deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-40703
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/group" petition, "name" and "alias-0” parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-40704
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/edition" petition, "name" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-40705
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/acquisition" petition, "name" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-40706
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/source" petition, "name" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-40707
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/place" petition, "name" and "alias-0” parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-40708
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/event" petition, "name" parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-40709
Published: 2025-08-29
Description: Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an authenticated user and steal their session cookie details, via  the "/insert/person/<ID>” petition, "name" and "alias-0” parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/craws/OpenAtlas; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-cross-site-scripting-xss-vulnerabilities-openatlas-acdh-ch
CVE: CVE-2025-9643
Published: 2025-08-29
Description: A vulnerability was found in itsourcecode Apartment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /setting/utility_bill_setup.php. Performing manipulation of the argument txtGasBill results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/49; https://itsourcecode.com/; https://vuldb.com/?ctiid.321850
CVE: CVE-2025-9644
Published: 2025-08-29
Description: A vulnerability was determined in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the file /setting/bill_setup.php. Executing manipulation of the argument txtBillType can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/48; https://itsourcecode.com/; https://vuldb.com/?ctiid.321851
CVE: CVE-2025-9645
Published: 2025-08-29
Description: A vulnerability was identified in itsourcecode Apartment Management System 1.0. This affects an unknown part of the file /t_dashboard/r_all_info.php. The manipulation of the argument mid leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/loveqiaoshen/QiaoShenCVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.321852
CVE: CVE-2025-9646
Published: 2025-08-29
Description: A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/o2oa/o2oa/issues/170; https://github.com/o2oa/o2oa/issues/170#issue[PII_REDACTED]; https://github.com/o2oa/o2oa/issues/170#issuecomment[PII_REDACTED]
CVE: CVE-2025-9647
Published: 2025-08-29
Description: A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/mtons/mblog/issues/ICPMNE; https://vuldb.com/?ctiid.321854; https://vuldb.com/?id.321854
CVE: CVE-2025-9649
Published: 2025-08-29
Description: A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is recommended to address this issue. It is advisable to upgrade the affected component. The vendor confirms in a GitHub issue reply: "Was able to reproduce in 6fcbf03 but NOT 4.5.3-beta3."
CVSS Score: 3.3 (LOW)
CWE: CWE-369, CWE-404, CWE-369
References: https://drive.google.com/file/d/16QQtZvUrMbF-i_1cGt5hNWmkn-YVyBOM/view?usp=sharing; https://github.com/appneta/tcpreplay/issues/968; https://github.com/appneta/tcpreplay/issues/968#issuecomment[PII_REDACTED]
CVE: CVE-2025-9650
Published: 2025-08-29
Description: A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d[PII_REDACTED]63980301d6f99866b3. This affects the function removeFileByPath of the file src/main/java/com/yeqifu/sys/utils/AppFileUtils.java. The manipulation of the argument carimg leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://github.com/JetpropelledSnake/CVE-File/blob/main/Unrestricted%20deletion%20of%20any%20file.md; https://vuldb.com/?ctiid.321858; https://vuldb.com/?id.321858
CVE: CVE-2025-9651
Published: 2025-08-29
Description: A vulnerability was found in shafhasan chatbox up to 156a39cde62f78532c3265a70eda12c70907e56f. This impacts an unknown function of the file /chat.php. The manipulation of the argument user_id results in sql injection. The attack may be performed from a remote location. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://vuldb.com/?ctiid.321859; https://vuldb.com/?id.321859; https://vuldb.com/?submit.636884
CVE: CVE-2025-54080
Published: 2025-08-29
Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/Exiv2/exiv2/commit/e[PII_REDACTED]11f15bcdc4e903203d6b7493eaec0; https://github.com/Exiv2/exiv2/security/advisories/GHSA-496f-x7cq-cq39
CVE: CVE-2025-55304
Published: 2025-08-29
Description: Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-407
References: https://github.com/Exiv2/exiv2/issues/3333; https://github.com/Exiv2/exiv2/pull/3335; https://github.com/Exiv2/exiv2/pull/3345
CVE: CVE-2025-9652
Published: 2025-08-29
Description: A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-9652/; https://karinagante.github.io/cve-2025-9652/#proof-of-concept-poc; https://vuldb.com/?ctiid.321860
CVE: CVE-2025-9653
Published: 2025-08-29
Description: A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_projeto_cad.php of the component Cadastrar projeto Page. Such manipulation of the argument nome/observacao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://karinagante.github.io/cve-2025-9653/; https://karinagante.github.io/cve-2025-9653/#proof-of-concept-poc; https://vuldb.com/?ctiid.321861
CVE: CVE-2025-9654
Published: 2025-08-29
Description: A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading to version 1.0.4 and 1.1.0 can resolve this issue. The patch is named cd2566a948b696501abfa6c6b03462cac5fb43d8. It is advisable to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77
References: https://github.com/AiondaDotCom/mcp-ssh/commit/5b9b9c5b28d3f2672f356a790154ed68e17ef453; https://github.com/AiondaDotCom/mcp-ssh/commit/cd2566a948b696501abfa6c6b03462cac5fb43d8; https://vuldb.com/?ctiid.321862
CVE: CVE-2025-9655
Published: 2025-08-29
Description: A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/o2oa/o2oa/issues/172; https://github.com/o2oa/o2oa/issues/172#issuecomment[PII_REDACTED]; https://vuldb.com/?ctiid.321863
CVE: CVE-2024-46916
Published: 2025-08-29
Description: Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the filesystem is properly mounted (e.g., leveraging a delete call in /etc/rc.d/init.d/mountfs to remove the /etc/fstab file). This can allow code execution and, in some versions, enable recovery of TPM Disk Encryption keys and decryption of the Windows system partition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269, CWE-276, CWE-284
References: https://github.com/emptynebuli; https://www.atredis.com/blog/2025/8/26/24nrgne4dqbwjxyip7txn8ep6zj057; https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/
CVE: CVE-2024-46917
Published: 2025-08-29
Description: Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity validation. This allows code execution, recovery of TPM Disk Encryption keys, decryption of the Windows system partition, and full control of the Windows OS, e.g., through ~/.profile changes.
