deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10405
Published: 2025-09-14
Description: A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Affected is an unknown function of the file /listbaptism.php. This manipulation of the argument bapt_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/peri0d/my_cve/issues/4; https://itsourcecode.com/; https://vuldb.com/?ctiid.323840
CVE: CVE-2025-10407
Published: 2025-09-14
Description: A vulnerability was identified in SourceCodester Student Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_user.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/3; https://vuldb.com/?ctiid.323841; https://vuldb.com/?id.323841
CVE: CVE-2025-10408
Published: 2025-09-14
Description: A security flaw has been discovered in SourceCodester Student Grading System 1.0. Affected by this issue is some unknown functionality of the file /edit_user.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/4; https://vuldb.com/?ctiid.323842; https://vuldb.com/?id.323842
CVE: CVE-2025-10409
Published: 2025-09-14
Description: A weakness has been identified in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /rms.php?page=users. Executing manipulation of the argument fname can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/5; https://vuldb.com/?ctiid.323843; https://vuldb.com/?id.323843
CVE: CVE-2025-10410
Published: 2025-09-14
Description: A security vulnerability has been detected in SourceCodester Link Status Checker 1.0. This vulnerability affects unknown code of the file index.php. The manipulation of the argument proxy leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/drew-byte/Link_Status_Checker_PoC; https://vuldb.com/?ctiid.323844; https://vuldb.com/?id.323844
CVE: CVE-2025-10411
Published: 2025-09-14
Description: A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /stc-log-keeper/check_profile.php of the component POST Request Handler. The manipulation of the argument profile_id results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/yihaofuweng/cve/issues/21; https://itsourcecode.com/; https://vuldb.com/?ctiid.323845
CVE: CVE-2025-10413
Published: 2025-09-14
Description: A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_customer. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/82; https://vuldb.com/?ctiid.323847; https://vuldb.com/?id.323847
CVE: CVE-2025-10414
Published: 2025-09-14
Description: A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. The impacted element is an unknown function of the file /ajax.php?action=save_customer. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/81; https://vuldb.com/?ctiid.323848; https://vuldb.com/?id.323848
CVE: CVE-2025-10415
Published: 2025-09-14
Description: A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=save_supplier. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/80; https://vuldb.com/?ctiid.323849; https://vuldb.com/?id.323849
CVE: CVE-2025-59364
Published: 2025-09-14
Description: The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/sanitize.js for a JSON request body.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-674
References: https://gist.github.com/Spendroslav/177804eaef5acfb222a550de212a1b94; https://github.com/AhmedAdelFahim/express-xss-sanitizer; https://www.npmjs.com/package/express-xss-sanitizer
CVE: CVE-2025-10416
Published: 2025-09-15
Description: A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_supplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/79; https://vuldb.com/?ctiid.323850; https://vuldb.com/?id.323850
CVE: CVE-2025-10417
Published: 2025-09-15
Description: A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=delete_product. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/78; https://vuldb.com/?ctiid.323851; https://vuldb.com/?id.323851
CVE: CVE-2025-10418
Published: 2025-09-15
Description: A weakness has been identified in SourceCodester Student Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_students.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/6; https://vuldb.com/?ctiid.323852; https://vuldb.com/?id.323852
CVE: CVE-2025-10419
Published: 2025-09-15
Description: A security vulnerability has been detected in SourceCodester Student Grading System 1.0. Affected by this issue is some unknown functionality of the file /del_promote.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/7; https://vuldb.com/?ctiid.323853; https://vuldb.com/?id.323853
CVE: CVE-2025-10420
Published: 2025-09-15
