deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53019
Published: 2025-07-14
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
CVSS Score: 3.7 (LOW)
CWE: CWE-125, CWE-401
References: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc; https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-cfh4-9f7v-fhrc
CVE: CVE-2025-53101
Published: 2025-07-14
Description: ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue.
CVSS Score: 7.4 (HIGH)
CWE: CWE-124
References: https://github.com/ImageMagick/ImageMagick/commit/66dc8f51c11b0ae1f1cdeacd381c3e9a4de69774; https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh3h-j545-h8c9; https://lists.debian.org/debian-lts-announce/2025/09/msg00012.html
CVE: CVE-2025-53623
Published: 2025-07-14
Description: The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the `CsvEnumerator` class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data leakage, or complete system compromise. The issue is fixed in versions `1.11.0` and above. Users can mitigate the risk by avoiding the use of untrusted input in the `CsvEnumerator` class and ensuring that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid using the `count_of_rows_in_file` method with untrusted CSV filenames.
CWE: CWE-78
References: https://github.com/Shopify/job-iteration/commit/1a7adfdd041105a5e45e774cadc6b973a292ba55; https://github.com/Shopify/job-iteration/pull/595; https://github.com/Shopify/job-iteration/releases/tag/v1.11.0
CVE: CVE-2025-53639
Published: 2025-07-14
Description: MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/metersphere/metersphere/security/advisories/GHSA-vcm3-5w3f-9f45
CVE: CVE-2025-53640
Published: 2025-07-14
Description: Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-639, CWE-862, CWE-639
References: https://docs.getindico.io/en/stable/config/settings/#ALLOW_PUBLIC_USER_SEARCH; https://docs.getindico.io/en/stable/installation/upgrade; https://github.com/indico/indico/releases/tag/v3.3.7
CVE: CVE-2025-53643
Published: 2025-07-14
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a; https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
CVE: CVE-2025-53818
Published: 2025-07-14
Description: GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vulnerable API if concatenated with untrusted user input. As of time of publication, no known patches are available.
CWE: CWE-78
References: https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/main/src/handlers/comment-handlers.ts#L8; https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/main/src/handlers/tool-handlers.ts#L79; https://github.com/Sunwood-ai-labs/github-kanban-mcp-server/blob/v0.4.0/src/handlers/comment-handlers.ts#L8-L23
CVE: CVE-2025-53819
Published: 2025-07-14
Description: Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available.
CVSS Score: 7.9 (HIGH)
CWE: CWE-271
References: https://github.com/NixOS/nix/commit/e2ef2cfcbc83ea01308ee64c38a58707ab23dec3; https://github.com/NixOS/nix/pull/13281; https://github.com/NixOS/nix/pull/13455
CVE: CVE-2025-53820
Published: 2025-07-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `index.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `erro` parameter. Version 3.4.5 contains a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rrm-92jv-xwcv; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rrm-92jv-xwcv
CVE: CVE-2025-53821
Published: 2025-07-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arbitrary URL via the `nextPage` parameter, leading to an uncontrolled redirection. Version 3.4.5 contains a fix for the issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f5c2-jmm6-v2c5; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f5c2-jmm6-v2c5
CVE: CVE-2025-53822
Published: 2025-07-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `relatorio_geracao.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `tipo_relatorio` parameter. Version 3.4.5 has a patch for the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f5xr-4g63-pc9r; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-f5xr-4g63-pc9r
CVE: CVE-2025-53823
Published: 2025-07-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Versions prior to 3.4.5 have a SQL Injection vulnerability in the endpoint `/WeGIA/html/socio/sistema/processa_deletar_socio.php`, in the `id_socio` parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.4.5 fixes the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-p8xr-qg3c-6ww2; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-p8xr-qg3c-6ww2
CVE: CVE-2025-53824
Published: 2025-07-14
Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the editar_permissoes.php endpoint of the WeGIA application prior to version 3.4.4. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. Version 3.4.4 fixes the issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-86r7-gc8h-63gh; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-86r7-gc8h-63gh
