deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11631
Published: 2025-10-12
Description: A vulnerability was determined in RainyGao DocSys up to 2.02.36. Affected by this vulnerability is an unknown functionality of the file /Doc/deleteDoc.do. Executing manipulation of the argument path can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md; https://vuldb.com/?ctiid.328043; https://vuldb.com/?id.328043
CVE: CVE-2025-31969
Published: 2025-10-12
Description: HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-358
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
CVE: CVE-2025-52614
Published: 2025-10-12
Description: HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability.  A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.
CVSS Score: 3.5 (LOW)
CWE: CWE-614
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
CVE: CVE-2025-52615
Published: 2025-10-12
Description: HCL Unica Platform is impacted by misconfigured security related HTTP headers.  This can lead to less secure browser default treatment for the policies controlled by these headers.
CVSS Score: 3.5 (LOW)
CWE: CWE-693
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
CVE: CVE-2025-11633
Published: 2025-10-12
Description: A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is the function upload_file_to_s3 of the file collect_logs.sh of the component HTTP Traffic Handler. The manipulation leads to improper certificate validation. The attack may be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-287, CWE-295, CWE-295
References: https://vuldb.com/?ctiid.328044; https://vuldb.com/?id.328044; https://vuldb.com/?submit.661352
CVE: CVE-2025-11634
Published: 2025-10-12
Description: A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. This affects an unknown part of the component UART Interface. The manipulation results in information disclosure. An attack on the physical device is feasible. The exploit has been released to the public and may be exploited. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-200, CWE-284
References: https://vuldb.com/?ctiid.328045; https://vuldb.com/?id.328045; https://vuldb.com/?submit.661353
CVE: CVE-2025-11635
Published: 2025-10-12
Description: A weakness has been identified in Tomofun Furbo 360 up to FB0035_FW_036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-404, CWE-400
References: https://vuldb.com/?ctiid.328046; https://vuldb.com/?id.328046; https://vuldb.com/?submit.661354
CVE: CVE-2025-2138
Published: 2025-10-12
Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 

could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security.
CVSS Score: 3.5 (LOW)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7247716
CVE: CVE-2025-2139
Published: 2025-10-12
Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security.
CVSS Score: 3.5 (LOW)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7247716
CVE: CVE-2025-2140
Published: 2025-10-12
Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source data.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-346
References: https://www.ibm.com/support/pages/node/7247716
CVE: CVE-2025-33096
Published: 2025-10-12
Description: IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled recursion.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://www.ibm.com/support/pages/node/7247716
CVE: CVE-2025-11636
Published: 2025-10-12
Description: A security vulnerability has been detected in Tomofun Furbo 360 up to FB0035_FW_036. This issue affects some unknown processing of the component Account Handler. Such manipulation leads to server-side request forgery. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-918
References: https://vuldb.com/?ctiid.328047; https://vuldb.com/?id.328047; https://vuldb.com/?submit.661361
CVE: CVE-2025-11637
Published: 2025-10-12
Description: A vulnerability was detected in Tomofun Furbo 360 up to FB0035_FW_036. Impacted is an unknown function of the component Audio Handler. Performing manipulation results in race condition. The attack is possible to be carried out remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: https://vuldb.com/?ctiid.328048; https://vuldb.com/?id.328048; https://vuldb.com/?submit.661362
CVE: CVE-2025-11638
Published: 2025-10-12
Description: A flaw has been found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Bluetooth Handler. Executing manipulation can lead to denial of service. The attacker needs to be present on the local network. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?ctiid.328049; https://vuldb.com/?id.328049; https://vuldb.com/?submit.661363
CVE: CVE-2025-11639
Published: 2025-10-12
Description: A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component Debug Log S3 Bucket Handler. The manipulation leads to insecure storage of sensitive information. An attack has to be approached locally. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-922, CWE-922
References: https://vuldb.com/?ctiid.328050; https://vuldb.com/?id.328050; https://vuldb.com/?submit.661364
CVE: CVE-2025-11640
Published: 2025-10-12
Description: A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. This affects an unknown function of the component Bluetooth Low Energy. The manipulation results in cleartext transmission of sensitive information. Access to the local network is required for this attack. Attacks of this nature are highly complex. The exploitability is reported as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-310, CWE-319, CWE-319
References: https://vuldb.com/?ctiid.328051; https://vuldb.com/?id.328051; https://vuldb.com/?submit.661374
CVE: CVE-2025-11641
Published: 2025-10-12
Description: A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. This impacts an unknown function of the component Trial Restriction Handler. This manipulation causes improper access controls. It is feasible to perform the attack on the physical device. The attack is considered to have high complexity. The exploitability is said to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.9 (LOW)
CWE: CWE-266, CWE-284
References: https://vuldb.com/?ctiid.328052; https://vuldb.com/?id.328052; https://vuldb.com/?submit.661379
CVE: CVE-2025-11642
Published: 2025-10-12
Description: A vulnerability was identified in Tomofun Furbo 360 and Furbo Mini. Affected is an unknown function of the component Registration Handler. Such manipulation leads to denial of service. The attack can be executed directly on the physical device. The attack requires a high level of complexity. The exploitability is told to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-404
References: https://vuldb.com/?ctiid.328053; https://vuldb.com/?id.328053; https://vuldb.com/?submit.661380
CVE: CVE-2025-11643
Published: 2025-10-12
