deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-59489
Published: 2025-10-03
Description: Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended location. If an application was built with a version of Unity Editor that had the vulnerable Unity Runtime code, then an adversary may be able to execute code on, and exfiltrate confidential information from, the machine on which that application is running. NOTE: product status is provided for Unity Editor because that is the information available from the Supplier. However, updating Unity Editor typically does not address the effects of the vulnerability; instead, it is necessary to rebuild and redeploy all affected applications.
CVSS Score: 7.4 (HIGH)
CWE: CWE-88, CWE-426
References: https://flatt.tech/research/posts/arbitrary-code-execution-in-unity-runtime/; https://unity.com/security#security-updates-and-patches; https://unity.com/security/sept-2025-01
CVE: CVE-2025-60445
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when the uploaded file is viewed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/18/File-Upload-to-Achieve-Stored-XSS-Attack/
CVE: CVE-2025-60447
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/21/Stored-XSS-Vulnerability-in-Emlog-Pro-HTML-Injection/
CVE: CVE-2025-60448
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/21/SVG-File-Upload-XSS-Vulnerability-in-Emlog-Pro/
CVE: CVE-2025-60449
Published: 2025-10-03
Description: An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://snowhy77.github.io/2025/08/21/Information-Disclosure-Vulnerability-in-SeaCMS/
CVE: CVE-2025-60450
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/22/Stored-XSS-Vulnerability-in-MetInfo-via-SVG-Upload/
CVE: CVE-2025-60451
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/22/Stored-XSS-Vulnerability-in-MetInfo-Webset-Module/
CVE: CVE-2025-60452
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\download_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Download-Module/
CVE: CVE-2025-60453
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Column-Module/
CVE: CVE-2025-60454
Published: 2025-10-03
Description: A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\img_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Image-Module/
CVE: CVE-2025-10728
Published: 2025-10-03
Description: When the module renders a Svg file that contains a <pattern> element, it might end up rendering it recursively leading to stack overflow DoS
CWE: CWE-674
References: https://codereview.qt-project.org/c/qt/qtsvg/+/654200
CVE: CVE-2025-10729
Published: 2025-10-03
Description: The module will parse a <pattern> node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free.
CWE: CWE-416
References: https://codereview.qt-project.org/c/qt/qtsvg/+/676473
CVE: CVE-2025-34226
Published: 2025-10-03
Description: OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate until a restart; on restart the runtime can fail to start because of corrupted database entries, resulting in persistent denial of service requiring complete rebase of the product to recover. This vulnerability was remediated by commit 095ee09.
CWE: CWE-20, CWE-664
References: https://autonomylogic.com/; https://github.com/thiagoralves/OpenPLC_v3/pull/297/commits/095ee09623dd229b64ad3a1db38a901a3772f6fc; https://openplc.discussion.community/post/persistant-dos-affecting-openplc-runtime-13722844
CVE: CVE-2025-55971
Published: 2025-10-03
Description: TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918
References: https://github.com/Szym0n13k/CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport; https://www.youtube.com/watch?v=FeNLGR_xFIA
CVE: CVE-2025-55972
Published: 2025-10-03
Description: A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) condition. By sending a flood of malformed or oversized SetAVTransportURI SOAP requests to the UPnP control endpoint, an attacker can cause the device to become unresponsive. This denial persists as long as the attack continues and affects all forms of TV operation. Manual user control and even reboots do not restore functionality unless the flood stops.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/Szym0n13k/CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport; https://www.youtube.com/watch?v=CRik5mp4SW4
CVE: CVE-2025-57423
Published: 2025-10-03
Description: A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, PersonName, lastUpdate, pool, and title. Due to insufficient input sanitisation, an unauthenticated remote attacker could inject arbitrary SQL commands via a crafted GET request, potentially leading to information disclosure or manipulation of the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://aardwolfsecurity.com/cve-2025-57423-critical-sql-injection-in-myclub/; https://github.com/jebissey/MyClub/commit/5741f39cf02215d3d01bf98f6133ac53d27e1556; https://github.com/jebissey/MyClub/commit/f067bb63ac7df153e95565529d99ac35de2c347e
CVE: CVE-2025-60787
Published: 2025-10-03
Description: MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-78, CWE-116
References: http://motioneye-project.com; https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter
CVE: CVE-2021-42193
Published: 2025-10-03
Description: nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://nop.com; http://nopcommerce.com; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2025-56551
Published: 2025-10-03
Description: An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content via supplying a crafted GET request.