CVSS Score: 8.1 (HIGH)
CWE: CWE-353
References: https://github.com/emptynebuli; https://www.atredis.com/blog/2025/8/26/24nrgne4dqbwjxyip7txn8ep6zj057; https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/
CVE: CVE-2025-47909
Published: 2025-08-29
Description: Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
CVSS Score: 7.3 (HIGH)
CWE: CWE-346
References: https://github.com/golang/vulndb/issues/3884; https://pkg.go.dev/vuln/GO-2025-3884
CVE: CVE-2025-54877
Published: 2025-08-29
Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99[PII_REDACTED] and Tuleap Enterprise Edition versions before 16.9-8 and before 16.10-5, an attacker can access to the content of the special and always there fields of accessible artifacts even if the permissions associated with the underlying fields do not allow it. This issue has been fixed in Tuleap Community Edition version 16.10.99[PII_REDACTED] and Tuleap Enterprise Edition versions 16.9-8 and 16.10-5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/Enalean/tuleap/commit/b0c1328f96135ee6a3f84d0847be5f843eafa590; https://github.com/Enalean/tuleap/security/advisories/GHSA-m5qc-c3q5-2p29; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b0c1328f96135ee6a3f84d0847be5f843eafa590
CVE: CVE-2025-55177
Published: 2025-08-29
Description: Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://www.facebook.com/security/advisories/cve-2025-55177; https://www.whatsapp.com/security/advisories/2025/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177
CVE: CVE-2025-55202
Published: 2025-08-29
Description: Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23
References: https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009; https://github.com/opencast/opencast/pull/6979; https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8
CVE: CVE-2025-55750
Published: 2025-08-29
Description: Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via the URL fragment when clicked by an authenticated user. This resulted from how Bitbucket returned tokens and how Gitpod handled the redirect flow. The issue was limited to Bitbucket (GitHub and GitLab integrations were not affected), required user interaction, and has been mitigated through redirect handling and OAuth logic hardening. The issue was resolved in main-gha.33628 and later. There are no workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://github.com/gitpod-io/gitpod/commit/a736c1b83bd781786af0da705d0acebabfba7862; https://github.com/gitpod-io/gitpod/pull/20983; https://github.com/gitpod-io/gitpod/security/advisories/GHSA-63fw-3jgp-2p2g
CVE: CVE-2025-5808
Published: 2025-08-29
Description: Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset from before 4.8 patch 3.
CWE: CWE-1284
References: https://docs.microfocus.com/doc/28/4.8/scrtyimpr
CVE: CVE-2025-9656
Published: 2025-08-29
Description: A security vulnerability has been detected in PHPGurukul Directory Management System 2.0. This vulnerability affects unknown code of the file /admin/add-directory.php. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/xiguala123/myCVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.321864
CVE: CVE-2025-9657
Published: 2025-08-29
Description: A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/o2oa/o2oa/issues/173; https://github.com/o2oa/o2oa/issues/173#issue[PII_REDACTED]; https://github.com/o2oa/o2oa/issues/173#issuecomment[PII_REDACTED]
CVE: CVE-2025-9658
Published: 2025-08-29
Description: A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/o2oa/o2oa/issues/174; https://github.com/o2oa/o2oa/issues/174#issue[PII_REDACTED]; https://github.com/o2oa/o2oa/issues/174#issuecomment[PII_REDACTED]
CVE: CVE-2025-9659
Published: 2025-08-29
Description: A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/o2oa/o2oa/issues/175; https://github.com/o2oa/o2oa/issues/175#issue[PII_REDACTED]; https://github.com/o2oa/o2oa/issues/175#issuecomment[PII_REDACTED]
CVE: CVE-2024-12923
Published: 2025-08-29
Description: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following version:
Photo Station 6.4.5 ( 2025/01/02 ) and later
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-25-24