Description: A vulnerability was detected in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /form137.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/8; https://vuldb.com/?ctiid.323854; https://vuldb.com/?id.323854
CVE: CVE-2025-10421
Published: 2025-09-15
Description: A flaw has been found in SourceCodester Student Grading System 1.0. This vulnerability affects unknown code of the file /update_account.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qcycop0101-hash/CVE/issues/9; https://vuldb.com/?ctiid.323855; https://vuldb.com/?id.323855
CVE: CVE-2025-10422
Published: 2025-09-15
Description: A vulnerability has been found in newbee-mall up to 613a662adf1da7623ec34459bc83e3c1b12d8ce7. This issue affects the function paySuccess of the file /paySuccess of the component Order Status Handler. The manipulation of the argument orderNo leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://github.com/newbee-ltd/newbee-mall/issues/100; https://github.com/newbee-ltd/newbee-mall/issues/100#issue[PII_REDACTED]; https://vuldb.com/?ctiid.323856
CVE: CVE-2025-10452
Published: 2025-09-15
Description: Statistical Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents with high-level privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.twcert.org.tw/en/cp-139-10380-1ce73-2.html; https://www.twcert.org.tw/tw/cp-132-10379-70d40-1.html
CVE: CVE-2025-59375
Published: 2025-09-15
Description: libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74; https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes; https://github.com/libexpat/libexpat/issues/1018
CVE: CVE-2025-10423
Published: 2025-09-15
Description: A vulnerability was found in newbee-mall 1.0. Impacted is the function mallKaptcha of the file /common/mall/kaptcha. The manipulation results in guessable captcha. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-287, CWE-804
References: https://github.com/newbee-ltd/newbee-mall/issues/101; https://github.com/newbee-ltd/newbee-mall/issues/101#issue[PII_REDACTED]; https://vuldb.com/?ctiid.323857
CVE: CVE-2025-10424
Published: 2025-09-15
Description: A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/faculty_controller.php. This manipulation of the argument new_image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/lan041221/cvec/issues/22; https://vuldb.com/?ctiid.323858; https://vuldb.com/?id.323858
CVE: CVE-2025-10425
Published: 2025-09-15
Description: A vulnerability was identified in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The impacted element is an unknown function of the file /admin/controller/student_controller.php. Such manipulation of the argument new_image leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/lan041221/cvec/issues/23; https://vuldb.com/?ctiid.323859; https://vuldb.com/?id.323859
CVE: CVE-2025-10426
Published: 2025-09-15
Description: A security flaw has been discovered in itsourcecode Online Laundry Management System 1.0. This affects an unknown function of the file /login.php. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/HAO-RAY/HCR-CVE/issues/3; https://itsourcecode.com/; https://vuldb.com/?ctiid.323860
CVE: CVE-2025-10427
Published: 2025-09-15
Description: A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php. Executing manipulation of the argument website_image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/joinia/webray.com.cn/blob/main/Pet-grooming-management-software/petgrooming-upload-user.md; https://vuldb.com/?ctiid.323861; https://vuldb.com/?id.323861
CVE: CVE-2025-10428
Published: 2025-09-15
Description: A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/seo_setting.php of the component Setting Handler. The manipulation of the argument website_image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/joinia/webray.com.cn/blob/main/Pet-grooming-management-software/petgrooming-upload-seosetting.md; https://vuldb.com/?ctiid.323862; https://vuldb.com/?id.323862
CVE: CVE-2025-10429
Published: 2025-09-15
Description: A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_product.php. The manipulation of the argument drop_services results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Pet-grooming-management-software/petgrooming-sql-ajaxpro.md; https://vuldb.com/?ctiid.323863; https://vuldb.com/?id.323863
CVE: CVE-2025-10453
Published: 2025-09-15
Description: O'View MapServer developed by PilotGaea Technologies has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://www.twcert.org.tw/en/cp-139-10382-781cc-2.html; https://www.twcert.org.tw/tw/cp-132-10381-4d482-1.html
