deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-50722
Published: 2025-08-25
Description: Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/147536951/Qiany1/blob/main/SparkShop.pdf
CVE: CVE-2025-53120
Published: 2025-08-25
Description: A path traversal vulnerability in unauthenticated upload functionality allows a malicious actor to upload binaries and scripts to the server’s configuration and web root directories, achieving remote code execution on the Unified PAM server.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-22
References: https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE: CVE-2025-57760
Published: 2025-08-25
Description: Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: http://github.com/langflow-ai/langflow/pull/9152; https://github.com/langflow-ai/langflow/commit/c188ec113c9ca46154ad01d0eded1754cc6bef97; https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r
CVE: CVE-2025-57772
Published: 2025-08-25
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440; https://github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqv
CVE: CVE-2025-57773
Published: 2025-08-25
Description: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerability has been fixed in version 2.10.12.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-502
References: https://github.com/dataease/dataease/commit/8d04e92d44e1bac9284e9e64df5afd7f96d9373c; https://github.com/dataease/dataease/security/advisories/GHSA-7r8j-6whv-4j5p
CVE: CVE-2025-6737
Published: 2025-08-25
Description: Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1391
References: https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
CVE: CVE-2025-9410
Published: 2025-08-25
Description: A weakness has been identified in lostvip-com ruoyi-go up to 2.1. The affected element is the function SelectListByPage of the file modules/system/dao/GenTableDao.go. Executing manipulation of the argument isAsc/orderByColumn can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/on-theway/cve/issues/3; https://github.com/on-theway/cve/issues/4; https://vuldb.com/?ctiid.321251
CVE: CVE-2025-9411
Published: 2025-08-25
Description: A security vulnerability has been detected in lostvip-com ruoyi-go up to 2.1. The impacted element is the function SelectPageList of the file modules/system/service/LoginInforService.go. The manipulation of the argument isAsc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/on-theway/cve/issues/5; https://vuldb.com/?ctiid.321252; https://vuldb.com/?id.321252
CVE: CVE-2025-50383
Published: 2025-08-25
Description: alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://alextselegidis.com; https://easyappointments.org/; https://github.com/Abdullah4eb/CVE-2025-50383
CVE: CVE-2025-57802
Published: 2025-08-25
Description: Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an attacker with access to the affected container can create symbolic links inside the mounted directory (/app/data). Because the container bind-mounts an arbitrary host path, these symlinks can point to sensitive locations on the host filesystem. When the application or other processes follow these symlinks, the attacker can gain unauthorized read access to host files outside the container. This issue has been patched in version 1.0.1.
CWE: CWE-61
References: https://github.com/airlinklabs/daemon/commit/5e6222dd9eec6d7cb0876b12507e3d[PII_REDACTED]; https://github.com/airlinklabs/daemon/security/advisories/GHSA-hrfv-wm8p-mg8m
CVE: CVE-2025-57811
Published: 2025-08-25
Description: Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to CVE-2024-52293. This vulnerability has been patched in versions 4.16.6 and 5.8.7.
CVSS Score: 7.2 (HIGH)
CWE: CWE-1336
References: https://github.com/craftcms/cms/commit/e77f8a287dcdda41f1724f525d03542f18566cbc; https://github.com/craftcms/cms/pull/17612; https://github.com/craftcms/cms/security/advisories/GHSA-crcq-738g-pqvc
CVE: CVE-2025-9412
Published: 2025-08-25
Description: A vulnerability was detected in lostvip-com ruoyi-go up to 2.1. This affects the function SelectListByPage of the file modules/system/dao/DictDataDao.go. The manipulation of the argument orderByColumn/isAsc results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/on-theway/cve/issues/6; https://github.com/on-theway/cve/issues/7; https://vuldb.com/?ctiid.321253
CVE: CVE-2025-9413
Published: 2025-08-25
Description: A flaw has been found in lostvip-com ruoyi-go up to 2.1. This impacts the function SelectListByPage of the file modules/system/system_router.go. This manipulation of the argument orderByColumn/isAsc causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/on-theway/cve/issues/8; https://github.com/on-theway/cve/issues/9; https://vuldb.com/?ctiid.321254
CVE: CVE-2025-9414
Published: 2025-08-25
Description: A vulnerability was found in kalcaddle kodbox 1.61. Affected by this vulnerability is an unknown functionality of the file /?explorer/upload/serverDownload of the component Download from Link Handler. Performing manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-918
References: https://gist.github.com/SysEternals/a03d45b582451f243f9c24076593c49c; https://vuldb.com/?ctiid.321256; https://vuldb.com/?id.321256
CVE: CVE-2025-9415
Published: 2025-08-25
Description: A vulnerability was identified in GreenCMS up to 2.3.0603. This affects an unknown part of the file /index.php?m=admin&c=media&a=fileconnect. The manipulation of the argument upload[] leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/lan041221/cvec/issues/10; https://vuldb.com/?ctiid.321258; https://vuldb.com/?id.321258
CVE: CVE-2025-3456
Published: 2025-08-25
Description: On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.
