deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58337
Published: 2025-11-05
Description: An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions.


Impact:

Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.




Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h; http://www.openwall.com/lists/oss-security/2025/11/04/5
CVE: CVE-2025-11745
Published: 2025-11-05
Description: The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter' shortcode in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.7/ad-inserter.php#L9333; https://plugins.trac.wordpress.org/browser/ad-inserter/tags/2.8.7/ad-inserter.php#L9870; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e7831c5-2262-42c9-9655-a43ef2dac54f?source=cve
CVE: CVE-2025-12497
Published: 2025-11-05
Description: The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio; https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve
CVE: CVE-2025-3125
Published: 2025-11-05
Description: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled location on the server, potentially leading to remote code execution (RCE).

This functionality is restricted by default to admin users; therefore, successful exploitation requires valid credentials with administrative permissions.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-434
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3961/
CVE: CVE-2025-46404
Published: 2025-11-05
Description: A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr&#39;ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2194; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2194
CVE: CVE-2025-46705
Published: 2025-11-05
Description: A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2196; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2196
CVE: CVE-2025-46784
Published: 2025-11-05
Description: A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr&#39;ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2195; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2195
CVE: CVE-2025-47151
Published: 2025-11-05
Description: A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr&#39;ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843
References: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2193; https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2193
CVE: CVE-2025-52602
Published: 2025-11-05
Description: HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.  An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs).   An attacker can use that information to target individuals with phishing or other social-engineering attacks.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-359
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124950
CVE: CVE-2025-61084
Published: 2025-11-05
Description: MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing even when anti-spoofing protections are in place. NOTE: this is disputed by the Supplier because UI spoofing occurs in a client, not in a server such as MDaemon's product or any other server implementation. Also, if a client without its own spoofing protection must be used, the Header Screening feature in MDaemon's product can be employed to mitigate the client-side vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-116
References: https://github.com/x00nullbit/CVE-References/blob/main/CVE-2025-61084/README.md
CVE: CVE-2025-64458
Published: 2025-11-05
Description: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-407
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
CVE: CVE-2025-64459
Published: 2025-11-05
Description: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: https://docs.djangoproject.com/en/dev/releases/security/; https://groups.google.com/g/django-announce; https://www.djangoproject.com/weblog/2025/nov/05/security-releases/
CVE: CVE-2025-57130
Published: 2025-11-05
Description: An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges. By sending a specially crafted HTTP request, a low-privilege user can access and modify the profile data of any other user, including administrators.
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: http://zwiicms.com; https://blog.nivel4.com/noticias/cve-2025-57130-especialistas-de-nivel4-identifican-falla-de-alta-severidad-en-gestor-de-contenidos
CVE: CVE-2025-60753
Published: 2025-11-05
Description: An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-835
References: https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753; https://github.com/libarchive/libarchive/issues/2725
CVE: CVE-2025-61304
Published: 2025-11-05
Description: OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pentastic-be/CVE-2025-61304
CVE: CVE-2025-63601
Published: 2025-11-05
Description: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://dappsec.substack.com/p/snipe-it-post-authenticated-remote; https://fptcloud.com/en/cve-2025-63601-proof-of-concept/; https://github.com/grokability/snipe-it/pull/17966
CVE: CVE-2025-20289
Published: 2025-11-05
Description: Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface.
 These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiple-vulns-O9BESWJH
CVE: CVE-2025-20303
Published: 2025-11-05
Description: Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface.
 These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiple-vulns-O9BESWJH
CVE: CVE-2025-20304
Published: 2025-11-05
Description: Multiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface.
 These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have at least a low-privileged account on the affected device.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiple-vulns-O9BESWJH
CVE: CVE-2025-20305
Published: 2025-11-05
Description: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device.
 This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could exploit this vulnerability by performing actions where the results should only be viewable to a high-privileged user. A successful exploit could allow the attacker to view passwords that are normally not visible to read-only administrators.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1220
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiple-vulns-O9BESWJH
CVE: CVE-2025-20343
Published: 2025-11-05
Description: A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly.

This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint. An attacker could exploit this vulnerability by sending a specific sequence of multiple crafted RADIUS access request messages to Cisco ISE. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when Cisco ISE restarts.
CVSS Score: 8.6 (HIGH)
CWE: CWE-697
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-radsupress-dos-8YF3JThh
CVE: CVE-2025-20354
Published: 2025-11-05
Description: A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system.

This vulnerability is due to improper authentication mechanisms that are associated to specific Cisco Unified CCX features. An attacker could exploit this vulnerability by uploading a crafted file to an affected system through the Java RMI process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-unauth-rce-QeN8h7mQ
CVE: CVE-2025-20358
Published: 2025-11-05
Description: A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution.

This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-306
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-unauth-rce-QeN8h7mQ
CVE: CVE-2025-20374
Published: 2025-11-05
Description: A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.

This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a crafted request to the web UI. A successful exploit could allow the attacker to gain read access to arbitrary files on the underlying operating system.&nbsp;To exploit this vulnerability, the attacker must have valid administrative credentials.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn
CVE: CVE-2025-20375
Published: 2025-11-05
Description: A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.

This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a crafted file to the web UI. A successful exploit could allow the attacker to upload arbitrary files to a vulnerable system and execute them, gaining access to the underlying operating system. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn
CVE: CVE-2025-20376
Published: 2025-11-05
Description: A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files.

This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the web UI and executing it. A successful exploit could allow the attacker to execute arbitrary commands on the underlying system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn
CVE: CVE-2025-20377
Published: 2025-11-05
Description: A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system.

This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this vulnerability by sending a valid request to a specific API endpoint within the affected system. A successful exploit could allow a low-privileged user to view sensitive information on the affected system that should be restricted. To exploit this vulnerability, the attacker must have valid user credentials on the affected system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-mult-vuln-gK4TFXSn
CVE: CVE-2025-30479
Published: 2025-11-05
Description: Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-43990
Published: 2025-11-05
Description: Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVSS Score: 7.3 (HIGH)
CWE: CWE-250
References: https://www.dell.com/support/kbdoc/en-us/000384947/dsa-2025-414
CVE: CVE-2025-45378
Published: 2025-11-05
Description: Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system.

If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-45379
Published: 2025-11-05
Description: Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system.
CVSS Score: 8.4 (HIGH)
CWE: CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-46364
Published: 2025-11-05
Description: Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control of system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-46365
Published: 2025-11-05
Description: Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-46366
Published: 2025-11-05
Description: Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential information.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-256
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-46424
Published: 2025-11-05
Description: Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privileged attacker could potentially exploit this vulnerability leading to Denial of service.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1240
References: https://www.dell.com/support/kbdoc/en-us/000384363/dsa-2025-374-security-update-for-dell-cloudlink-multiple-security-vulnerabilities
CVE: CVE-2025-57244
Published: 2025-11-05
Description: OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wolffangsecurity/CVEs/blob/main/Stored%20XSS%20via%20Input%20Fields%20with%20Inconsistent%20Client-Side%20and%20Server-Side%20Validation%20Writeup.md; https://github.com/wolffangsecurity/CVEs/tree/main/CVE-2025-57244
CVE: CVE-2025-59716
Published: 2025-11-05
Description: ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validation of the supplied token in showPasswordForm, the server responds differently when an e-mail address corresponds to a valid pending guest user rather than a non-existent user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://gist.github.com/thesmartshadow/64ae0449e909174d0479a4f23657147f; https://github.com/owncloud/guests; https://marketplace.owncloud.com/apps/guests