deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-62074
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-71-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-62075
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/simple-payment/vulnerability/wordpress-simple-payment-plugin-2-4-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-62076
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-payment/vulnerability/wordpress-simple-payment-plugin-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-62914
Published: 2025-11-06
Description: Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/effect-maker/vulnerability/wordpress-effect-maker-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-62950
Published: 2025-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/contest-gallery/vulnerability/wordpress-contest-gallery-plugin-28-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-63307
Published: 2025-11-06
Description: alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, and rename of files to HTML and SVG types and serves those files inline without adequate content-type validation or output sanitization.
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://github.com/Theethat-Thamwasin/CVE-2025-63307; https://github.com/alexusmai/laravel-file-manager; https://github.com/Theethat-Thamwasin/CVE-2025-63307/blob/main/POC-CVE-63307.md
CVE: CVE-2025-64196
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through <= 7.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-7-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64198
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Easy Social Share Buttons easy-social-share-buttons3 allows Reflected XSS.This issue affects Easy Social Share Buttons: from n/a through < 10.7.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-social-share-buttons3/vulnerability/wordpress-easy-social-share-buttons-plugin-10-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64224
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/grandconference-custom-post/vulnerability/wordpress-grand-conference-theme-custom-post-type-plugin-2-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64232
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Import from YML import-from-yml allows Reflected XSS.This issue affects Import from YML: from n/a through <= 3.1.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/import-from-yml/vulnerability/wordpress-import-from-yml-plugin-3-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64287
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/alloggio/vulnerability/wordpress-alloggio-hotel-booking-theme-theme-1-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-6325
Published: 2025-11-06
Description: Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-36-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-6327
Published: 2025-11-06
Description: Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-36-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-10885
Published: 2025-11-06
Description: A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT AUTHORITY/SYSTEM due to an insufficient validation of loaded binaries. An attacker with local and low-privilege access could exploit this to execute code as SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://emsfs.autodesk.com/utility/odis/1/installer/latest/AdODIS-installer.exe; https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0022
CVE: CVE-2025-12485
Published: 2025-11-06
Description: Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step.





This issue affects the following versions :

  *  Devolutions Server 2025.3.2.0 through 2025.3.5.0
  *  

Devolutions Server 2025.2.15.0 and earlier
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://devolutions.net/security/advisories/DEVO-2025-0016
CVE: CVE-2025-12808
Published: 2025-11-06
Description: Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure.





This issue affects the following versions :

  *  Devolutions Server 2025.3.2.0 through 2025.3.5.0
  *  

Devolutions Server 2025.2.15.0 and earlier
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://devolutions.net/security/advisories/DEVO-2025-0016
CVE: CVE-2025-59396
Published: 2025-11-06
Description: Rejected reason: Not a security vulnerability
CVE: CVE-2025-63560
Published: 2025-11-06
Description: An issue in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder Firmware v.1.20.0006 allows a remote attacker to cause a denial of service via the systemctrl API System/reFactory component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://kiloview.com; https://darrinj99.github.io/writeups/kiloview_e3.html; https://github.com/Darrinj99/Vuln-Writeups-/blob/main/CVE-2025-63560/README.md
CVE: CVE-2025-63588
Published: 2025-11-06
Description: An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/cybercrewinc/CVE-2025-63588; https://helloandrewpaul.medium.com/reflected-xss-in-login-form-email-password-fields-vvveb-cms-v1-0-7-2[PII_REDACTED]4d; https://github.com/cybercrewinc/CVE-2025-63588
CVE: CVE-2025-63589
Published: 2025-11-06
Description: A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/cmsimple-xh/cmsimple-xh/blob/master/index.php; https://github.com/cybercrewinc/CVE-2025-63589; https://github.com/cybercrewinc/CVE-2025-63589
CVE: CVE-2025-12815
Published: 2025-11-06
Description: An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. 