CVSS Score: 3.8 (LOW)
CWE: CWE-532
References: https://https://www.arista.com/en/support/advisories-notices/security-advisory/22022-security-advisory-0122
CVE: CVE-2025-52130
Published: 2025-08-25
Description: File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution (RCE) on the web server.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-616
References: https://github.com/SMEWebify/WebErpMesv2; https://medium.com/@The_Hiker/wrong-variable-name-leads-to-rce-cve-2025-52130-8ff59a7d245c
CVE: CVE-2025-9416
Published: 2025-08-25
Description: A security flaw has been discovered in oitcode samarium up to 0.9.6. This vulnerability affects unknown code of the file /cms/webpage/ of the component Pages Image Handler. The manipulation results in cross site scripting. The attack may be performed from a remote location. The exploit has been released to the public and may be exploited.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/MaiqueSilva/VulnDB/blob/main/README09.md; https://vuldb.com/?ctiid.321259; https://vuldb.com/?id.321259
CVE: CVE-2025-9417
Published: 2025-08-25
Description: A weakness has been identified in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /employee/addemployee.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/41; https://itsourcecode.com/; https://vuldb.com/?ctiid.321260
CVE: CVE-2025-57804
Published: 2025-08-25
Description: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
CWE: CWE-93
References: https://github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a; https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h; https://lists.debian.org/debian-lts-announce/2025/09/msg00004.html
CVE: CVE-2025-6188
Published: 2025-08-25
Description: On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not perform some form of authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290
References: https://www.arista.com/en/support/advisories-notices/security-advisory/22021-security-advisory-0121
CVE: CVE-2025-9418
Published: 2025-08-25
Description: A security vulnerability has been detected in itsourcecode Apartment Management System 1.0. Impacted is an unknown function of the file /owner/addowner.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/40; https://itsourcecode.com/; https://vuldb.com/?ctiid.321261
CVE: CVE-2025-9419
Published: 2025-08-25
Description: A vulnerability was detected in itsourcecode Apartment Management System 1.0. The affected element is an unknown function of the file /unit/addunit.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/39; https://itsourcecode.com/; https://vuldb.com/?ctiid.321262
CVE: CVE-2025-57805
Published: 2025-08-25
Description: The Scratch Channel is a news website. In versions 1 and 1.1, a POST request to the endpoint used to publish articles, can be used to post an article in any category with any date, regardless of who's logged in. This issue has been patched in version 1.2.
CWE: CWE-20
References: https://github.com/The-Scratch-Channel/tsc-web-client/security/advisories/GHSA-h5rj-2466-qr23
CVE: CVE-2025-57809
Published: 2025-08-25
Description: XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5; https://github.com/mlc-ai/xgrammar/issues/250; https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc
CVE: CVE-2025-57814
Published: 2025-08-25
Description: request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Versions 1.x.x and earlier contain a vulnerability where HTTPS requests to 127.0.0.1 bypass IP address filtering, while HTTP requests are correctly blocked. This allows attackers to potentially access internal HTTPS services running on localhost, bypassing the library's SSRF protection. The vulnerability is particularly dangerous when the application accepts user-controlled URLs and internal services are only protected by network-level restrictions. This vulnerability has been fixed in request-filtering-agent version 2.0.0. Users should upgrade to version 2.0.0 or later.