CVE: CVE-2025-59378
Published: 2025-09-15
Description: In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-669
References: https://codeberg.org/guix/guix/commit/1618ca7aa2ee8b6519ee9fd0b965e15eca2bfe45; https://guix.gnu.org/en/blog/2025/privilege-escalation-vulnerability-2025-2/
CVE: CVE-2025-10430
Published: 2025-09-15
Description: A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/barcode.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Pet-grooming-management-software/petgrooming-sql-barcode.md; https://vuldb.com/?ctiid.323864; https://vuldb.com/?id.323864
CVE: CVE-2025-10431
Published: 2025-09-15
Description: A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/ajax_represent.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/joinia/webray.com.cn/blob/main/Pet-grooming-management-software/petgrooming-sql-ajaxrepresent.md; https://vuldb.com/?ctiid.323865; https://vuldb.com/?id.323865
CVE: CVE-2025-10432
Published: 2025-09-15
Description: A vulnerability was found in Tenda AC1206 15.03.06.23. This vulnerability affects the function check_param_changed of the file /goform/AdvSetMacMtuWa of the component HTTP Request Handler. Performing manipulation of the argument wanMTU results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-121
References: https://github.com/M4st3rYi/IoTVulPocs/blob/main/Tenda/AC1206/fromAdvSetMacMtuWan.md; https://vuldb.com/?ctiid.323866; https://vuldb.com/?id.323866
CVE: CVE-2025-10433
Published: 2025-09-15
Description: A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/debug. Executing manipulation of the argument code can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.1 is capable of addressing this issue. It is suggested to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502
References: https://github.com/1Panel-dev/MaxKB/releases/tag/v2.1.1; https://vuldb.com/?ctiid.323867; https://vuldb.com/?id.323867
CVE: CVE-2025-41713
Published: 2025-09-15
Description: During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1188
References: https://certvde.com/en/advisories/VDE-2025-083; https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-083.json
CVE: CVE-2025-10434
Published: 2025-09-15
Description: A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Upgradeextension/ibuyu/blob/main/README.md; https://vuldb.com/?ctiid.323868; https://vuldb.com/?id.323868
CVE: CVE-2025-10435
Published: 2025-09-15
Description: A security flaw has been discovered in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ldz23/cve/issues/1; https://vuldb.com/?ctiid.323869; https://vuldb.com/?id.323869
CVE: CVE-2025-10436
Published: 2025-09-15
Description: A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/sup_searchfrm.php?action=edit. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/ldz23/cve/issues/2; https://vuldb.com/?ctiid.323870; https://vuldb.com/?id.323870
CVE: CVE-2025-10440
Published: 2025-09-15
Description: A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link/D-Link_CJ_1.md; https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link/D-Link_CJ_1.md#exp; https://vuldb.com/?ctiid.323874
CVE: CVE-2025-9076
Published: 2025-09-15
Description: Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://mattermost.com/security-updates
CVE: CVE-2025-9078
Published: 2025-09-15
Description: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-328
References: https://mattermost.com/security-updates
CVE: CVE-2025-10441
Published: 2025-09-15
Description: A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link/D-Link_CJ_2.md; https://github.com/[PII_REDACTED]/mycve/blob/main/D-Link/D-Link_CJ_2.md#poc; https://vuldb.com/?ctiid.323875
CVE: CVE-2025-10442
Published: 2025-09-15
Description: A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/Tenda_AC9_CJ.md; https://github.com/[PII_REDACTED]/mycve/blob/main/Tenda/Tenda_AC9_CJ.md#poc; https://vuldb.com/?ctiid.323876
CVE: CVE-2025-9072
Published: 2025-09-15
Description: Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL.
CVSS Score: 7.6 (HIGH)
CWE: CWE-601
References: https://mattermost.com/security-updates
CVE: CVE-2025-9084
Published: 2025-09-15
Description: Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth login URLs
CVSS Score: 3.1 (LOW)
CWE: CWE-601
References: https://mattermost.com/security-updates
CVE: CVE-2025-9826
Published: 2025-09-15
Description: Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://empower.m-files.com/security-advisories/CVE-2025-9826; https://product.m-files.com/security-advisories/cve-2025-9826/