published: 2025-09-23
Description: A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://karinagante.github.io/cve-2025-10844/; https://karinagante.github.io/cve-2025-10844/#proof-of-concept-poc; https://vuldb.com/?ctiid.325206
CVE: CVE-2025-10845
Published: 2025-09-23
Description: A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://karinagante.github.io/cve-2025-10845/; https://karinagante.github.io/cve-2025-10845/#proof-of-concept-poc; https://vuldb.com/?ctiid.325207
CVE: CVE-2025-10846
Published: 2025-09-23
Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://karinagante.github.io/cve-2025-10846/; https://karinagante.github.io/cve-2025-10846/#proof-of-concept-poc; https://vuldb.com/?ctiid.325208
CVE: CVE-2025-10848
Published: 2025-09-23
Description: A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.php. Such manipulation of the argument student_id leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.325209; https://vuldb.com/?id.325209; https://vuldb.com/?submit.657937
CVE: CVE-2025-10851
Published: 2025-09-23
Description: A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.325210; https://vuldb.com/?id.325210; https://vuldb.com/?submit.657939
CVE: CVE-2025-9588
Published: 2025-09-23
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection.This issue affects enVision: before 250563.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: https://www.usom.gov.tr/bildirim/tr-25-0285
CVE: CVE-2025-10147
Published: 2025-09-23
Description: The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/podlove-podcasting-plugin-for-wordpress/tags/4.2.6/lib/model/image.php#L465; https://plugins.trac.wordpress.org/changeset/3364994/; https://www.wordfence.com/threat-intel/vulnerabilities/id/093058f1-c717-424f-9bd5-4838df8d20a1?source=cve
CVE: CVE-2025-10857
Published: 2025-09-23
Description: A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.325228; https://vuldb.com/?id.325228; https://vuldb.com/?submit.657940
CVE: CVE-2025-9798
Published: 2025-09-23
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows Stored XSS.This issue affects Netigma: from 6.3.3 before 6.3.5 V8.
CVSS Score: 8.9 (HIGH)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0286
CVE: CVE-2025-10412
Published: 2025-09-23
Description: The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function in all versions up to, and including, 4.9.55. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://moomoo.agency/cpo; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0c6a45-2c4a-4a23-84e6-7a[PII_REDACTED]?source=cve
CVE: CVE-2025-7106
Published: 2025-09-23
Description: danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having `CREATE: false` permission, as the check for `['USE', 'CREATE']` passes with just `USE: true`. This vulnerability affects other permission checks as well, such as `PROMPTS`. The issue is present in all versions prior to the fix.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-639
References: https://github.com/danny-avila/librechat/commit/91a2df47599c09d80886bfc28e0ccf1debd42110; https://huntr.com/bounties/7de2765b-d1fe-4495-9[PII_REDACTED]57c48
CVE: CVE-2025-9342
Published: 2025-09-23
Description: Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse.This issue affects AHE Mobile: from 1.9.7 before 1.9.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0287
CVE: CVE-2024-4598
Published: 2025-09-23
Description: An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions.

This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1259
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3355/
CVE: CVE-2025-9962
Published: 2025-09-23
Description: A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build
                      2026.02.06 (commit d0f97fd9).
CWE: CWE-120
References: https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/; https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf; https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products
CVE: CVE-2025-10244
Published: 2025-09-23
Description: A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg; https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0020
CVE: CVE-2025-9963
Published: 2025-09-23
Description: A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. This way the system can also be compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build
                      2026.02.06 (commit d0f97fd9).
CWE: CWE-22
References: https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/; https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf; https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products
CVE: CVE-2025-9964
Published: 2025-09-23
Description: No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. 
This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build
                      2026.02.06 (commit d0f97fd9).
CWE: CWE-521
References: https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/; https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf; https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products
CVE: CVE-2025-9965
Published: 2025-09-23
Description: Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build
                      2026.02.06 (commit d0f97fd9).
CWE: CWE-287
References: https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/; https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf; https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products
CVE: CVE-2025-9966
Published: 2025-09-23
Description: Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build
                      2026.02.06 (commit d0f97fd9).
CWE: CWE-269
References: https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/; https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf; https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products
CVE: CVE-2025-10184
Published: 2025-09-23
Description: The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. 

