deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53832
Published: 2025-07-21
Description: Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. The server constructs and executes shell commands using unvalidated user input directly within command-line strings. This introduces the possibility of shell metacharacter injection (|, >, &&, etc.). This vulnerability is fixed in version 0.0.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/translated/lara-mcp/commit/e534ef690adf390e4ac862a200b2a83f6cf45944; https://github.com/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7
CVE: CVE-2025-54122
Published: 2025-07-21
Description: Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an unauthenticated attacker to bypass network isolation and access restrictions, potentially enabling access to internal services, cloud metadata endpoints, and exfiltration of sensitive data from isolated network segments. This vulnerability is fixed in version 25.7.21.2525.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: https://github.com/Manager-io/Manager/security/advisories/GHSA-347w-cgwh-m895
CVE: CVE-2025-54127
Published: 2025-07-21
Description: HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not perform authorization or authentication checks. If a user were to deploy haxcms-nodejs without modifying the default settings, ‘HAXCMS_DISABLE_JWT_CHECKS‘ would be set to ‘true‘ and their deployment would lack session authentication. This is fixed in version 11.0.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1188
References: https://github.com/haxtheweb/issues/security/advisories/GHSA-f38f-jvqj-mfg6
CVE: CVE-2025-54128
Published: 2025-07-21
Description: HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disabled Content Security Policy (CSP). This configuration is insecure for a production application because it does not protect against cross-site-scripting attacks. The contentSecurityPolicy value is explicitly disabled in the application's Helmet configuration in app.js. This is fixed in version 11.0.8.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/haxtheweb/haxcms-nodejs/commit/ddb9351c6d6418008d4084a5b17fd6d611bc4e30; https://github.com/haxtheweb/issues/security/advisories/GHSA-59g8-h59f-8hjp
CVE: CVE-2025-54129
Published: 2025-07-21
Description: HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts. An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites. This is fixed in version 11.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/haxtheweb/issues/security/advisories/GHSA-wh3h-vfcv-m5g5
CVE: CVE-2025-54134
Published: 2025-07-21
Description: HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when an authenticated attacker provides an API request lacking required URL parameters. This vulnerability affects the listFiles and saveFiles endpoints. This vulnerability exists because the application does not properly handle exceptions which occur as a result of changes to user-modifiable URL parameters. This is fixed in version 11.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-248, CWE-703
References: https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/listFiles.js#L22; https://github.com/haxtheweb/haxcms-nodejs/blob/main/src/routes/saveFile.js#L52; https://github.com/haxtheweb/haxcms-nodejs/commit/e9773d1996233f9bafb06832b8220ec2a98bab34
CVE: CVE-2025-7939
Published: 2025-07-21
Description: A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsController.java. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Bemcliu/cve-reports/blob/main/cve-03-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Arbitrary%20File%20Upload/readme.md; https://vuldb.com/?ctiid.317076; https://vuldb.com/?id.317076
CVE: CVE-2025-7940
Published: 2025-07-21
Description: A vulnerability was found in Genshin Albedo Cat House App 1.0.2 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.house.auscat. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.house.auscat.md; https://github.com/KMov-g/androidapps/blob/main/com.house.auscat.md#video-proof-of-concept; https://vuldb.com/?ctiid.317077
CVE: CVE-2025-7941
Published: 2025-07-21
Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Time Table Generator System 1.0. Affected is an unknown function of the file /admin/profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://drive.google.com/file/d/19C2IWKR38Qqw7RLNn1nWzvWv4GszgPnU/view; https://github.com/LagonGit/ReportCVE/issues/6; https://phpgurukul.com/
CVE: CVE-2025-7942
Published: 2025-07-21
Description: A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/LagonGit/ReportCVE/issues/7; https://phpgurukul.com/; https://vuldb.com/?ctiid.317083
CVE: CVE-2025-7486
Published: 2025-07-21
Description: The Ebook Store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Order Details in all versions up to, and including, 5.8012 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ebook-store/trunk/functions.php#L230; https://plugins.trac.wordpress.org/changeset/3328355; https://www.wordfence.com/threat-intel/vulnerabilities/id/20e0e651-8330-4062-8fb4-f0545befcb1a?source=cve
CVE: CVE-2025-7943
Published: 2025-07-21
Description: A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-autoortaxi.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/LagonGit/ReportCVE/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.317084
CVE: CVE-2025-7944
Published: 2025-07-21
Description: A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/LagonGit/ReportCVE/issues/9; https://phpgurukul.com/; https://vuldb.com/?ctiid.317085
CVE: CVE-2025-7945
Published: 2025-07-22
Description: A vulnerability was found in D-Link DIR-513 up to 20190831. It has been declared as critical. This vulnerability affects the function formSetWanDhcpplus of the file /goform/formSetWanDhcpplus. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/LYN1ng/D-linkdir513/blob/main/Dlink_DIR-513_Buffer_Overflow_Vulnerability.md; https://vuldb.com/?ctiid.317086; https://vuldb.com/?id.317086
CVE: CVE-2025-7946
Published: 2025-07-22
Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /search-visitor.php of the component HTTP POST Request Handler. The manipulation of the argument searchdata leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/HieuGITLAB/my-cves/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.317087
