deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-62695
Published: 2025-10-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1173952; https://phabricator.wikimedia.org/T400500; https://phabricator.wikimedia.org/T400500
CVE: CVE-2025-62696
Published: 2025-10-21
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master.
CWE: CWE-77
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Springboard/+/1174003; https://phabricator.wikimedia.org/T400422; https://phabricator.wikimedia.org/T400422
CVE: CVE-2025-62699
Published: 2025-10-21
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting.
Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong IP and User-Agent making these edits un-auditable via the CheckUser tool.This issue affects Mediawiki - Translate Extension: from master before 1.39.
CWE: CWE-200
References: https://gerrit.wikimedia.org/r/q/I65c740c8ca5130b40463d687e2f0775951abbf22; https://gerrit.wikimedia.org/r/q/Idac164418362c65d0ad37055fe9e0ad134197da3; https://phabricator.wikimedia.org/T399627
CVE: CVE-2025-62694
Published: 2025-10-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/1191439; https://gerrit.wikimedia.org/r/q/I17fc061112f61b4c37b772410b265df060819416; https://phabricator.wikimedia.org/T400525
CVE: CVE-2025-62701
Published: 2025-10-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikistories/+/1189218; https://phabricator.wikimedia.org/T400545; https://phabricator.wikimedia.org/T400545
CVE: CVE-2025-62702
Published: 2025-10-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.
CWE: CWE-79
References: https://gerrit.wikimedia.org/r/q/I86c5f17364c7351e7c06ce4cc6e5592467bc8dc3; https://phabricator.wikimedia.org/T400526; https://phabricator.wikimedia.org/T400526
CVE: CVE-2025-10916
Published: 2025-10-21
Description: The FormGent  WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
CVSS Score: 9.1 (CRITICAL)
References: https://wpscan.com/vulnerability/81c23998-1abb-495f-890a-79624a4cab9a/; https://wpscan.com/vulnerability/81c23998-1abb-495f-890a-79624a4cab9a/
CVE: CVE-2025-11949
Published: 2025-10-21
Description: EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.twcert.org.tw/en/cp-139-10455-5b9ac-2.html; https://www.twcert.org.tw/tw/cp-132-10454-35844-1.html
CVE: CVE-2025-12004
Published: 2025-10-21
Description: Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.
CWE: CWE-732
References: https://gerrit.wikimedia.org/r/q/Id[PII_REDACTED]57004fa7fc56318fc104d8e2d267b; https://phabricator.wikimedia.org/T397521; https://phabricator.wikimedia.org/T397521
CVE: CVE-2025-26392
Published: 2025-10-21
Description: SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26392
CVE: CVE-2025-10612
Published: 2025-10-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows Reflected XSS.This issue affects City Guide: before 1.4.45.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.usom.gov.tr/bildirim/tr-25-0350
CVE: CVE-2025-5496
Published: 2025-10-21
Description: ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: https://www.manageengine.com/products/desktop-central/kb/arbitrary-file-deletion-allows-local-privilege-escalation.html
CVE: CVE-2025-7473
Published: 2025-10-21
Description: Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-91
References: https://www.manageengine.com/products/desktop-central/parsing-xml-data.html
CVE: CVE-2025-10639
Published: 2025-10-21
Description: The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://r.sec-consult.com/workexaminer; http://seclists.org/fulldisclosure/2025/Oct/19
CVE: CVE-2025-10640
Published: 2025-10-21
Description: An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer server and therefore all sensitive monitoring data. This includes monitored screenshots and keystrokes of all users.

