deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-65358
Published: 2025-12-02
Description: Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/HashenUdara/edoc-doctor-appointment-system; https://github.com/omkaryepre/vulnerability-research/tree/main/CVE-2025-65358
CVE: CVE-2025-65656
Published: 2025-12-02
Description: dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://github.com/jqhph/dcat-admin; https://github.com/lznlol/operation-log/blob/main/CVE-2025-65656.md
CVE: CVE-2025-52622
Published: 2025-12-02
Description: The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1188
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127171
CVE: CVE-2025-58386
Published: 2025-12-02
Description: In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285
References: https://docs.terminalfour.com/release-notes/security-notices/cve-2025-58386/; https://terminalfour.com
CVE: CVE-2025-60854
Published: 2025-12-02
Description: A vulnerability has been found in D-Link R15 (AX1500) 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10473
CVE: CVE-2025-64750
Published: 2025-12-02
Description: SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a user relies on LSM restrictions to prevent malicious operations then, under certain circumstances, an attacker can redirect the LSM label write operation so that it is ineffective. The attacker must cause the user to run a malicious container image that redirects the mount of /proc to the destination of a shared mount, either known to be configured on the target system, or that will be specified by the user when running the container. The attacker must also control the content of the shared mount, for example through another malicious container which also binds it, or as a user with relevant permissions on the host system it is bound from. This vulnerability is fixed in SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-61, CWE-706
References: https://github.com/advisories/GHSA-fh74-hm69-rqjw; https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm; https://github.com/sylabs/singularity/commit/[PII_REDACTED]9a7af1699fd6511c3f5f1371d80f33
CVE: CVE-2025-65105
Published: 2025-12-02
Description: Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can do. The --security option has always been mentioned in Apptainer documentation as being a feature for the root user, although these forms do also work for unprivileged users on systems where the corresponding feature is enabled. Apparmor is enabled by default on Debian-based distributions and SElinux is enabled by default on RHEL-based distributions, but on SUSE it depends on the distribution version. This vulnerability is fixed in 1.4.5.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-61, CWE-706
References: https://github.com/apptainer/apptainer/commit/4313b42717e18a4add7dd7503528bc15af905981; https://github.com/apptainer/apptainer/commit/82f17900a0c31bc769bf9b4612d271c7068d8bf2; https://github.com/apptainer/apptainer/pull/3226
CVE: CVE-2025-65215
Published: 2025-12-02
Description: Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/vabnamoni/CVE-Researches/blob/main/CVE-2025-65215; https://www.linkedin.com/in/vabna-lina-24ab17186/
CVE: CVE-2025-65844
Published: 2025-12-02
Description: EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the /api/images endpoint. The endpoint is accessible without authentication by default, and server-side validation of uploaded files is insufficient. This can be abused to upload arbitrary content (including non-image files) which could impersonate user/admin login panels (exfiltrating credentials) and to perform a denial-of-service attack by exhausting disk space.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://github.com/evershopcommerce/evershop/issues/819
CVE: CVE-2025-65881
Published: 2025-12-02
Description: Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/MMAKINGDOM/17b85a6e077f08134ee96850f162ed8f; https://github.com/MMAKINGDOM/CVE-2025-65881/
CVE: CVE-2025-66399
Published: 2025-12-02
Description: Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters (including newlines) that are accepted, stored verbatim in the database, and later embedded into backend SNMP operations. In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. This vulnerability is fixed in 1.2.29.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/Cacti/cacti/security/advisories/GHSA-c7rr-2h93-7gjf
CVE: CVE-2025-13630
Published: 2025-12-02
Description: Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/456547591
CVE: CVE-2025-13631
Published: 2025-12-02
Description: Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a crafted file. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/448113221
CVE: CVE-2025-13632
Published: 2025-12-02
Description: Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: High)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-194
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/439058242
CVE: CVE-2025-13633
Published: 2025-12-02
Description: Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/458082926
CVE: CVE-2025-13634
Published: 2025-12-02
Description: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/429140219
CVE: CVE-2025-13635
Published: 2025-12-02
Description: Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/405727341
CVE: CVE-2025-13636
Published: 2025-12-02
Description: Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/446181124
CVE: CVE-2025-13637
Published: 2025-12-02
Description: Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-449
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/392375329
CVE: CVE-2025-13638
Published: 2025-12-02
Description: Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/448046109
CVE: CVE-2025-13639
Published: 2025-12-02
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)
CVSS Score: 8.1 (HIGH)
CWE: CWE-79
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/448408148
CVE: CVE-2025-13640
Published: 2025-12-02
Description: Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the device. (Chromium security severity: Low)
CVSS Score: 3.5 (LOW)
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/452071826
CVE: CVE-2025-13720
Published: 2025-12-02
Description: Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 8.8 (HIGH)
CWE: CWE-704
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/457818670
CVE: CVE-2025-13721
Published: 2025-12-02
Description: Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html; https://issues.chromium.org/issues/355120682
CVE: CVE-2025-34352
Published: 2025-12-02
Description: JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is trusted or resetting its ACLs when it already exists. A local, low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. This issue is fixed in JumpCloud Remote Assist 0.317.0 and affects Windows systems where Remote Assist is installed and managed through the Agent lifecycle.
