deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-5074
Published: 2025-05-22
Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component PROMPT Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://fitoxs.com/exploit/exploit-f178a364d6fda9f1ff1b6a3e4a09707f746bbd3c34b087c3871e9dc0e00f28df.txt; https://vuldb.com/?ctiid.309954; https://vuldb.com/?id.309954
CVE: CVE-2025-2272
Published: 2025-05-22
Description: Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://support.forcepoint.com/s/article/Security-Advisory-Privilege-Escalation-and-Arbitrary-code-execution-in-F1E-Endpoint
CVE: CVE-2025-3936
Published: 2025-05-22
Description: Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://docs.niagara-community.com/category/tech_bull; https://www.honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3937
Published: 2025-05-22
Description: Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 7.7 (HIGH)
CWE: CWE-916, CWE-916
References: https://docs.niagara-community.com/category/tech_bull; https://www.honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3938
Published: 2025-05-22
Description: Missing Cryptographic Step vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-325, CWE-327
References: https://docs.niagara-community.com/category/tech_bull; https://www.honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3939
Published: 2025-05-22
Description: Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://docs.niagara-community.com/category/tech_bull; https://honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3940
Published: 2025-05-22
Description: Improper Use of Validation Framework vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1173
References: https://docs.niagara-community.com/category/tech_bull; https://honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3941
Published: 2025-05-22
Description: Improper Handling of Windows ::DATA Alternate Data Stream vulnerability in Tridium Niagara Framework on Windows, Tridium Niagara Enterprise Security on Windows allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11.Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-69, CWE-706
References: https://docs.niagara-community.com/category/tech_bull; https://www.honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3942
Published: 2025-05-22
Description: Improper Output Neutralization for Logs vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Input Data Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-117, CWE-116
References: https://www.honeywell.com/us/en/product-security#security-notices; https://www.tridium.com/us/en/product-security
CVE: CVE-2025-3943
Published: 2025-05-22
Description: Use of GET Request Method With Sensitive Query Strings vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Parameter Injection. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-598
References: https://docs.niagara-community.com/category/tech_bull; https://honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3944
Published: 2025-05-22
Description: Incorrect Permission Assignment for Critical Resource vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows File Manipulation. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 7.2 (HIGH)
CWE: CWE-732, CWE-732
References: https://docs.niagara-community.com/category/tech_bull; https://www.honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-3945
Published: 2025-05-22
Description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niagara Enterprise Security: before 4.14.2, before 4.15.1, before 4.10.11. Tridium recommends upgrading to Niagara Framework and Enterprise Security versions 4.14.2u2, 4.15.u1, or 4.10u.11.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88, CWE-88
References: https://docs.niagara-community.com/category/tech_bull; https://honeywell.com/us/en/product-security#security-notices
CVE: CVE-2025-46713
Published: 2025-05-22
Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 0.0.1 and prior to 1.15.12, API_SET_SECURE_PARAM may have an arithmetic overflow deep in the memory allocation subsystem that would lead to a smaller allocation than requested, and a buffer overflow. Version 1.15.12 fixes the issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-5g85-6p6v-r479
CVE: CVE-2025-46714
Published: 2025-05-22
Description: Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. Starting in version 1.3.0 and prior to 1.15.12, API_GET_SECURE_PARAM has an arithmetic overflow leading to a small memory allocation and then a extremely large copy into the small allocation. Version 1.15.12 fixes the issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-c5h5-54gp-xh4q
CVE: CVE-2025-5075
Published: 2025-05-22
Description: A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component DEBUG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-5c08f30e4ae57f2e4b89fbe5a5d6c540e3c359e1e5b12a00d4a6257b1b9fc935.txt; https://vuldb.com/?ctiid.309955; https://vuldb.com/?id.309955
CVE: CVE-2023-47466
Published: 2025-05-22
Description: TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk.
CVSS Score: 2.9 (LOW)
CWE: CWE-476
References: https://github.com/taglib/taglib/commit/dfa33bec0806cbb45785accb8cc6c2048a7d40cf; https://github.com/taglib/taglib/compare/v1.13.1...v2.0; https://github.com/taglib/taglib/issues/1163
CVE: CVE-2025-1110
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.
CVSS Score: 2.7 (LOW)
CWE: CWE-1220, CWE-863
References: https://gitlab.com/gitlab-org/gitlab/-/issues/517693; https://hackerone.com/reports/2972576
CVE: CVE-2025-2853
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of proper validation in GitLab could allow an authenticated user to cause a denial of service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/527218; https://hackerone.com/reports/3015673
CVE: CVE-2025-3111
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in the Kubernetes integration could allow an authenticated user to cause denial of service..
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/533313; https://hackerone.com/reports/3045424
CVE: CVE-2025-4575
Published: 2025-05-22
Description: Issue summary: Use of -addreject option with the openssl x509 application adds
a trusted use instead of a rejected use for a certificate.