The WorkExaminer Professional console is used for administrative access to the server. Before access to the console is granted administrators must login. Internally, a custom protocol is used to call a respective stored procedure on the MSSQL database. The return value of the call is not validated on the server-side. Instead it is only validated client-side which allows to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-602
References: https://r.sec-consult.com/workexaminer; http://seclists.org/fulldisclosure/2025/Oct/19
CVE: CVE-2025-10641
Published: 2025-10-21
Description: All WorkExaminer Professional traffic between monitoring client, console and server is transmitted as plain text. This allows an attacker with access to the network to read the transmitted sensitive data. An attacker can also freely modify the data on the wire. The monitoring clients transmit their data to the server using the unencrypted FTP. Clients connect to the FTP server on port 12304 and transmit the data unencrypted. In addition, all traffic between the console client and the server at port 12306 is unencrypted.
CVSS Score: 7.1 (HIGH)
CWE: CWE-319
References: https://r.sec-consult.com/workexaminer; http://seclists.org/fulldisclosure/2025/Oct/19
CVE: CVE-2025-9428
Published: 2025-10-21
Description: Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com/analytics-plus/CVE-2025-9428.html
CVE: CVE-2025-10020
Published: 2025-10-21
Description: Zohocorp ManageEngine ADManager Plus version before 8024 are vulnerable to authenticated command injection vulnerability in the Custom Script component.
CVSS Score: 8.5 (HIGH)
CWE: CWE-77
References: https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2025-10020.html
CVE: CVE-2025-6239
Published: 2025-10-21
Description: Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-6239.html
CVE: CVE-2025-11151
Published: 2025-10-21
Description: Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz Bilgisayar Software Design Industry and Trade Ltd. Co. CityPLus allows Detect Unpublicized Web Pages.This issue affects CityPLus: before V24.29500.1.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200, CWE-497
References: https://www.usom.gov.tr/bildirim/tr-25-0351
CVE: CVE-2025-11624
Published: 2025-10-21
Description: Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptor size, but smaller than max handle size allowed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/wolfSSL/wolfssh/pull/834
CVE: CVE-2025-11625
Published: 2025-10-21
Description: Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/wolfSSL/wolfssh/pull/840
CVE: CVE-2025-9339
Published: 2025-10-21
Description: SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit.

























This issue affects SIMPLE.ERP in versions before 6.30@a04.3.
CWE: CWE-89
References: https://cert.pl/en/posts/2025/10/CVE-2025-9339/; https://simple.com.pl/
CVE: CVE-2020-36855
Published: 2025-10-21
Description: A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121
References: https://shimo.im/docs/rp3OMVMDPKtjn0km/; https://vuldb.com/?ctiid.329028; https://vuldb.com/?id.329028
CVE: CVE-2022-4981
Published: 2025-10-21
Description: A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the component dcmqrscp. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit is now public and may be used. Upgrading to version 3.6.8 is sufficient to resolve this issue. The patch is identified as 957fb31e5. Upgrading the affected component is advised.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://shimo.im/docs/e1Azd4dDQXUgOGqW/; https://support.dcmtk.org/redmine/issues/1026; https://vuldb.com/?ctiid.329029
CVE: CVE-2025-56450
Published: 2025-10-21
Description: Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/selfcareLeadHistory` endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. The backend fails to sanitize the user input, allowing enumeration of database schemas, table names, and potentially leading to full database compromise.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/apboss123/CVE-2025-56450/blob/main/README.md; https://reference1.example.com/selfcare/login
CVE: CVE-2025-57521
Published: 2025-10-21
Description: Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup. The application loads a network plugin without validating its digital signature or verifying its authenticity. A local attacker can exploit this behavior by placing a malicious component in the expected location, which is controllable by the attacker (e.g., under %APPDATA%), resulting in code execution within the context of the user. The main application is digitally signed, which may allow a malicious component to inherit trust and evade detection by security solutions that rely on signed parent processes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-77
References: https://github.com/bambulab/BambuStudio/issues/7405; https://github.com/piuppi/Proof-of-Concepts/blob/main/Bambu%20Lab/Bambu%20Studio/README.md; https://wiki.bambulab.com/en/software/bambu-studio/release/release-note-2-3-0
CVE: CVE-2025-59438
Published: 2025-10-21
Description: Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-208
References: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-invalid-padding-error/; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
CVE: CVE-2025-60344
Published: 2025-10-21
Description: A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). Successful exploitation may allow access to files outside of the intended directory, potentially exposing sensitive system or configuration files. The issue results from insufficient validation or sanitization of user-supplied input. Affected Products include: DSR-150, DSR-150N, and DSR-250N v1.09B32_WW.
CVSS Score: 8.6 (HIGH)
CWE: CWE-24, CWE-200
References: https://github.com/fyoozr/D-Link-DSR-N250-LFI-Vulnerability/; https://github.com/fyoozr/vulnerability-research/tree/main/CVE-2025-60344
CVE: CVE-2025-60932
Published: 2025-10-21
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step Description, Note Name, and Goal Description parameters. The patched version is PP-Release-6.3.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-current-goals
CVE: CVE-2025-60933
Published: 2025-10-21
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step Description, Note Name, and Goal Description parameters. The patched version is PP-Release-6.3.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-future-goals
CVE: CVE-2025-60934
Published: 2025-10-21
Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the index.php component of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee Notes, title, or description parameters. The patched version is PP-Release-6.3.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.offsecguy.com/cve/hr-performance-solutions/vulnerability/reflected-xss-employee-notes
CVE: CVE-2025-12024
Published: 2025-10-21
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-22166
Published: 2025-10-21
Description: This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center.