CVE: CVE-2025-53825
Published: 2025-07-14
Description: Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This exposes secrets and potentially enables remote code execution, putting all public Dokploy users using these preview deployments at risk. Version 0.24.3 contains a fix for the issue.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-862
References: https://github.com/Dokploy/dokploy/commit/1977235d313824b9764f1a06785fb7f73ab7eba2; https://github.com/Dokploy/dokploy/security/advisories/GHSA-h67g-mpq5-6ph5; https://github.com/Dokploy/dokploy/security/advisories/GHSA-h67g-mpq5-6ph5
CVE: CVE-2025-53833
Published: 2025-07-14
Description: LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations. Attackers could execute arbitrary commands on the server, access sensitive environment variables, and/or escalate access depending on server configuration. Users are strongly advised to upgrade to version v2.8.1 or later to receive a patch.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-1336
References: https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b; https://github.com/saleem-hadad/larecipe/pull/390; https://github.com/saleem-hadad/larecipe/security/advisories/GHSA-jv7x-xhv2-p5v2
CVE: CVE-2025-53834
Published: 2025-07-14
Description: Caido is a web security auditing toolkit. A reflected cross-site scripting (XSS) vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match&Replace and Scope. This could allow an attacker to craft input that results in arbitrary script execution. Version 0.49.0 fixes the issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/caido/caido/releases/tag/v0.49.0; https://github.com/caido/caido/security/advisories/GHSA-h8jr-c6qq-h7m7
CVE: CVE-2025-53835
Published: 2025-07-14
Description: XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 5.4.5 and prior to version 14.10, the XHTML syntax depended on the `xdom+xml/current` syntax which allows the creation of raw blocks that permit the insertion of arbitrary HTML content including JavaScript. This allows XSS attacks for users who can edit a document like their user profile (enabled by default). This has been fixed in version 14.10 by removing the dependency on the `xdom+xml/current` syntax from the XHTML syntax. Note that the `xdom+xml` syntax is still vulnerable to this attack. As it's main purpose is testing and its use is quite difficult, this syntax shouldn't be installed or used on a regular wiki. There are no known workarounds apart from upgrading.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-80
References: https://github.com/xwiki/xwiki-rendering/commit/a4ca31f99f524b9456c64150d6f375984aa81ea7; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-w3wh-g4m9-783p; https://jira.xwiki.org/browse/XRENDERING-660
CVE: CVE-2025-53836
Published: 2025-07-15
Description: XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWiki use the vulnerable feature. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. To avoid the exploitation of this bug, comments can be disabled for untrusted users until an upgrade to a patched version has been performed. Note that users with edit rights will still be able to add comments via the object editor even if comments have been disabled.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94, CWE-863
References: https://github.com/xwiki/xwiki-rendering/commit/c73fa3ccd4ac59057e48e5d4325f659e78e8f86d; https://github.com/xwiki/xwiki-rendering/security/advisories/GHSA-32mf-57h2-64x9; https://jira.xwiki.org/browse/XRENDERING-689
CVE: CVE-2025-53839
Published: 2025-07-15
Description: DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRACOON Branding Service prior to 2.10.0 are vulnerable to cross-site scripting. Improper neutralization of input from administrative users could inject HTML code into the workflow for newly onboarded users. A fix was made available in version 2.10.0 and rolled out to the DRACOON service. DRACOON customers do not need to take action.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-79
References: https://github.com/dracoon/security-advisories/security/advisories/GHSA-jv2h-8mw7-mc97
CVE: CVE-2025-53885
Published: 2025-07-15
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template string. Malicious admins can log sensitive data from other users when they are created or updated. Version 11.9.0 contains a fix for the issue. As a workaround, avoid logging sensitive data to the console outside the context of development.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-532
References: https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5; https://github.com/directus/directus/pull/25355; https://github.com/directus/directus/releases/tag/v11.9.0
CVE: CVE-2025-53886
Published: 2025-07-15
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-200, CWE-212, CWE-532