Impact summary: If a user intends to make a trusted certificate rejected for
a particular use it will be instead marked as trusted for that use.

A copy & paste error during minor refactoring of the code introduced this
issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate
should be trusted only for the purpose of authenticating TLS servers but not
for CMS signature verification and the CMS signature verification is intended
to be marked as rejected with the -addreject option, the resulting CA
certificate will be trusted for CMS signature verification purpose instead.

Only users which use the trusted certificate format who use the openssl x509
command line application to add rejected uses are affected by this issue.
The issues affecting only the command line application are considered to
be Low severity.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue.

OpenSSL 3.4, 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this
issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://github.com/openssl/openssl/commit/e96d22446e633d117e6c9904cb15b4693e956eaa; https://openssl-library.org/news/secadv/20250522.txt; http://www.openwall.com/lists/oss-security/2025/05/22/1
CVE: CVE-2025-4979
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-1220
References: https://gitlab.com/gitlab-org/gitlab/-/issues/524455
CVE: CVE-2025-5076
Published: 2025-05-22
Description: A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this issue is some unknown functionality of the component SEND Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119, CWE-120
References: https://fitoxs.com/exploit/exploit-9829d8aeaf006c1a3474f4cbcc27d3dd30b5e2053444fd36b805b785f65b2e3e.txt; https://vuldb.com/?ctiid.309956; https://vuldb.com/?id.309956
CVE: CVE-2025-5077
Published: 2025-05-22
Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/GeniusWang23/CVE/issues/1; https://vuldb.com/?ctiid.309957; https://vuldb.com/?id.309957
CVE: CVE-2025-5078
Published: 2025-05-22
Description: A vulnerability was detected in PHPGurukul/Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /admin/subcategory.php. Performing manipulation of the argument Category results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/GeniusWang23/CVE/issues/2; https://vuldb.com/?ctiid.309958; https://vuldb.com/?id.309958
CVE: CVE-2024-12093
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1288
References: https://gitlab.com/gitlab-org/gitlab/-/issues/507445; https://hackerone.com/reports/2851261
CVE: CVE-2024-54188
Published: 2025-05-22
Description: Infoblox NETMRI before 7.6.1 has a vulnerability allowing remote authenticated users to read arbitrary files with root access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.infoblox.com/s/article/Infoblox-NetMRI-is-vulnerable-to-CVE-2024-54188
CVE: CVE-2025-0605
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-1390, CWE-287
References: https://gitlab.com/gitlab-org/gitlab/-/issues/514204; https://hackerone.com/reports/2919391
CVE: CVE-2025-0679
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain conditions un-authorised users can view full email addresses that should be partially obscured.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-359
References: https://gitlab.com/gitlab-org/gitlab/-/issues/514751; https://hackerone.com/reports/2952536
CVE: CVE-2025-0993
Published: 2025-05-22
Description: An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/516927; https://hackerone.com/reports/2967771
CVE: CVE-2025-32813
Published: 2025-05-22
Description: An issue was discovered in Infoblox NETMRI before 7.6.1. Remote Unauthenticated Command Injection can occur.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://support.infoblox.com/s/article/Infoblox-NetMRI-is-vulnerable-to-CVE-2025-32813
CVE: CVE-2025-32814
Published: 2025-05-22
Description: An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://support.infoblox.com/s/article/Infoblox-NetMRI-is-vulnerable-to-CVE-2025-32814
CVE: CVE-2025-32815
Published: 2025-05-22
Description: An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://support.infoblox.com/s/article/Infoblox-NetMRI-is-vulnerable-to-CVE-2025-32815