This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network.

Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.25
 Confluence Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.7
 Confluence Data Center and Server 10.0: Upgrade to a release greater than or equal to 10.0.2

See the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).

This vulnerability was reported via our Atlassian (Internal) program.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/CONFSERVER-100907
CVE: CVE-2025-60280
Published: 2025-10-21
Description: Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly in the browser. When exploited, an attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, and a broader attack surface for more advanced exploitation techniques.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/debug-security/CVE/tree/main/CVE-2025-60280; https://vwrap.live/stored-xss-in-bangresto
CVE: CVE-2025-60751
Published: 2025-10-21
Description: GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121
References: https://github.com/geographiclib/geographiclib/issues/43; https://github.com/zer0matt/CVE-2025-60751; https://lists.debian.org/debian-lts-announce/2025/11/msg00004.html
CVE: CVE-2025-61181
Published: 2025-10-21
Description: daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://github.com/jayfoxaa/yuhang-Zhou/blob/main/upload/readme.md
CVE: CVE-2025-61194
Published: 2025-10-21
Description: daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/wzy-most/zeyu-Wang/blob/main/sql/readme.md
CVE: CVE-2025-61220
Published: 2025-10-21
Description: The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://autobizline.com; https://autobizline.com/secondline/user/get_user/; https://github.com/syz913/CVE-reports/blob/main/CVE-2025-61220.md
CVE: CVE-2025-62250
Published: 2025-10-21
Description: Improper Authentication in Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to send malicious data to the Liferay Portal 7.4.0 through 7.4.3.132, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions that will treat it as trusted data via unauthenticated cluster messages.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62250
CVE: CVE-2025-11534
Published: 2025-10-21
Description: The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.
CWE: CWE-288
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-294-06; https://www.runzero.com/advisories/raisecom-ssh-bypass-cve-2025-11534/
CVE: CVE-2025-60500
Published: 2025-10-21
Description: QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/H4zaz/CVE-2025-60500
CVE: CVE-2025-60506
Published: 2025-10-21
Description: Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/onurcangnc/moodle-xss-pdfannotator; https://onurcangenc.com.tr/blog/moodle-xss-pdfannotator; https://onurcangenc.com.tr/posts/cve-2025-60506-stored-cross-site-scripting-xss-in-moodle-pdf-annotator-plugin-v1-5-release-9/
CVE: CVE-2025-60511
Published: 2025-10-21
Description: Moodle OpenAI Chat Block plugin 3.0.[PII_REDACTED]) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries that are executed with that block's configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: http://moodle.com; http://openai.com; https://github.com/onurcangnc/moodle_block_openai_chat