To mitigate this issue, users should upgrade to version 2025.09 or above.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-283
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-026/; https://github.com/aws/res/releases/tag/2025.09; https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv
CVE: CVE-2025-27916
Published: 2025-11-06
Description: An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. When the connection between two clients is established via an IP address, it is possible to manipulate the data and spoof the AnyDesk ID.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290, CWE-290
References: https://anydesk.com/en/changelog/windows; https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE: CVE-2025-27917
Published: 2025-11-06
Description: An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Remote Denial of Service can occur because of incorrect deserialization that results in failed memory allocation and a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://anydesk.com/en/changelog/windows; https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE: CVE-2025-27918
Published: 2025-11-06
Description: An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. It has an integer overflow and resultant heap-based buffer overflow via a UDP packet during processing of an Identity user image within the Discovery feature, or when establishing a connection between any two clients.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-190
References: https://anydesk.com/en/changelog/windows; https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE: CVE-2025-27919
Published: 2025-11-06
Description: An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission can manipulate remote AnyDesk settings and create a password for the Full Access profile without needing confirmation from the counterparty. Consequently, the attacker can later connect without this counterparty confirmation.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: https://anydesk.com/en/changelog/windows; https://dspace.cvut.cz/bitstream/handle/10467/122721/F8-DP-2025-Krejsa-Vojtech-DP_Krejsa_Vojtech_2025.pdf
CVE: CVE-2024-25621
Published: 2025-11-06
Description: containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
CVSS Score: 7.3 (HIGH)
CWE: CWE-279
References: https://github.com/containerd/containerd/blob/main/docs/rootless.md; https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5; https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w
CVE: CVE-2025-22397
Published: 2025-11-06
Description: Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-22
References: https://www.dell.com/support/kbdoc/en-us/000384516/dsa-2025-376-security-update-for-dell-idrac9-and-idrac10-vulnerabilities
CVE: CVE-2025-31133
Published: 2025-11-06
Description: runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.
CVSS Score: 7.8 (HIGH)
CWE: CWE-61, CWE-363
References: https://github.com/opencontainers/runc/commit/1a30a8f3d921acbbb6a4bb7e99da2c05f8d48522; https://github.com/opencontainers/runc/commit/5d7b[PII_REDACTED]872d1cd0c937f2ca25f418eb66; https://github.com/opencontainers/runc/commit/8476df83b534a2522b878c0507b3491def48db9f
CVE: CVE-2025-60541
Published: 2025-11-06
Description: A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request.
CVSS Score: 7.3 (HIGH)
CWE: CWE-918
References: https://github.com/linshenkx/prompt-optimizer; https://github.com/linshenkx/prompt-optimizer/issues/179
CVE: CVE-2025-63551
Published: 2025-11-06
Description: A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the server to initiate an HTTP request to an arbitrary internal or external network address. Successful exploitation could lead to internal network reconnaissance, port scanning, or the retrieval of sensitive information. The vulnerability may be present in the backend API called by or associated with the path `/admin/#/webset/?head_tab_active=0`, where user-provided XML data is processed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-918
References: https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection; https://github.com/sh4ll0t/SSRF-Vulnerability-in-MetInfo-via-XXE-Injection/blob/main/README.md
CVE: CVE-2022-50589
Published: 2025-11-06
Description: SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/; https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6; https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality
CVE: CVE-2022-50590
Published: 2025-11-06
Description: SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-843
References: https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-deleteattachment-type-confusion-vulnerability/; https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6; https://www.vulncheck.com/advisories/suitecrm-type-confusion-via-deleteattachment-functionality
CVE: CVE-2022-50591
Published: 2025-11-06
Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_config_id’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-306, CWE-89
References: https://blog.exodusintel.com/2022/03/01/advantech-iview-ztp_config_id-parameter-sql-injection-information-disclosure-vulnerability/; https://www.advantech.tw/support/details/firmware?id=1-HIPU-183; https://www.vulncheck.com/advisories/advantech-iview-ztpconfigid-parameter-sqli-information-disclosure
CVE: CVE-2022-50592
Published: 2025-11-06
Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘getInventoryReportData’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-306, CWE-89
References: https://blog.exodusintel.com/2022/03/01/advantech-iview-getinventoryreportdata-parameter-sql-injection-information-disclosure/; https://www.advantech.tw/support/details/firmware?id=1-HIPU-183; https://www.vulncheck.com/advisories/advantech-iview-getinventoryreportdata-parameter-sqli-rce
CVE: CVE-2022-50593
Published: 2025-11-06
Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-306, CWE-89
References: https://blog.exodusintel.com/2022/03/01/advantech-iview-search_term-parameter-sql-injection-remote-code-execution-vulnerability/; https://www.advantech.tw/support/details/firmware?id=1-HIPU-183; https://www.vulncheck.com/advisories/advantech-iview-searchterm-parameter-sqli-rce
CVE: CVE-2022-50594
Published: 2025-11-06
Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-306, CWE-89
References: https://blog.exodusintel.com/2022/03/01/advantech-iview-page_action_service-parameter-sql-injection-remote-code-execution-vulnerability/; https://www.advantech.tw/support/details/firmware?id=1-HIPU-183; https://www.vulncheck.com/advisories/advantech-iview-data-parameter-sqli-information-disclosure
CVE: CVE-2022-50595
Published: 2025-11-06
Description: Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_search_value’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-306, CWE-89
References: https://blog.exodusintel.com/2022/03/01/advantech-iview-ztp_search_value-parameter-sql-injection-remote-code-execution-vulnerability/; https://www.advantech.tw/support/details/firmware?id=1-HIPU-183; https://www.vulncheck.com/advisories/advantech-iview-ztpsearchvalue-parameter-sqli-rce
CVE: CVE-2022-50596
Published: 2025-11-06
Description: D-Link DIR-1260 Wi-Fi router firmware versions up to and including v1.20B05 contain a command injection vulnerability within the web management interface that allows for unauthenticated attackers to execute arbitrary commands on the device with root privileges. The flaw specifically exists within the SetDest/Dest/Target arguments to the GetDeviceSettings form. The management interface is accessible over HTTP and HTTPS on the local and Wi-Fi networks and optionally from the Internet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.exodusintel.com/2022/05/11/d-link-dir-1260-getdevicesettings-pre-auth-command-injection-vulnerability/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10298; https://www.vulncheck.com/advisories/dlink-dir1260-getdevicesettings-unauthenticated-command-injection
CVE: CVE-2025-12490
Published: 2025-11-06
Description: Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28085.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/pfsense/FreeBSD-ports/commit/36b2303dfca35a1183d76f26bcc6ce26d4ea682d; https://www.zerodayinitiative.com/advisories/ZDI-25-979/