deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4219
Published: 2025-05-21
Description: The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/dpepress/trunk/dpepress.php#L72; https://www.wordfence.com/threat-intel/vulnerabilities/id/ccd273dc-9de3-4863-a787-db653f2003ca?source=cve
CVE: CVE-2025-4221
Published: 2025-05-21
Description: The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/animated-buttons/trunk/Animated_Buttons.php#L52; https://www.wordfence.com/threat-intel/vulnerabilities/id/e778399f-f7fe-47c5-9722-b833d78f475c?source=cve
CVE: CVE-2025-4611
Published: 2025-05-21
Description: The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/elightup/slim-seo/commit/b475dceff3a6bd94335d5a79eb12cdd92e2c8350; https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.5.3/src/Breadcrumbs.php#L109; https://plugins.trac.wordpress.org/browser/slim-seo/tags/4.5.3/src/Breadcrumbs.php#L37
CVE: CVE-2025-4803
Published: 2025-05-21
Description: The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://github.com/bfiessinger/wppedia/blob/1d0b8568349c9c9479372f845a812eb2aa4b3d09/core/classes/traits/trait-sanitizes-data.php#L64; https://plugins.trac.wordpress.org/browser/wppedia/tags/1.3.0/core/classes/class-options.php#L396; https://plugins.trac.wordpress.org/browser/wppedia/tags/1.3.0/core/classes/traits/trait-sanitizes-data.php#L64
CVE: CVE-2025-1416
Published: 2025-05-21
Description: In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417.

This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-863
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-1417
Published: 2025-05-21
Description: In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by the MDM (Mobile Device Management). This information include user ids, email addresses, first names, last names and device UUIDs. The last one can be used for exploitation of CVE-2025-1416.

Successful exploitation requires UUID of a targeted backup, which cannot be brute forced. 

This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-863
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-1418
Published: 2025-05-21
Description: A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information (including their usage in connected devices).   


This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-863
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-1419
Published: 2025-05-21
Description: Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.


This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-79
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-1420
Published: 2025-05-21
Description: Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack.


This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-79
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-1421
Published: 2025-05-21
Description: Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC.


This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-1236
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-40775
Published: 2025-05-21
Description: When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it.  If the TSIG contains an invalid value in the algorithm field, BIND immediately aborts with an assertion failure.
This issue affects BIND 9 versions 9.20.0 through 9.20.8 and 9.21.0 through 9.21.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-232
References: https://kb.isc.org/docs/cve-2025-40775; http://www.openwall.com/lists/oss-security/2025/05/21/1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-48415
Published: 2025-05-21
Description: A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor  or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-749
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2025-48416
Published: 2025-05-21
Description: An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.
CVSS Score: 8.1 (HIGH)
CWE: CWE-912
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2025-48417
Published: 2025-05-21
Description: The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin interface. The files are located in /etc/ssl (e.g. salia.local.crt, salia.local.key and salia.local.pem). There is no option to upload/configure custom TLS certificates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-321
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2024-42922
Published: 2025-05-21
Description: AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://gist.github.com/mstfsec/c4c05ddfb1cf8779422ff780587723c8
CVE: CVE-2024-56429
Published: 2025-05-21
Description: itech iLabClient 3.7.1 relies on the hard-coded YngAYdgAE/kKZYu2F2wm6w== key (found in iLabClient.jar) for local users to read or write to the database.
CVSS Score: 7.7 (HIGH)
CWE: CWE-321
References: https://github.com/lisa-2905/CVE-2024-56429; https://itech-gmbh.de/produkte/
CVE: CVE-2025-44892
Published: 2025-05-21
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ownekey parameter in the web_rmon_alarm_post_rmon_alarm function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/20/web-rmon-alarm-post-rmon-alarm-owne/
CVE: CVE-2025-44895
Published: 2025-05-21
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ipv4Aclkey parameter in the web_acl_ipv4BasedAceAdd function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/18/web-acl-ipv4BasedAceAdd-post-ipv4Acl-StackOverflow/
CVE: CVE-2024-23337
Published: 2025-05-21
Description: jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of[PII_REDACTED], the signed integer limit. This causes a denial of service. Commit de21386681c0df0104a99d9d09db23a9b2a78b1e contains a patch for the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-190
References: https://github.com/jqlang/jq/commit/de21386681c0df0104a99d9d09db23a9b2a78b1e; https://github.com/jqlang/jq/issues/3262; https://github.com/jqlang/jq/security/advisories/GHSA-2q6r-344g-cx46
CVE: CVE-2025-5029
Published: 2025-05-21
Description: A vulnerability has been found in Kingdee Cloud Galaxy Private Cloud BBC System up to 9.0 Patch April 2025 and classified as critical. Affected by this vulnerability is the function BaseServiceFactory.getFileUploadService.deleteFileAction of the file fileUpload/deleteFileAction.jhtml of the component File Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://vip.kingdee.com/knowledge/[PII_REDACTED]11770368; https://vip.kingdee.com/school/detail/[PII_REDACTED]45944320?productLineId=1&lang=zh-CN; https://vuldb.com/?ctiid.309847
CVE: CVE-2025-27997
Published: 2025-05-21
Description: An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData directory.
CVSS Score: 8.4 (HIGH)
CWE: CWE-427
References: https://gist.github.com/sornram9254/4593dd5eb2bcca50d68dc6ac70e40b24
CVE: CVE-2025-27998
Published: 2025-05-21
Description: An issue in Valvesoftware Steam Client Steam Client[PII_REDACTED] allows attackers to escalate privileges via a crafted executable or DLL.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94
References: https://gist.github.com/sornram9254/e8d10efcf246cc50ff3d4f837b261616
CVE: CVE-2025-48200
Published: 2025-05-21
Description: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-502
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-008
CVE: CVE-2025-48201
Published: 2025-05-21
Description: The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
CVSS Score: 8.6 (HIGH)
CWE: CWE-425
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-007
CVE: CVE-2025-48202
Published: 2025-05-21
Description: The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-425
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-006
CVE: CVE-2025-48203
Published: 2025-05-21
Description: The cs_seo extension through 9.2.0 for TYPO3 allows XSS.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-005
CVE: CVE-2025-48204
Published: 2025-05-21
Description: The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-78
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-007
CVE: CVE-2025-48205
Published: 2025-05-21
Description: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.
CVSS Score: 8.6 (HIGH)
CWE: CWE-425
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-008
CVE: CVE-2025-48206
Published: 2025-05-21
Description: The ns_backup extension through 13.0.0 for TYPO3 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-007
CVE: CVE-2025-48207
Published: 2025-05-21
Description: The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
CVSS Score: 8.6 (HIGH)
CWE: CWE-425
References: https://typo3.org/security/advisory/typo3-ext-sa-2025-004
CVE: CVE-2025-4008
Published: 2025-05-21
Description: The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.

