deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5572
Published: 2025-06-04
Description: A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. Affected by this vulnerability is the function setSystemEmail of the file /setSystemEmail. The manipulation of the argument EmailSMTPPortNumber leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_43/43.md; https://vuldb.com/?ctiid.311029; https://vuldb.com/?id.311029
CVE: CVE-2025-5573
Published: 2025-06-04
Description: A vulnerability was found in D-Link DCS-932L 2.18.01. It has been rated as critical. Affected by this issue is the function setSystemWizard/setSystemControl of the file /setSystemWizard. The manipulation of the argument AdminID leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/wudipjq/my_vuln/blob/main/D-Link5/vuln_44/44.md; https://vuldb.com/?ctiid.311030; https://vuldb.com/?id.311030
CVE: CVE-2025-5574
Published: 2025-06-04
Description: A vulnerability classified as critical has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This affects an unknown part of the file /add-company.php. The manipulation of the argument companyname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/9; https://phpgurukul.com/; https://vuldb.com/?ctiid.311031
CVE: CVE-2025-5575
Published: 2025-06-04
Description: A vulnerability classified as critical was found in PHPGurukul Dairy Farm Shop Management System 1.3. This vulnerability affects unknown code of the file /add-product.php. The manipulation of the argument productname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.311032
CVE: CVE-2024-13967
Published: 2025-06-04
Description: This vulnerability allows the successful attacker to gain unauthorized access to a 
configuration web page delivered by the integrated web Server of EIBPORT.

This issue affects EIBPORT V3 KNX: through 3.9.8; EIBPORT V3 KNX GSM: through 3.9.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A1621&LanguageCode=en&DocumentPartId=pdf&Action=Launch
CVE: CVE-2025-27444
Published: 2025-06-04
Description: A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filter[dateFrom] GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin or editor privileges to inject arbitrary JavaScript code by crafting a malicious URL.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://rsjoomla.com/
CVE: CVE-2025-47724
Published: 2025-06-04
Description: Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00006_CNCSoft%20-%20Out-of-bounds%20Write.pdf
CVE: CVE-2025-47725
Published: 2025-06-04
Description: Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00006_CNCSoft%20-%20Out-of-bounds%20Write.pdf
CVE: CVE-2025-47726
Published: 2025-06-04
Description: Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00006_CNCSoft%20-%20Out-of-bounds%20Write.pdf
CVE: CVE-2025-47727
Published: 2025-06-04
Description: Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00006_CNCSoft%20-%20Out-of-bounds%20Write.pdf
CVE: CVE-2025-47728
Published: 2025-06-04
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00007_CNCSoft-G2%20-%20File%20Parsing%20Memory%20Corruption.pdf
CVE: CVE-2025-5482
Published: 2025-06-04
Description: The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-620
References: https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/trunk/includes/functions/account.php#L303; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3305406%40sunshine-photo-cart%2Ftrunk&old=3261773%40sunshine-photo-cart%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5311b43c-14dd-4bdd-b6d0-d6468b831968?source=cve
CVE: CVE-2025-5576
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Dairy Farm Shop Management System 1.3. This issue affects some unknown processing of the file /bwdate-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.311033
CVE: CVE-2025-5577
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/12; https://phpgurukul.com/; https://vuldb.com/?ctiid.311034
CVE: CVE-2025-5578
Published: 2025-06-04
Description: A vulnerability has been found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sales-report-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/13; https://phpgurukul.com/; https://vuldb.com/?ctiid.311035
CVE: CVE-2025-5579
Published: 2025-06-04
Description: A vulnerability was found in PHPGurukul Dairy Farm Shop Management System 1.3 and classified as critical. Affected by this issue is some unknown functionality of the file /search-product.php. The manipulation of the argument productname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/FLYFISH567/CVE/issues/14; https://phpgurukul.com/; https://vuldb.com/?ctiid.311036
CVE: CVE-2025-5580
Published: 2025-06-04
Description: A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_login.php.md; https://vuldb.com/?ctiid.311037
CVE: CVE-2025-5581
Published: 2025-06-04
Description: A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument User leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_admin_index.php.md; https://vuldb.com/?ctiid.311038
CVE: CVE-2025-5582
Published: 2025-06-04
Description: A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_profile.php.md; https://vuldb.com/?ctiid.311039
CVE: CVE-2018-25112
Published: 2025-06-04
Description: An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creating large amounts of network traffic that needs to be handled by the ILC. This results in a Denial-of-Service of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://certvde.com/en/advisories/VDE-2018-012/
CVE: CVE-2025-5583
Published: 2025-06-04
Description: A vulnerability classified as critical has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /register.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_register.php.md; https://vuldb.com/?ctiid.311040
CVE: CVE-2025-5584
Published: 2025-06-04
Description: A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as problematic. Affected is an unknown function of the file /doctor/edit-patient.php?editid=2 of the component POST Parameter Handler. The manipulation of the argument patname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Ant1sec-ops/Hospital-management-Systemv4.0-Stored-XSS/blob/main/stored-xss-exploit.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.311046
CVE: CVE-2025-5601
Published: 2025-06-04
Description: Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://gitlab.com/wireshark/wireshark/-/issues/20509; https://www.wireshark.org/security/wnpa-sec-2025-02.html
CVE: CVE-2025-30415
Published: 2025-06-04
Description: Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1286
References: https://security-advisory.acronis.com/advisories/SEC-8646
CVE: CVE-2025-48959
Published: 2025-06-04
Description: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40077.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-8133
CVE: CVE-2025-5597
Published: 2025-06-04
Description: Improper Authentication vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Authentication Bypass.This issue affects airleader MASTER: 3.00571.
CWE: CWE-287
References: https://github.com/migros/migros-security-advisories/blob/main/advisories/msec-2025-003_wf-seuerungstechnik-gmbh_airleader-master_authentication-bypass.md
CVE: CVE-2025-5598
Published: 2025-06-04
Description: Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airleader MASTER: 3.0046.
CWE: CWE-35
References: https://github.com/migros/migros-security-advisories/blob/main/advisories/msec-2025-004_wf-seuerungstechnik-gmbh_airleader-master_path-traversal.md
CVE: CVE-2025-1701
Published: 2025-06-04
Description: CVE-2025-1701 is a high-severity vulnerability in the MIM Admin service. An attacker could exploit this vulnerability by sending a specially crafted request over the RMI interface to execute arbitrary code with the privileges of the MIM Admin service. The RMI interface is only accessible locally (listening on 127.0.0.1), limiting the attack vector to the local machine.  This means that in a properly configured hospital environment, an attacker must have already compromised the network and additionally compromised the system where the MIM Admin service is running.  From there, attackers with sufficient knowledge of MIM's implementation, library usage, and functionality with access to extend the MIM RMI library could force the MIM Admin service to run commands on the local machine with its privileges.

