deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39478
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartiolabs Smart Notification allows Reflected XSS. This issue affects Smart Notification: from n/a through 10.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/smio-push-notification/vulnerability/wordpress-smart-notification-plugin-10-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39488
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit MagOne magone allows Reflected XSS.This issue affects MagOne: from n/a through <= 8.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/magone/vulnerability/wordpress-magone-theme-8-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-45851
Published: 2025-06-27
Description: An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint /ISAPI/Security/challenge. The vendor has stated that upgrading to V5.7.23_SP2 fixes the issue.
CVSS Score: 7.5 (HIGH)
References: https://assets.hikvision.com/prd/public/all/files/202506/releasenote%5CNetwork_Camera-V5.7.23_SP2_Release_Note-E8.pdf; https://crashpark.weebly.com/blog/hikvision-ip-camera-unauthenticated-denial-of-service-dos; https://www.hikvision.com/en/support/download/firmware/
CVE: CVE-2025-47574
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/school-management/vulnerability/wordpress-school-management-system-plugin-92-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47654
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift allows Reflected XSS.This issue affects FormLift for Infusionsoft Web Forms: from n/a through <= 7.5.20.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/formlift/vulnerability/wordpress-formlift-for-infusionsoft-web-forms-plugin-7-5-19-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49290
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Reflected XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/off-canvas-sidebars/vulnerability/wordpress-off-canvas-sidebars-menus-slidebars-plugin-0-5-8-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49321
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Eventin wp-event-solution allows Reflected XSS.This issue affects Eventin: from n/a through <= 4.0.28.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49416
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows PHP Local File Inclusion.This issue affects FW Gallery: from n/a through <= 8.0.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49423
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Tahir Ali Jan Bulk YouTube Post Creator bulk-youtube-post-creator allows Reflected XSS.This issue affects Bulk YouTube Post Creator: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bulk-youtube-post-creator/vulnerability/wordpress-bulk-youtube-post-creator-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49448
Published: 2025-06-27
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Food Menu  allows Path Traversal. This issue affects FW Food Menu : from n/a through 6.0.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/wordpress/plugin/fw-food-menu/vulnerability/wordpress-fw-food-menu-6-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-49883
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through <= 4.2.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/greenmart/vulnerability/wordpress-greenmart-4-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49885
Published: 2025-06-27
Description: Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/drag-and-drop-file-upload-wc-pro/vulnerability/wordpress-drag-and-drop-multiple-file-upload-pro-woocommerce-5-0-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49886
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab Zikzag Core zikzag-core allows PHP Local File Inclusion.This issue affects Zikzag Core: from n/a through <= 1.4.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/zikzag-core/vulnerability/wordpress-zikzag-core-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-50052
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Counter flexo-countdown allows Reflected XSS.This issue affects Flexo Counter: from n/a through <= 1.0001.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/flexo-countdown/vulnerability/wordpress-flexo-counter-1-0001-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52709
Published: 2025-06-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-52717
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through <= 8.0.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lifterlms/vulnerability/wordpress-lifterlms-8-0-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52722
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoinWebs Classiera classiera allows SQL Injection.This issue affects Classiera: from n/a through <= 4.0.34.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Theme/classiera/vulnerability/wordpress-classiera-4-0-34-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52723
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codesupplyco Networker networker allows PHP Local File Inclusion.This issue affects Networker: from n/a through <= 1.2.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/networker/vulnerability/wordpress-networker-1-2-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52724
Published: 2025-06-27
Description: Deserialization of Untrusted Data vulnerability in BoldThemes Amwerk amwerk allows Object Injection.This issue affects Amwerk: from n/a through <= 1.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/amwerk/vulnerability/wordpress-amwerk-1-2-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52725
Published: 2025-06-27
Description: Deserialization of Untrusted Data vulnerability in pebas CouponXxL couponxxl allows Object Injection.This issue affects CouponXxL: from n/a through <= 3.0.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/couponxxl/vulnerability/wordpress-couponxxl-3-0-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52726
Published: 2025-06-27
Description: Incorrect Privilege Assignment vulnerability in pebas CouponXxL Custom Post Types couponxxl-cpt allows Privilege Escalation.This issue affects CouponXxL Custom Post Types: from n/a through <= 3.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/couponxxl-cpt/vulnerability/wordpress-couponxxl-custom-post-types-3-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-52727
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Vertical Web Pricing Tables css3_vertical_web_pricing_tables allows Reflected XSS.This issue affects CSS3 Vertical Web Pricing Tables: from n/a through <= 1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/css3_vertical_web_pricing_tables/vulnerability/wordpress-css3-vertical-web-pricing-tables-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52729