CWE: CWE-59, CWE-378
References: https://jumpcloud.com/platform/remote-assistance; https://jumpcloud.com/support/list-of-jumpcloud-agent-release-notes; https://www.vulncheck.com/advisories/jumpcloud-remote-assist-arbitrary-file-write-delete-via-insecure-temp-directory
CVE: CVE-2025-57850
Published: 2025-12-02
Description: A container privilege escalation flaw was found in certain CodeReady Workspaces images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-276
References: https://access.redhat.com/security/cve/CVE-2025-57850; https://bugzilla.redhat.com/show_bug.cgi?id=2391103
CVE: CVE-2025-60736
Published: 2025-12-02
Description: code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/WinDyAlphA/CVE-2025-60736
CVE: CVE-2025-61729
Published: 2025-12-02
Description: Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://go.dev/cl/725920; https://go.dev/issue/76445; https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
CVE: CVE-2025-65896
Published: 2025-12-02
Description: SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/long2ice/asyncmy; https://github.com/long2ice/asyncmy/issues/134
CVE: CVE-2025-66409
Published: 2025-12-02
Description: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, when AVRCP is enabled on ESP32, receiving a malformed VENDOR DEPENDENT command from a peer device can cause the Bluetooth stack to access memory before validating the command buffer length. This may lead to an out-of-bounds read, potentially exposing unintended memory content or causing unexpected behavior.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/espressif/esp-idf/commit/075ed218cadb[PII_REDACTED]cd8a795d8a626519fb; https://github.com/espressif/esp-idf/commit/2f788e59ee361eee230879ae2ec9cf5c893fe372; https://github.com/espressif/esp-idf/commit/798029129a71c802cff0e75eb59f902bca8f1946
CVE: CVE-2025-66414
Published: 2025-12-02
Description: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.24.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1188
References: https://github.com/modelcontextprotocol/typescript-sdk/commit/09623e2aa5044f9e9da62c73d820a8250b9d97ed; https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w
CVE: CVE-2025-66416
Published: 2025-12-02
Description: The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1188
References: https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99; https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
CVE: CVE-2025-66454
Published: 2025-12-02
Description: Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This grants remote access to all worker endpoints—including tool enumeration and tool invocation—without credentials. This vulnerability is fixed in 1.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-321, CWE-798
References: https://github.com/ArcadeAI/arcade-mcp/commit/44660d18ceb[PII_REDACTED]03df860a31ca766c817; https://github.com/ArcadeAI/arcade-mcp/pull/691; https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438
CVE: CVE-2025-66458
Published: 2025-12-02
Description: Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Lookyloo/lookyloo/commit/b6ee2fee0afff0b35f37dd891bbce9d53ed8a290; https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-58h2-652v-gq87
CVE: CVE-2025-66459
Published: 2025-12-02
Description: Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Lookyloo/lookyloo/commit/1850a34b8cec52438df3b544295b20cfa35f8ad1; https://github.com/Lookyloo/lookyloo/commit/8c3ab96de44c1ce15646d734aa06faf884329116; https://github.com/Lookyloo/lookyloo/commit/95cdc00fe37fd89790fa89bb3ee3fefa2da38442
CVE: CVE-2025-66460
Published: 2025-12-02
Description: Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Lookyloo/lookyloo/commit/63b39311f6b251a671895d97174345faf1b18e6e; https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-r93r-7jfr-99c3
CVE: CVE-2025-66468
Published: 2025-12-02
Description: The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042; https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg
CVE: CVE-2025-13510
Published: 2025-12-02
Description: The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings.
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-336-02
CVE: CVE-2025-13542
Published: 2025-12-02
Description: The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/egrad-education-wordpress-theme/42803015; https://www.wordfence.com/threat-intel/vulnerabilities/id/c880470f-3f81-47a2-b[PII_REDACTED]e9f43?source=cve
CVE: CVE-2025-13658
Published: 2025-12-02
Description: A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and execution controls. Exploitation results in SYSTEM-level privileges.
CWE: CWE-94
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-336-01