This web interface exposes an endpoint that is vulnerable to command injection.

Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-306
References: https://forum.meteohub.de/viewtopic.php?t=18687; https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008
CVE: CVE-2024-56428
Published: 2025-05-21
Description: The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the CONFIGS table) for their servers configured in the client.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://github.com/lisa-2905/CVE-2024-56428; https://itech-gmbh.de/#ueber-itech
CVE: CVE-2025-0372
Published: 2025-05-21
Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue affects HYPR Passwordless: before 10.1.
CWE: CWE-362
References: https://www.hypr.com/trust-center/security-advisories
CVE: CVE-2025-20112
Published: 2025-05-21
Description: A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device.

This vulnerability is due to excessive permissions that have been assigned to system commands.&nbsp;An attacker could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of an affected device. To successfully exploit this vulnerability, an attacker would need administrative access to the ESXi hypervisor.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-268
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-kkhZbHR5
CVE: CVE-2025-20113
Published: 2025-05-21
Description: A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system.

This vulnerability is due to insufficient server-side validation of user-supplied parameters in API or HTTP requests. An attacker could exploit this vulnerability by submitting a crafted API or HTTP request to an affected system. A successful exploit could allow the attacker to access, modify, or delete data beyond the sphere of their intended access level, including obtaining potentially sensitive information stored in the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-602
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-priv-esc-3Pk96SU4
CVE: CVE-2025-20114
Published: 2025-05-21
Description: A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system.

This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-priv-esc-3Pk96SU4
CVE: CVE-2025-20152
Published: 2025-05-21
Description: A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a specific authentication request to a network access device (NAD) that uses Cisco ISE for authentication, authorization, and accounting (AAA). A successful exploit could allow the attacker to cause Cisco ISE to reload.
CVSS Score: 8.6 (HIGH)
CWE: CWE-125
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-restart-ss-uf986G2Q
CVE: CVE-2025-20242
Published: 2025-05-21
Description: A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacker to read and modify data on an affected device.
 This vulnerability is due to a lack of proper authentication controls. An attacker could exploit this vulnerability by sending crafted TCP data to a specific port on an affected device. A successful exploit could allow the attacker to read or modify data on the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-contcent-insuffacces-ArDOVhN8
CVE: CVE-2025-20246
Published: 2025-05-21
Description: A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
 A vulnerability is due to improper filtering of user-supplied input. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to conduct a cross-site scripting attack against the targeted user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8
CVE: CVE-2025-20247
Published: 2025-05-21
Description: A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
 A vulnerability is due to improper filtering of user-supplied input. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to conduct a cross-site scripting attack against the targeted user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8
CVE: CVE-2025-20250
Published: 2025-05-21
Description: A vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack.
 A vulnerability is due to improper filtering of user-supplied input. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to conduct a cross-site scripting attack against the targeted user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-7teQtFn8
CVE: CVE-2025-20255
Published: 2025-05-21
Description: A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the meeting join service.
 This vulnerability is due to improper handling of malicious HTTP requests to the affected service. An attacker could exploit this vulnerability by manipulating stored HTTP responses within the service, also known as HTTP cache poisoning. A successful exploit could allow the attacker to cause the Webex Meetings service to return incorrect HTTP responses to clients.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-349
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cache-Q4xbkQBG
CVE: CVE-2025-20256
Published: 2025-05-21
Description: A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system.

This vulnerability is due to insufficient input validation in specific fields of the web-based management interface. An attacker with valid administrative credentials could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.&nbsp;
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-ssti-dPuLqSmZ
CVE: CVE-2025-20257
Published: 2025-05-21
Description: A vulnerability in an API subsystem of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with low privileges to generate fraudulent findings that are used to generate alarms and alerts on an affected product.

Thi vulnerability is due to insufficient authorization enforcement on a specific API. An attacker could exploit this vulnerability by authenticating as a low-privileged user and performing API calls with crafted input. A successful exploit could allow the attacker to obfuscate legitimate findings in analytics reports or create false indications with alarms and alerts on an affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sna-apiacv-4B6X5ysw