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/diza/vulnerability/wordpress-diza-1-3-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52774
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.15.06.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/infility-global/vulnerability/wordpress-infility-global-2-12-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52778
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through <= 2.12.5.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xili-dictionary/vulnerability/wordpress-xili-dictionary-2-12-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52799
Published: 2025-06-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through <= 9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/lms/vulnerability/wordpress-lms-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52808
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in real-web RealtyElite realtyelite allows PHP Local File Inclusion.This issue affects RealtyElite: from n/a through <= 1.0.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/realtyelite/vulnerability/wordpress-realtyelite-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52809
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National Weather Service Alerts: from n/a through <= 1.3.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/national-weather-service-alerts/vulnerability/wordpress-national-weather-service-alerts-1-3-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52810
Published: 2025-06-27
Description: Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/wordpress/theme/katerio/vulnerability/wordpress-katerio-magazine-1-5-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52811
Published: 2025-06-27
Description: Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a through <= 1.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/davenport/vulnerability/wordpress-davenport-versatile-blog-and-magazine-wordpress-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52812
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Domnoo domnoo allows PHP Local File Inclusion.This issue affects Domnoo: from n/a through <= 1.49.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/domnoo/vulnerability/wordpress-domnoo-1-49-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52814
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local File Inclusion.This issue affects BRW: from n/a through <= 1.8.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/ova-brw/vulnerability/wordpress-brw-1-7-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52815
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CityGov citygov allows PHP Local File Inclusion.This issue affects CityGov: from n/a through <= 1.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/citygov/vulnerability/wordpress-citygov-1-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52816
Published: 2025-06-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/zita/vulnerability/wordpress-zita-1-6-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52817
Published: 2025-06-27
Description: Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through <= 2.2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/abandoned-contact-form-7/vulnerability/wordpress-abandoned-contact-form-7-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52818
Published: 2025-06-27
Description: Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusty Whistleblowing: from n/a through <= 2.0.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/trusty-whistleblowing-solution/vulnerability/wordpress-trusty-whistleblowing-1-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52824
Published: 2025-06-27
Description: Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mobile-dj-manager/vulnerability/wordpress-mobile-dj-manager-1-7-6-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-52826
Published: 2025-06-27
Description: Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/theme/sala/vulnerability/wordpress-sala-1-1-3-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52827
Published: 2025-06-27
Description: Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through <= 1.3.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/nuss/vulnerability/wordpress-nuss-1-3-3-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52829
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DirectIQ DirectIQ Email Marketing directiq-wp allows SQL Injection.This issue affects DirectIQ Email Marketing: from n/a through <= 2.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/directiq-wp/vulnerability/wordpress-directiq-email-marketing-2-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52834
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Theme/homey/vulnerability/wordpress-homey-2-4-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-6762
Published: 2025-06-27
Description: A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-02.md; https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250618-02.md#steps-to-reproduce; https://vuldb.com/?ctiid.314073
CVE: CVE-2025-6763
Published: 2025-06-27
Description: A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users."
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-306, CWE-306
References: https://github.com/zeke2997/CVE_request_comet_system; https://github.com/zeke2997/CVE_request_comet_system#poc; https://vuldb.com/?ctiid.314074
CVE: CVE-2025-6765
Published: 2025-06-27
Description: A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-275, CWE-639
References: https://vuldb.com/?ctiid.314075; https://vuldb.com/?id.314075; https://vuldb.com/?submit.599873
CVE: CVE-2025-40910
Published: 2025-06-27
Description: Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.

Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/; https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm; https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch
CVE: CVE-2025-53018
Published: 2025-06-27
Description: Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources—such as localhost services or cloud-provider metadata endpoints—become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.
CVSS Score: 3.0 (LOW)
CWE: CWE-918
References: https://github.com/LycheeOrg/Lychee/commit/9dc162eefe56ce185ac1d59da42ee557933d914d; https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v; https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-cpgw-wgf3-xc6v