CVE: CVE-2025-7947
Published: 2025-07-22
Description: A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Handler. The manipulation of the argument ID leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-639
References: https://github.com/jishenghua/jshERP/issues/124; https://vuldb.com/?ctiid.317088; https://vuldb.com/?id.317088
CVE: CVE-2025-7948
Published: 2025-07-22
Description: A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-640
References: https://github.com/jishenghua/jshERP/issues/123; https://vuldb.com/?ctiid.317089; https://vuldb.com/?id.317089
CVE: CVE-2012-10020
Published: 2025-07-22
Description: The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/113576/; https://plugins.trac.wordpress.org/changeset/555071; https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_foxypress_upload.rb
CVE: CVE-2015-10137
Published: 2025-07-22
Description: The Website Contact Form With File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_file()' function in versions up to, and including, 1.3.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/131413/; https://packetstormsecurity.com/files/131514/; https://plugins.trac.wordpress.org/browser/website-contact-form-with-file-upload/trunk/readme.txt
CVE: CVE-2025-5240
Published: 2025-07-22
Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/crm-customer-relationship-management-by-vcita/trunk/vcita-widgets-functions.php#L180; https://plugins.trac.wordpress.org/changeset/3256449/; https://wordpress.org/plugins/crm-customer-relationship-management-by-vcita/#developers
CVE: CVE-2025-6831
Published: 2025-07-22
Description: The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/user-registration/tags/4.2.4/modules/content-restriction/class-urcr-shortcodes.php; https://plugins.trac.wordpress.org/browser/user-registration/tags/4.2.4/modules/content-restriction/class-urcr-shortcodes.php#L147; https://plugins.trac.wordpress.org/changeset/3329704/
CVE: CVE-2025-7949
Published: 2025-07-22
Description: A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file publiccms-parent/publiccms/src/main/resources/templates/admin/cmsDiy/preview.html. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named c1e79f124e3f4c458315d908ed7dee06f9f12a76/f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://github.com/sanluan/PublicCMS/commit/c1e79f124e3f4c458315d908ed7dee06f9f12a76; https://github.com/sanluan/PublicCMS/issues/87; https://vuldb.com/?ctiid.317095
CVE: CVE-2025-7950
Published: 2025-07-22
Description: A vulnerability was found in code-projects Public Chat Room 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/BalanceLee/CVE/issues/5; https://vuldb.com/?ctiid.317096
CVE: CVE-2025-7951
Published: 2025-07-22
Description: A vulnerability classified as problematic has been found in code-projects Public Chat Room 1.0. This affects an unknown part of the file /send_message.php. The manipulation of the argument chat_msg/your_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/BalanceLee/CVE/issues/6; https://vuldb.com/?ctiid.317097
CVE: CVE-2025-7952
Published: 2025-07-22
Description: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/ElvisBlue/Public/blob/main/Vuln/7.md; https://github.com/ElvisBlue/Public/blob/main/Vuln/7.md#poc; https://vuldb.com/?ctiid.317098
CVE: CVE-2025-7953
Published: 2025-07-22
Description: A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is named f1af17af004ca9345c6fe4d5936d87d008d26e75. It is recommended to apply a patch to fix this issue.
CVSS Score: 3.5 (LOW)
CWE: CWE-601
References: https://github.com/sanluan/PublicCMS/commit/f1af17af004ca9345c6fe4d5936d87d008d26e75; https://github.com/sanluan/PublicCMS/issues/88; https://vuldb.com/?ctiid.317099
CVE: CVE-2025-52580
Published: 2025-07-22
Description: Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be exposed to an attacker who has access to the application logs.
CVSS Score: 2.4 (LOW)
CWE: CWE-532
References: https://jvn.jp/en/jp/JVN07825095/
CVE: CVE-2025-6585
Published: 2025-07-22
Description: The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callback() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete accounts of other users including admins.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636; https://www.wordfence.com/threat-intel/vulnerabilities/id/afb3e0e0-68c7-43f6-981f-59c3f3507429?source=cve
CVE: CVE-2025-7495
Published: 2025-07-22
Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/api/api.php#L144; https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/class-wp-members-shortcodes.php#L1092; https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/vendor/rocketgeek-utilities/includes/utilities.php#L259
CVE: CVE-2025-7644
Published: 2025-07-22
Description: The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3328206%40pixel-gallery&new=3328206%40pixel-gallery&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a3fbf26b-c7d8-4c44-b3c1-c4e028465a9e?source=cve
CVE: CVE-2025-7645
Published: 2025-07-22
Description: The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, when an administrator deletes the submission, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3330857%40extensions-for-cf7&new=3330857%40extensions-for-cf7&sfp_email=&sfph_mail=; https://wordpress.org/plugins/extensions-for-cf7/; https://www.wordfence.com/threat-intel/vulnerabilities/id/894b43ed-143d-4c0b-afd1-05fcd6fa5018?source=cve
CVE: CVE-2025-38352
Published: 2025-07-22
Description: In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.
CVSS Score: 7.4 (HIGH)
CWE: CWE-367
References: https://git.kernel.org/stable/c/2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff; https://git.kernel.org/stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b; https://git.kernel.org/stable/c/460188bc042a3f40f72d34b9f7fc6ee66b0b757b
CVE: CVE-2025-46267
Published: 2025-07-22
Description: Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may be enabled by a remote attacker who can log in to WebGUI.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-912
References: https://jvn.jp/en/vu/JVNVU91615135/; https://www.elecom.co.jp/news/security/20250722-01/
CVE: CVE-2025-53472
Published: 2025-07-22
Description: WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://jvn.jp/en/vu/JVNVU91615135/; https://www.elecom.co.jp/news/security/20250722-01/