CVSS Score: 8.2 (HIGH)
CWE: CWE-598
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://i.imgur.com/4HF0cnP.png; https://i.imgur.com/qA6SAXO.png
CVE: CVE-2025-61590
Published: 2025-10-03
Description: Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code Workspaces. Workspaces allow users to open more than a single folder and save specific settings (pretty similar to .vscode/settings.json) for the folders / project. An untitled workspace is automatically created by VS Code (untitled.code-workspace), which contains all the folders and workspace settings from the user's current session, opening up an entire new attack vector if the user has a .code-workspace file in path (either untitled created automatically or a saved one). If an attacker is able to hijack the chat context of the victim (such as via a compromised MCP server), they can use prompt injection to make the Cursor Agent write into this file and modify the workspace. This leads to a bypass of CVE-2025-54130 which can lead to RCE by writing to the settings section. This issue is fixed in version 1.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://github.com/cursor/cursor/security/advisories/GHSA-xg6w-rmh5-r77r
CVE: CVE-2025-61591
Published: 2025-10-03
Description: Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious MCP server and return crafted, maliciously injected commands during the interaction process, leading to command injection and potential remote code execution. If chained with an untrusted MCP service via OAuth, this command injection vulnerability could allow arbitrary code execution on the host by the agent. This can then be used to directly compromise the system by executing malicious commands with full user privileges. This issue does not currently have a fixed release version, but there is a patch, 2025.09.17-25b418f.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/cursor/cursor/security/advisories/GHSA-wj33-264c-j9cq
CVE: CVE-2024-56804
Published: 2025-10-03
Description: An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:
Video Station 5.8.4 and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-25-32
CVE: CVE-2025-33034
Published: 2025-10-03
Description: A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-33039
Published: 2025-10-03
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-33040
Published: 2025-10-03
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-44006
Published: 2025-10-03
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-44007
Published: 2025-10-03
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-46817
Published: 2025-10-03
Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.
CVSS Score: 7.0 (HIGH)
CWE: CWE-190
References: https://github.com/redis/redis/commit/fc9abc775e308374f667fdf3e723ef4b7eb0e3ca; https://github.com/redis/redis/releases/tag/8.2.2; https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp
CVE: CVE-2025-52653
Published: 2025-10-03
Description: HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
CVE: CVE-2025-61592
Published: 2025-10-03
Description: Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific CLI configuration from the current working directory (<project>/.cursor/cli.json) could override certain global configurations in Cursor CLI. This allowed users running the CLI inside a malicious repository to be vulnerable to Remote Code Execution through a combination of permissive configuration (allowing shell commands) and prompt injection delivered via project-specific Rules (<project>/.cursor/rules/rule.mdc) or other mechanisms. The fix for this issue is currently available as a patch 2025.09.17-25b418f. As of October 3, 2025 there is no release version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-829
References: https://github.com/cursor/cursor/security/advisories/GHSA-v64q-396f-7m79
CVE: CVE-2025-61593
Published: 2025-10-03
Description: Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files (i.e. */.cursor/cli.json) allows attackers to modify the content of the files through prompt injection, thus achieving remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive filesystems. This issue is fixed in a commit, 25b418f, but has yet to be released as of October 3, 2025.
CVSS Score: 7.1 (HIGH)
CWE: CWE-94, CWE-178
References: https://github.com/cursor/cursor/security/advisories/GHSA-x2vq-h6v6-jhc6
CVE: CVE-2025-44008
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-44009
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-44010
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-44011
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-44012
Published: 2025-10-03
Description: An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.qnap.com/en/security-advisory/qsa-25-35
CVE: CVE-2025-44014
Published: 2025-10-03
Description: An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.1 ( 2025/07/09 ) and later
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.qnap.com/en/security-advisory/qsa-25-34
CVE: CVE-2025-46818
Published: 2025-10-03
Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: https://github.com/redis/redis/commit/45eac0262028c771b6f[PII_REDACTED]b75f49f7a9e; https://github.com/redis/redis/releases/tag/8.2.2; https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp
CVE: CVE-2025-46819
Published: 2025-10-03
Description: Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-190, CWE-125
References: https://github.com/redis/redis/commit/3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba; https://github.com/redis/redis/releases/tag/8.2.2; https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f
CVE: CVE-2025-47210
Published: 2025-10-03
Description: A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.2 ( 2025/07/31 ) and later
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://www.qnap.com/en/security-advisory/qsa-25-35