The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
CWE: CWE-89, CWE-862
References: https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/bltd4b7439a28b6c866/68d168a6930d015d43a6b588/CVE-2025-10184_PoC.zip; https://www.rapid7.com/blog/post/cve-2025-10184-oneplus-oxygenos-telephony-provider-permission-bypass-not-fixed/; https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/bltd4b7439a28b6c866/68d168a6930d015d43a6b588/CVE-2025-10184_PoC.zip
CVE: CVE-2025-9846
Published: 2025-09-23
Description: Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection.This issue affects Inka.Net: before 6.7.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://www.usom.gov.tr/bildirim/tr-25-0288
CVE: CVE-2017-20200
Published: 2025-09-23
Description: A vulnerability has been found in Coinomi up to 1.7.6. This issue affects some unknown processing. Such manipulation leads to cleartext transmission of sensitive information. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The vendor replied with: "(...) there isn't any security implication associated with your findings."
CVSS Score: 3.7 (LOW)
CWE: CWE-310, CWE-319
References: https://vuldb.com/?ctiid.325143; https://vuldb.com/?id.325143; https://vuldb.com/?submit.653875
CVE: CVE-2025-6921
Published: 2025-09-23
Description: The huggingface/transformers library, versions prior to 4.53.0, is vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer. The vulnerability arises from the _do_use_weight_decay method, which processes user-controlled regular expressions in the include_in_weight_decay and exclude_from_weight_decay lists. Malicious regular expressions can cause catastrophic backtracking during the re.search call, leading to 100% CPU utilization and a denial of service. This issue can be exploited by attackers who can control the patterns in these lists, potentially causing the machine learning task to hang and rendering services unresponsive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be; https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f
CVE: CVE-2025-8354
Published: 2025-09-23
Description: A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Type Confusion vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://www.autodesk.com/products/autodesk-access/overview; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0021
CVE: CVE-2025-9844
Published: 2025-09-23
Description: Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427
References: https://help.salesforce.com/s/articleView?id=005224301&type=1
CVE: CVE-2025-4760
Published: 2025-09-23
Description: An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.

A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/
CVE: CVE-2025-57407
Published: 2025-09-23
Description: A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gp247net/core/releases/tag/1.1.24; https://github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php
CVE: CVE-2025-5717
Published: 2025-09-23
Description: An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.

Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/
CVE: CVE-2024-6429
Published: 2025-09-23
Description: A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.

By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/
CVE: CVE-2025-0663
Published: 2025-09-23
Description: A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. A single cryptographic key is used across all tenants to sign authentication cookies, allowing a privileged user in one tenant to forge authentication cookies for users in other tenants.

Because the Auto-Login feature is enabled by default, this flaw may allow an attacker to gain unauthorized access and potentially take over accounts in other tenants. Successful exploitation requires access to Adaptive Authentication functionality, which is typically restricted to high-privileged users. The vulnerability is only exploitable when Auto-Login is enabled, reducing its practical impact in deployments where the feature is disabled.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3864/
CVE: CVE-2025-56304
Published: 2025-09-23
Description: Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://yzmcms.com; https://gitee.com/cyjsyj/cve/wikis/CVE-2025-56304?sort_id=14635721; https://www.yzmcms.com/
CVE: CVE-2025-9900
Published: 2025-09-23
Description: A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.

By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-123
References: https://access.redhat.com/errata/RHSA-2025:17651; https://access.redhat.com/errata/RHSA-2025:17675; https://access.redhat.com/errata/RHSA-2025:17710
CVE: CVE-2025-0209
Published: 2025-09-23
Description: A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. A malicious actor can exploit this vulnerability by injecting a crafted payload that is reflected in the server response, enabling the execution of arbitrary JavaScript in the victim's browser.

This vulnerability could allow attackers to redirect users to malicious websites, modify the user interface, or exfiltrate data from the browser. However, session-related sensitive cookies are protected using the httpOnly flag, which mitigates the risk of session hijacking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3902/
CVE: CVE-2025-0672
Published: 2025-09-23
Description: An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may associate the new account with the previously registered FIDO device.

This flaw may allow a previously deleted user to authenticate using their FIDO credentials and impersonate the newly created user, resulting in unauthorized access. The vulnerability applies only to deployments that utilize FIDO-based authentication.
CVSS Score: 3.3 (LOW)
CWE: CWE-287
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3134/
CVE: CVE-2025-1255
Published: 2025-09-23
Description: Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.2.0 before 7.3.0.9.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-822
References: https://www.rti.com/vulnerabilities/#cve-2025-1255
CVE: CVE-2025-29083
Published: 2025-09-23
Description: SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Plugin_Manager.php file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://github.com/fax77829yz/CSZ_CMS-exploit/blob/main/README.md#cve2
CVE: CVE-2025-29084
Published: 2025-09-23
Description: SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrade.php file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/fax77829yz/CSZ_CMS-exploit/blob/main/README.md#cve1
CVE: CVE-2025-4582
Published: 2025-09-23
Description: Buffer Over-read, Off-by-one Error vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation, Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.8, from 6.1.0 before 6.1.2.26, from 6.0.0 before 6.0.1.43, from 5.3.0 before 5.3.*, from 4.4a before 5.2.*.
CVSS Score: 7.1 (HIGH)
CWE: CWE-126, CWE-193
References: https://www.rti.com/vulnerabilities/#cve-2025-4582