References: https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb; https://github.com/directus/directus/pull/25354; https://github.com/directus/directus/releases/tag/v11.9.0
CVE: CVE-2025-53887
Published: 2025-07-15
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, the exact Directus version number is incorrectly being used as OpenAPI Spec version this means that it is being exposed by the `/server/specs/oas` endpoint without authentication. With the exact version information a malicious attacker can look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. Version 11.9.0 fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/directus/directus/commit/e74f3e4e92edc33b5f83eefb001a3d2a85af17a3; https://github.com/directus/directus/pull/25353; https://github.com/directus/directus/releases/tag/v11.9.0
CVE: CVE-2025-53889
Published: 2025-07-15
Description: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items provided as payload to the Flow. Depending on what the Flow is set up to do this can lead to the Flow executing potential tasks on the attacker's behalf without authenticating. Bad actors could execute the manual trigger Flows without authentication, or access rights to the said collection(s) or item(s). Users with manual trigger Flows configured are impacted as these endpoints do not currently validate if the user has read access to `directus_flows` or to the relevant collection/items. The manual trigger Flows should have tighter security requirements as compared to webhook Flows where users are expected to perform do their own checks. Version 11.9.0 fixes the issue. As a workaround, implement permission checks for read access to Flows and read access to relevant collection/items.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://github.com/directus/directus/commit/22be460c76957708d67fdd52846a9ad1cbb083fb; https://github.com/directus/directus/releases/tag/v11.9.0; https://github.com/directus/directus/security/advisories/GHSA-7cvf-pxgp-42fc
CVE: CVE-2025-53890
Published: 2025-07-15
Description: pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unauthenticated remote attackers to execute arbitrary code in the client browser and potentially the backend server. Exploitation requires no user interaction or authentication and can result in session hijacking, credential theft, and full system remote code execution. Commit 909e5c[PII_REDACTED]0d1264cfceb5555870eb9546, the patch for the issue, is included in version 0.5.0b3.dev89.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/pyload/pyload/commit/909e5c[PII_REDACTED]0d1264cfceb5555870eb9546; https://github.com/pyload/pyload/pull/4586; https://github.com/pyload/pyload/security/advisories/GHSA-8w3f-4r8f-pf53
CVE: CVE-2025-53891
Published: 2025-07-15
Description: The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploaded files (instruction/message media) are not strictly validated for type and size. A user may upload renamed or oversized files that can disrupt performance or bypass restrictions. This could result in malicious file upload, denial of service, or client-side crashes. Version 1.0.5 contains a fix for the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/TimeLineOfficial/Time-Line-/security/advisories/GHSA-rvxq-q975-8vv2
CVE: CVE-2025-6265
Published: 2025-07-15
Description: A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated attacker with administrator privileges to access specific directories and delete files, such as the configuration file, on the affected device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-path-traversal-vulnerability-in-aps-07-15-2025
CVE: CVE-2025-5393
Published: 2025-07-15
Description: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This was partially patched in 7.8.5 and has been fully addresses in 7.8.7.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-73
References: https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939; https://www.wordfence.com/threat-intel/vulnerabilities/id/2cb1b526-0df6-42a1-9294-90bc61730209?source=cve
CVE: CVE-2025-5394
Published: 2025-07-15
Description: The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://themeforest.net/item/alone-charity-multipurpose-nonprofit-wordpress-theme/15019939; https://www.wordfence.com/threat-intel/vulnerabilities/id/86f91589-b309-49aa-8b04-ca972acaf8fb?source=cve
CVE: CVE-2025-7340
Published: 2025-07-15
Description: The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the temp_file_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/ht-contactform/trunk/admin/Includes/Services/FileManager.php#L86; https://plugins.trac.wordpress.org/changeset/3326887/ht-contactform/trunk/admin/Includes/Services/FileManager.php?contextall=1&old=3316109&old_path=%2Fht-contactform%2Ftrunk%2Fadmin%2FIncludes%2FServices%2FFileManager.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cb666b-bfab-492f-a74e-11dc9b171136?source=cve