deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7362
Published: 2025-07-08
Description: The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice.




This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f; https://phabricator.wikimedia.org/T394864; https://phabricator.wikimedia.org/T394864
CVE: CVE-2025-7363
Published: 2025-07-08
Description: The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript.




This issue affects Mediawiki - TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I107ab638fecbf52b5bec3f02726ed24b1ae74429; https://gerrit.wikimedia.org/r/q/I2e8c[PII_REDACTED]9634f6ec64d37cf82507dfa110; https://phabricator.wikimedia.org/T394721
CVE: CVE-2023-43039
Published: 2025-07-08
Description: IBM OpenPages with Watson 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7238923
CVE: CVE-2024-49783
Published: 2025-07-08
Description: IBM OpenPages with Watson 8.3 and 9.0 



could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability to use additional cryptographic methods to possibly extract the encrypted data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-329
References: https://www.ibm.com/support/pages/node/7239145
CVE: CVE-2024-49784
Published: 2025-07-08
Description: IBM OpenPages with Watson 8.3 and 9.0 

could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://www.ibm.com/support/pages/node/7239145
CVE: CVE-2025-27367
Published: 2025-07-08
Description: IBM OpenPages with Watson 8.3 and 9.0 





is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved without storing the required fields.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-602
References: https://www.ibm.com/support/pages/node/7239155
CVE: CVE-2025-27369
Published: 2025-07-08
Description: IBM OpenPages with Watson 8.3 and 9.0 







is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used for the administration of OpenPages. An authenticated user is able to obtain certain information about system configuration and internal state which is only intended for administrators of the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7239155
CVE: CVE-2025-37102
Published: 2025-07-08
Description: An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points.  

A successful exploitation could allow a remote attacker with elevated  privileges to execute arbitrary commands on the underlying operating system as a highly privileged user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04894en_us&docLocale=en_US
CVE: CVE-2025-48384
Published: 2025-07-08
Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Score: 8.0 (HIGH)
CWE: CWE-59, CWE-436
References: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9; http://seclists.org/fulldisclosure/2025/Sep/60; http://www.openwall.com/lists/oss-security/2025/07/08/4
CVE: CVE-2025-48385
Published: 2025-07-08
Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CWE: CWE-73, CWE-88
References: https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655; http://www.openwall.com/lists/oss-security/2025/07/08/4
CVE: CVE-2025-48386
Published: 2025-07-08
Description: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr; http://www.openwall.com/lists/oss-security/2025/07/08/4
CVE: CVE-2025-7190
Published: 2025-07-08
Description: A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. This affects an unknown part of the file /admin/student_edit_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://code-projects.org/; https://github.com/y2xsec324/cve/issues/11; https://vuldb.com/?ctiid.315129
CVE: CVE-2025-7191
Published: 2025-07-08
Description: A vulnerability has been found in code-projects Student Enrollment System 1.0 and classified as critical. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/11; https://vuldb.com/?ctiid.315130
CVE: CVE-2025-37103
Published: 2025-07-08
Description: Hard-coded login credentials were found in HPE Networking Instant On  Access Points, allowing anyone with knowledge of it to bypass normal  device authentication. Successful exploitation could allow a remote  attacker to gain administrative access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04894en_us&docLocale=en_US
CVE: CVE-2025-53355
Published: 2025-07-08
Description: MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/Flux159/mcp-server-kubernetes/commit/ab165f5a0eea917fef5dbae954506fff6f4bf514; https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-gjv4-ghm7-q58q; https://github.com/cyanheads/git-mcp-server/commit/0dbd6995ccdf76ab770b[PII_REDACTED]5b2d06c4d9
CVE: CVE-2025-7192
Published: 2025-07-08
Description: A vulnerability was found in D-Link DIR-645 up to 1.05B01 and classified as critical. This issue affects the function ssdpcgi_main of the file /htdocs/cgibin of the component ssdpcgi. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/Thir0th/Thir0th-CVE/blob/main/D-Link%20DIR%E2%80%91645%20A1%20has%20a%20remote%20arbitrary%20command%20execution%20vulnerability%20in%20ssdpcgi.md; https://vuldb.com/?ctiid.315131; https://vuldb.com/?id.315131
CVE: CVE-2025-7193
Published: 2025-07-08
Description: A vulnerability was found in itsourcecode Agri-Trading Online Shopping System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/suppliercontroller.php. The manipulation of the argument supplier leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Sp1d3rL1/CVE/issues/7; https://itsourcecode.com/; https://vuldb.com/?ctiid.315132
CVE: CVE-2025-43582
Published: 2025-07-08
Description: Substance3D - Viewer versions 0.22 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user, scope unchanged. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html
CVE: CVE-2025-43583
Published: 2025-07-08
Description: Substance3D - Viewer versions 0.22 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html
CVE: CVE-2025-43584
Published: 2025-07-08
Description: Substance3D - Viewer versions 0.22 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d-viewer/apsb25-54.html
CVE: CVE-2025-49535
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service by bypassing security measures. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49536
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49537
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 7.9 (HIGH)
CWE: CWE-78
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49538
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.
CVSS Score: 7.4 (HIGH)
CWE: CWE-91
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49539
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49540
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49541
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49542
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser, scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49543
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49544
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-611
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49545
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-918
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49546
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application. Exploitation of this issue does not require user interaction and scope is unchanged. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 2.4 (LOW)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-49551
Published: 2025-07-08
Description: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html
CVE: CVE-2025-7030
Published: 2025-07-08
Description: Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-267
References: https://www.drupal.org/sa-contrib-2025-085
CVE: CVE-2025-7031
Published: 2025-07-08
Description: Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.drupal.org/sa-contrib-2025-086
CVE: CVE-2025-7194
Published: 2025-07-08
Description: A vulnerability was found in D-Link DI-500WF 17.04.10A1T. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file ip_position.asp of the component jhttpd. The manipulation of the argument ip leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/BigMancer/CVE/issues/1; https://vuldb.com/?ctiid.315133; https://vuldb.com/?id.315133
CVE: CVE-2025-7196
Published: 2025-07-08
Description: A vulnerability was found in code-projects Jonnys Liquor 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /browse.php. The manipulation of the argument Search leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Gemileo/CVE/issues/3; https://vuldb.com/?ctiid.315134
CVE: CVE-2025-27165
Published: 2025-07-08
Description: Substance3D - Stager versions 3.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/substance3d_stager/apsb25-64.html
CVE: CVE-2025-27203
Published: 2025-07-08
Description: Adobe Connect versions 24.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does require user interaction and scope is changed.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/connect/apsb25-61.html
CVE: CVE-2025-30313
Published: 2025-07-08
Description: Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb25-65.html
CVE: CVE-2025-43591
Published: 2025-07-08
Description: InDesign Desktop versions 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/indesign/apsb25-60.html