CWE: CWE-918
References: https://github.com/azu/request-filtering-agent-https127-test; https://github.com/azu/request-filtering-agent/security/advisories/GHSA-pw25-c82r-75mm
CVE: CVE-2025-8627
Published: 2025-08-25
Description: The TP-Link KP303 Smartplug can be issued unauthenticated protocol commands that may cause unintended power-off condition and potential information leak.

This issue affects TP-Link KP303 (US) Smartplug: before 1.1.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: https://www.tp-link.com/us/support/faq/4619/
CVE: CVE-2025-9420
Published: 2025-08-25
Description: A flaw has been found in itsourcecode Apartment Management System 1.0. The impacted element is an unknown function of the file /floor/addfloor.php. Executing manipulation of the argument hdnid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/38; https://itsourcecode.com/; https://vuldb.com/?ctiid.321263
CVE: CVE-2025-9421
Published: 2025-08-25
Description: A vulnerability has been found in itsourcecode Apartment Management System 1.0. This affects an unknown function of the file /complain/addcomplain.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zhuyi-hz/cve/issues/16; https://itsourcecode.com/; https://vuldb.com/?ctiid.321264
CVE: CVE-2025-9422
Published: 2025-08-25
Description: A vulnerability was found in oitcode samarium up to 0.9.6. This impacts an unknown function of the file /dashboard/team of the component Team Image Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/MaiqueSilva/VulnDB/blob/main/readme10.md; https://vuldb.com/?ctiid.321265; https://vuldb.com/?id.321265
CVE: CVE-2025-9423
Published: 2025-08-25
Description: A vulnerability was determined in Campcodes Online Water Billing System 1.0. Affected is an unknown function of the file /editecex.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/Yuanwennnn/cve/issues/1; https://vuldb.com/?ctiid.321266; https://vuldb.com/?id.321266
CVE: CVE-2025-9424
Published: 2025-08-25
Description: A vulnerability was identified in Ruijie WS7204-A 2017.06.15. Affected by this vulnerability is an unknown functionality of the file /itbox_pi/branch_import.php?a=branch_list. Such manipulation of the argument province leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/Hwwg/cve/issues/1; https://vuldb.com/?ctiid.321267; https://vuldb.com/?id.321267
CVE: CVE-2025-9425
Published: 2025-08-25
Description: A security flaw has been discovered in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /enquiry.php. Performing manipulation of the argument pid results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/shq3526/cve/issues/6; https://itsourcecode.com/; https://vuldb.com/?ctiid.321268
CVE: CVE-2025-9426
Published: 2025-08-25
Description: A weakness has been identified in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /package.php. Executing manipulation of the argument subcatid can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the public and could be exploited.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/shq3526/cve/issues/7; https://itsourcecode.com/; https://vuldb.com/?ctiid.321269
CVE: CVE-2025-9429
Published: 2025-08-26
Description: A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post Handler. The manipulation of the argument content/title/ leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/mtons/mblog/issues/ICPMLJ; https://gitee.com/mtons/mblog/issues/ICPMLW; https://vuldb.com/?ctiid.321270
CVE: CVE-2025-9430
Published: 2025-08-26
Description: A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the argument input results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/mtons/mblog/issues/ICPMMF; https://vuldb.com/?ctiid.321271; https://vuldb.com/?id.321271
CVE: CVE-2025-9431
Published: 2025-08-26
Description: A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/mtons/mblog/issues/ICPMML; https://vuldb.com/?ctiid.321272; https://vuldb.com/?id.321272
CVE: CVE-2025-9432
Published: 2025-08-26
Description: A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Panel. Such manipulation of the argument Title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/mtons/mblog/issues/ICPMMQ; https://vuldb.com/?ctiid.321273; https://vuldb.com/?id.321273
CVE: CVE-2025-8447
Published: 2025-08-26
Description: An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 3.1 (LOW)
CWE: CWE-639
References: https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.17; https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.12; https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.8
CVE: CVE-2025-9433
Published: 2025-08-26
Description: A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/mtons/mblog/issues/ICPMMW; https://vuldb.com/?ctiid.321274; https://vuldb.com/?id.321274
CVE: CVE-2025-9434
Published: 2025-08-26
Description: A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/edit_title.php?id=1. Executing manipulation of the argument desc can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/lan041221/cvec/issues/11; https://vuldb.com/?ctiid.321275; https://vuldb.com/?id.321275