CVE: CVE-2025-32915
Published: 2025-05-22
Description: Packages downloaded by Checkmk's automatic agent updates on Linux and Solaris have incorrect permissions in Checkmk < 2.4.0p1, < 2.3.0p32, < 2.2.0p42 and <= 2.1.0p49 (EOL). This allows a local attacker to read sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://checkmk.com/werk/17099
CVE: CVE-2025-45471
Published: 2025-05-22
Description: Insecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://gist.github.com/zolaer9527/549d5f466359829a3f1aaafebe7ecc3f; https://github.com/lumigo-io/SAR-measure-cold-start/issues/32
CVE: CVE-2025-5024
Published: 2025-05-22
Description: A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result in gnome-remote-desktop no longer being able to open files even after it is restarted via systemd.
CVSS Score: 7.4 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2025:10631; https://access.redhat.com/errata/RHSA-2025:10635; https://access.redhat.com/errata/RHSA-2025:10742
CVE: CVE-2025-5079
Published: 2025-05-22
Description: A flaw has been found in PHPGurukul/Campcodes Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/updateorder.php. Executing manipulation of the argument remark can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dico-Z/CVE/issues/1; https://vuldb.com/?ctiid.309959; https://vuldb.com/?id.309959
CVE: CVE-2025-5080
Published: 2025-05-22
Description: A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function webExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/xubeining/Cve_report/blob/main/Shenzhen%20Jixiang%20Tengda%20Technology%20Co.%2C%20Ltd.%20FH451%20has%20a%20Remote%20Code%20Execution%20vulnerability.md; https://vuldb.com/?ctiid.309960; https://vuldb.com/?id.309960
CVE: CVE-2025-23182
Published: 2025-05-22
Description: CWE-203: Observable Discrepancy
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-23183
Published: 2025-05-22
Description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-2506
Published: 2025-05-22
Description: When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated tables. When pglogical runs it should verify it is running on a replication connection but does not perform this check. This vulnerability was introduced in the pglogical 3.x codebase, which is proprietary to EDB. The same code base has been integrated into BDR/PGD 4 and 5.
To exploit the vulnerability the attacker needs at least CONNECT permissions to a database configured for replication and must understand a number of pglogical3/BDR specific commands and be able to decode the binary protocol.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://www.enterprisedb.com/docs/security/advisories/cve20252506/
CVE: CVE-2025-45468
Published: 2025-05-22
Description: Insecure permissions in fc-stable-diffusion-plus v1.0.18 allows attackers to escalate privileges and compromise the customer cloud account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://gist.github.com/zolaer9527/fda954ea6ab9a34b3d3de35e7131e3e1
CVE: CVE-2025-4366
Published: 2025-05-22
Description: A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning.

Fixed in:  https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff 

Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to manipulate headers and URLs in subsequent requests made on the same HTTP/1.1 connection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-444
References: https://github.com/cloudflare/pingora
CVE: CVE-2025-5081
Published: 2025-05-22
Description: A vulnerability classified as critical was found in Campcodes Cybercafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adminprofile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/wzylky/CVE/issues/1; https://vuldb.com/?ctiid.309961; https://vuldb.com/?id.309961
CVE: CVE-2024-48850
Published: 2025-05-22
Description: Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources.
This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.
CVSS Score: 7.2 (HIGH)
CWE: CWE-36
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A0021&LanguageCode=en&DocumentPartId=pdf&Action=Launch