Description: A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/furbo_img of the component MQTT Client Certificate. Performing manipulation results in hard-coded credentials. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.7 (LOW)
CWE: CWE-259, CWE-798
References: https://vuldb.com/?ctiid.328054; https://vuldb.com/?id.328054; https://vuldb.com/?submit.661875
CVE: CVE-2025-11644
Published: 2025-10-12
Description: A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.0 (LOW)
CWE: CWE-200, CWE-922, CWE-922
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXX.md; https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure%20Storage%20of%20Sensitve%20Information%20-%20CVE-2025-XXXXX.md; https://vuldb.com/?ctiid.328055
CVE: CVE-2025-11645
Published: 2025-10-12
Description: A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-200, CWE-922
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure.md; https://vuldb.com/?ctiid.328056; https://vuldb.com/?id.328056
CVE: CVE-2025-11646
Published: 2025-10-12
Description: A vulnerability was detected in Tomofun Furbo 360 and Furbo Mini. This vulnerability affects unknown code of the component GATT Service. The manipulation results in improper access controls. The attack can only be performed from the local network. The exploit is now public and may be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Information-Disclosure-P2PUUID.md; https://vuldb.com/?ctiid.328057; https://vuldb.com/?id.328057
CVE: CVE-2025-11647
Published: 2025-10-12
Description: A flaw has been found in Tomofun Furbo 360 and Furbo Mini. This issue affects some unknown processing of the component GATT Service. This manipulation of the argument DeviceToken causes information disclosure. The attack is only possible within the local network. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-200, CWE-284
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Information-Disclosure-DeviceToken.md; https://vuldb.com/?ctiid.328058; https://vuldb.com/?id.328058
CVE: CVE-2025-11648
Published: 2025-10-12
Description: A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. Impacted is an unknown function of the file TF_FQDN.json of the component GATT Interface URL Handler. Such manipulation leads to server-side request forgery. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-918
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/SSRF-via-BLE.md; https://vuldb.com/?ctiid.328059; https://vuldb.com/?id.328059
CVE: CVE-2025-11649
Published: 2025-10-12
Description: A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing manipulation results in use of hard-coded password. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.0 (HIGH)
CWE: CWE-255, CWE-259
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Hardcoded-Password.md; https://vuldb.com/?ctiid.328060; https://vuldb.com/?id.328060
CVE: CVE-2025-11650
Published: 2025-10-12
Description: A vulnerability was determined in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file /etc/shadow of the component Password Handler. Executing manipulation can lead to use of weak hash. The physical device can be targeted for the attack. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 1.8 (LOW)
CWE: CWE-327, CWE-328
References: https://github.com/dead1nfluence/Furbo-Advisories/blob/main/Insecure-Encryption-Algorithm.md; https://vuldb.com/?ctiid.328061; https://vuldb.com/?id.328061
CVE: CVE-2025-11651
Published: 2025-10-13
Description: A vulnerability has been found in UTT 进取 518G up to V3v3.2.7[PII_REDACTED]13. This vulnerability affects the function sub_4247AC of the file /goform/formRemoteControl. The manipulation of the argument Profile leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/13.md; https://github.com/cymiao1978/cve/blob/main/13.md#poc; https://vuldb.com/?ctiid.328068
CVE: CVE-2025-11652
Published: 2025-10-13
Description: A vulnerability was found in UTT 进取 518G up to V3v3.2.7[PII_REDACTED]13. This issue affects some unknown processing of the file /goform/formTaskEdit_ap. The manipulation of the argument txtMin2 results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/cymiao1978/cve/blob/main/14.md; https://github.com/cymiao1978/cve/blob/main/14.md#poc; https://vuldb.com/?ctiid.328069
CVE: CVE-2025-11653
Published: 2025-10-13
Description: A vulnerability was determined in UTT HiPER 2620G up to 3.1.4. Impacted is the function strcpy of the file /goform/fNTP. This manipulation of the argument NTPServerIP causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/ashin9/CVE/issues/2; https://vuldb.com/?ctiid.328070; https://vuldb.com/?id.328070
CVE: CVE-2025-11654
Published: 2025-10-13
Description: A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208. The affected element is an unknown function of the file /log.php. Such manipulation of the argument cemail/password leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/mhszed/Report/blob/main/Ecommerce-Clothing-Website%20sql.docx; https://vuldb.com/?ctiid.328071; https://vuldb.com/?id.328071
CVE: CVE-2025-36087
Published: 2025-10-13
Description: IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations, contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-798
References: https://www.ibm.com/support/pages/node/7247753
CVE: CVE-2025-11655
Published: 2025-10-13
Description: A security flaw has been discovered in Total.js Flow up to 673ef9144dd25d4f4fd4fdfda5af27f230198924. The impacted element is an unknown function of the component SVG File Handler. Performing manipulation results in unrestricted upload. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://vuldb.com/?ctiid.328072; https://vuldb.com/?id.328072; https://vuldb.com/?submit.665479
CVE: CVE-2025-11656
Published: 2025-10-13
Description: A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function of the file /assets/editNotes.php. Executing manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/qqy-123/cve/issues/1; https://vuldb.com/?ctiid.328073; https://vuldb.com/?id.328073
CVE: CVE-2025-11657
Published: 2025-10-13
Description: A security vulnerability has been detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This impacts an unknown function of the file /assets/createNotice.php. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/qqy-123/cve/issues/2; https://vuldb.com/?ctiid.328074; https://vuldb.com/?id.328074
CVE: CVE-2025-11658
Published: 2025-10-13
Description: A vulnerability was detected in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected is an unknown function of the file /assets/changeSllyabus.php. The manipulation of the argument File results in unrestricted upload. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/qqy-123/cve/issues/3; https://vuldb.com/?ctiid.328075; https://vuldb.com/?id.328075
CVE: CVE-2025-11659
Published: 2025-10-13
Description: A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/qqy-123/cve/issues/4; https://vuldb.com/?ctiid.328076; https://vuldb.com/?id.328076