Users of MIM Software products exposed via RDP or multi-user application virtualization system should take note that the system being exposed is the environment hosting the virtualized MIM client.



This issue affects MIM Admin Service: before 7.2.13, 7.3.8, 7.4.3
CWE: CWE-20, CWE-306
References: https://www.mimsoftware.com/cve-2025-1701
CVE: CVE-2025-27811
Published: 2025-06-04
Description: A local privilege escalation in the razer_elevation_service.exe in Razer Synapse 4 through 4.0.86[PII_REDACTED] allows a local attacker to escalate their privileges via a vulnerable COM interface in the target service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://app.inspectiv.com/#/submissions/EAEDG9ssRaTWKSJJ5Bbrt9; https://gist.github.com/leonjza/829a98f6c0954d7cb3f6614d05f87f37
CVE: CVE-2025-48960
Published: 2025-06-04
Description: Weak server key used for TLS encryption. The following products are affected: Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: https://security-advisory.acronis.com/advisories/SEC-6403
CVE: CVE-2025-48961
Published: 2025-06-04
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-8000
CVE: CVE-2025-48962
Published: 2025-06-04
Description: Sensitive information disclosure due to SSRF. The following products are affected: Acronis Cyber Protect 16 (Windows, Linux) before build 39938.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://security-advisory.acronis.com/advisories/SEC-8514
CVE: CVE-2025-5592
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functionality of the component PASSIVE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-d28993dd71bcf3fbc63ff58db41e5f10a3ff7932e72d9e25c556cf18921a98e3.txt; https://vuldb.com/?ctiid.311078; https://vuldb.com/?id.311078
CVE: CVE-2025-23095
Published: 2025-06-04
Description: An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23095/
CVE: CVE-2025-23096
Published: 2025-06-04
Description: An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400. A Double Free in the mobile processor leads to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23096/
CVE: CVE-2025-23101
Published: 2025-06-04
Description: An issue was discovered in Samsung Mobile Processor Exynos 1380. A Use-After-Free in the mobile processor leads to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23101/
CVE: CVE-2025-23106
Published: 2025-06-04
Description: An issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2025-23106/
CVE: CVE-2025-29093
Published: 2025-06-04
Description: File Upload vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Content/Gallery/Images component.
CVSS Score: 8.2 (HIGH)
CWE: CWE-434
References: https://github.com/FraMarcuccio/CVE-2025-29093-Arbitrary-File-Upload/blob/main/README.md; https://www.linkedin.com/in/francesco-marcuccio-0433b9218
CVE: CVE-2025-29094
Published: 2025-06-04
Description: Cross Site Scripting vulnerability in Motivian Content Mangment System v.41.0.0 allows a remote attacker to execute arbitrary code via the Marketing/Forms, Marketing/Offers and Content/Pages components.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/FraMarcuccio/CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS; https://github.com/FraMarcuccio/CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS
CVE: CVE-2025-5593
Published: 2025-06-04
Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component HOST Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-9e0f802ba8eab46db6ff5f0c634f96412286b66b33c50a420dd57c1329e3a20d1.txt; https://vuldb.com/?ctiid.311079; https://vuldb.com/?id.311079
CVE: CVE-2025-5594
Published: 2025-06-04
Description: A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the component SET Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-79d290eb2c875b417f7a91769b3bb07a64f2562b57484473ef0f92808bb7dbe2.txt; https://vuldb.com/?ctiid.311080; https://vuldb.com/?id.311080
CVE: CVE-2025-20129
Published: 2025-06-04
Description: A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data.

This vulnerability is due to improper sanitization of HTTP requests that are sent to the web-based chat interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the chat interface of a targeted user on a vulnerable server. A successful exploit could allow the attacker to redirect chat traffic to a server that is under their control, resulting in sensitive information being redirected to the attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccp-info-disc-ZyGerQpd
CVE: CVE-2025-20130
Published: 2025-06-04
Description: A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device.

This vulnerability is due to improper validation of the file copy function. An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API endpoint. A successful exploit could allow the attacker to upload arbitrary files to an affected system.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-P4M8vwXY
CVE: CVE-2025-20163
Published: 2025-06-04
Description: A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices.

This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on SSH connections to Cisco NDFC-managed devices, which could allow an attacker to intercept this traffic. A successful exploit could allow the attacker to impersonate a managed device and capture user credentials.
CVSS Score: 8.7 (HIGH)
CWE: CWE-322
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfc-shkv-snQJtjrp